Predicting problem events from machine data

A method, comprising:

• receiving a set of problem prediction rules and information indicative of a length of an observation window, wherein the information indicative of the length of the observation window is based on a length of an analysis time period used to create at least one of the problem prediction rules based on analysis of historical problem data and historical machine data;
• receiving machine data generated by a device within the observation window;
• and
• identifying a predicted problem event associated with the device based on a determination that the machine data matches one of the problem prediction rules.

An apparatus, comprising:

• a processor and a memory communicatively connected to the processor, the processor configured to:
• receive historical problem event data associated with a device, the device comprising a network device or a customer device;
• receive historical machine data generated by the device;
• create, based on a predictive time epoch, a temporal association between the historical problem event data associated with the device and the machine data generated by the device;
• and
• generate a problem prediction rule associated with the device based on the temporal association between the historical problem event data associated with the device and the machine data generated by the device.

The apparatus of claim 11, wherein, to create the temporal association between the historical problem event data associated with the device and the machine data generated by the device, the processor is configured to:

• identify, within the historical problem event data, a problem event associated with the device and having a reporting time associated therewith;
• determine a predictive time epoch preceding the reporting time associated with the problem event;
• identify, from the historical machine data, one or more machine data records falling within the predictive time epoch;
• and
• create the temporal association by creating an association between the problem event and the one or more machine data records falling within the predictive time epoch.

A method, comprising:

• receiving, by a processor, historical problem event data associated with a device, the device comprising a network device or a customer device;
