# US 2017/0255683 A1 · Processing of Performance Data and Structure Data by Thresholding Log Data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0255683 A1 - Document ID: US20170255683A1 - Status: Published application - Kind: A1 - Application number: 15/421,395 - Filed: 2017-01-31 - Published: 2017-09-07 - Earliest claimed: 2013-04-30 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Brian BINGHAM; Tristan FLETCHER; Alok Anant BHIDE - Web page: https://patentgrep.com/patent/US20170255683A1 ## CPC - G06F 16/248: Presentation of query results - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - G06F 11/3024: {where the computing system component is a central processing unit [CPU]} - G06F 11/3037: {where the computing system component is a memory, e.g. virtual memory, cache (accessing, addressing or allocating within memory systems or architectures G06F12/00; checking stores for correct operation G11C29/00)} - G06F 11/323: {Visualisation of programs or trace data} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 16/26: Visual data mining; Browsing structured data - G06F 17/40: Data acquisition and logging (for input to computer G06F3/00) - G06F 11/3409: {for performance assessment} - G06F 2201/815: Virtual - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data. ## Claims ### Claim 1 A method comprising: acquiring, by a computer system, a plurality of performance measurements for each of at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment; acquiring, by the computer system, a plurality of portions of log data representing activity of at least one hardware or software component of the IT environment; correlating, by the computer system, at least one of the portions of log data with at least one of the performance measurements, by determining that one of the portions of log data has a specified relationship to a threshold value, and in response to determining that said one of the portions of log data has the specified relationship to the threshold value, identifying at least one of the performance measurements that has a time stamp corresponding to a time stamp of said one of the portions of log data; and causing display of an indication of correlation between said one of the portions of log data and the identified at least one of the performance measurements. ### Claim 2 (depends on 1) A method as recited in claim 1, further comprising: causing display of said one of the portions of log data and the identified at least one of the performance measurements. ### Claim 3 (depends on 1) A method as recited in claim 1, further comprising: causing concurrent display of said one of the portions of log data and the identified at least one of the performance measurements. ### Claim 4 (depends on 1) A method as recited in claim 1, further comprising: causing concurrent display of a listing of raw log data from said one of the portions of log data and the identified at least one of the performance measurements. ### Claim 5 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a user-specified search criterion. ### Claim 6 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a user-specified search criterion that is not a time-based criterion. ### Claim 7 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a user-specified search criterion that relates to a machine in the IT environment. ### Claim 8 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a correlation criterion, the method further comprising: obtaining the correlation criterion from a user input to a graphical user interface element that enables a user to input a search criterion as said correlation criterion but does not enable input of a complete search query. ### Claim 9 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a correlation criterion, the method further comprising: obtaining the correlation criterion from a user's selection from a drop-down list in a graphical user interface. ### Claim 10 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a correlation criterion that relates to a machine in the IT environment and is specified by a user's selection from a drop-down list of machines included in the IT environment. ### Claim 11 (depends on 1) A method as recited in claim 1, wherein said correlating is based on a correlation criterion, the method further comprising, prior to said correlating: obtaining the correlation criterion from a search query input by a user into a query box in a text-based search query language. ### Claim 12 (depends on 1) A method as recited in claim 1, wherein said storing comprises storing each of the acquired performance measurements and each of the acquired portions of log data with a time-stamp in a time-series data store; said correlating further comprises identifying at least one of the stored performance measurements and at least one of the stored portions of log data that have time stamps that satisfy a user-specified time criterion. ### Claim 13 (depends on 1) A method as recited in claim 1, wherein the performance measurements have been determined by direct measurement of a hardware or software component in the IT environment. ### Claim 14 (depends on 1) A method as recited in claim 1, wherein the plurality of portions of log data are derived from a text-based log file. ### Claim 15 (depends on 1) A method as recited in claim 1, wherein the plurality of performance measurements are not derived from a log file and are acquired independently of the plurality of portions of log data. ### Claim 16 (depends on 1) A method as recited in claim 1, wherein the plurality of performance measurements are acquired independently of the plurality of portions of log data, and wherein the performance measurements have been determined by direct measurement of a hardware or software component in the IT environment and the plurality of portions of log data are derived from a text-based log file. ### Claim 17 (depends on 1) A method as recited in claim 1, wherein the plurality of performance measurements are acquired independently of the plurality of portions of log data by direct measurement of a hardware or software component in the IT environment, and the plurality of portions of log data are acquired independently of the performance measurements. ### Claim 18 (depends on 1) A method as recited in claim 1, wherein acquiring the plurality of performance measurements comprises acquiring, via an application programming interface (API), the plurality of performance measurements from a third-party software application that collects the performance measurements. ### Claim 19 (depends on 1) A method as recited in claim 1, wherein the performance measurements are stored in a first time-series data store, and the portions of log data are stored in a second time-series data store separate from the first time-series data store. ### Claim 20 (depends on 1) A method as recited in claim 1, wherein the performance measurements are stored in a time-series data store in a first format, and the portions of log data are stored in said time-series data store in a second format different from the first format. ### Claim 21 (depends on 1) A method as recited in claim 1, wherein the performance measurements are stored in a first time-series data store in a first format, and the portions of log data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format. ### Claim 22 (depends on 1) A method as recited in claim 1, wherein the performance measurements are stored in a first time-series data store in a first format, and the portions of log data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format; the method further comprising: receiving a user-specified search query in a query language for searching the first and second time-series data stores, the user-specified search query containing a correlation criterion; wherein said correlating further includes, in response to the user-specified search query, searching the first time-series data store for performance data that satisfy the correlation criterion and searching the second time-series data store for log data that satisfy the correlation criterion. ### Claim 23 (depends on 1) A method as recited in claim 1, wherein the performance measurements are stored in a first time-series data store in a first format, and the portions of log data are stored in a second time-series data store separate from the first time-series data store in a second format different from the first format; the method further comprising: receiving a user-specified search query in a query language for searching the first and second time-series data stores, the user-specified search query containing a correlation criterion, wherein the correlation criterion comprises a user-specified value or a user-specified range of values, for a user-specified field; wherein said correlating further includes, in response to the user-specified search query, searching the first time-series data store for performance data that satisfy the correlation criterion and searching the second time-series data store for log data that satisfy the correlation criterion. ### Claim 24 (depends on 1) A method as recited in claim 1, further comprising: acquiring structure data indicative of structure characteristics of the IT environment; storing the acquired structure data indicative of structure characteristics of the IT environment; and correlating a performance characteristic of the IT environment with a structure characteristic of the IT environment, based on the stored performance measurements and stored structure data. ### Claim 25 (depends on 1) A method as recited in claim 1, further comprising: acquiring structure data indicative of structure characteristics of the IT environment, wherein the structure data is derived from log data from the IT environment; storing the acquired structure data indicative of structure characteristics of the IT environment; and correlating a performance characteristic of the IT environment with a structure characteristic of the IT environment, based on the stored performance measurements and stored structure data. ### Claim 26 (depends on 1) A method as recited in claim 1, wherein the at least one performance metric comprises a performance metric for at least one hardware or software resource of a computer system. ### Claim 27 (depends on 1) A method as recited in claim 1, wherein the at least one performance metric comprises a performance metric for at least one virtual machine or virtual machine host. ### Claim 28 (depends on 1) A method as recited in claim 1, wherein the at least one performance metric comprises a performance metric for a virtual machine cluster. ### Claim 29 A non-transitory machine-readable storage medium for use in a processing system of a data intake and query system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising: acquiring a plurality of performance measurements for each of at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment; acquiring a plurality of portions of log data representing activity of at least one hardware or software component of the IT environment; correlating at least one of the portions of log data with at least one of the performance measurements, by determining that one of the portions of log data has a specified relationship to a threshold value, and in response to determining that said one of the portions of log data has the specified relationship to the threshold value, identifying at least one of the performance measurements that has a time stamp corresponding to a time stamp of said one of the portions of log data; and causing display of an indication of correlation between said one of the portions of log data and the identified at least one of the performance measurements. ### Claim 30 A system comprising: a communication device through which to communicate on a computer network; and at least one processor operatively coupled to the communication device and configured to perform operations including acquiring a plurality of performance measurements for each of at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment; acquiring a plurality of portions of log data representing activity of at least one hardware or software component of the IT environment; correlating at least one of the portions of log data with at least one of the performance measurements, by determining that one of the portions of log data has a specified relationship to a threshold value, and in response to determining that said one of the portions of log data has the specified relationship to the threshold value, identifying at least one of the performance measurements that has a time stamp corresponding to a time stamp of said one of the portions of log data; and causing display of an indication of correlation between said one of the portions of log data and the identified at least one of the performance measurements.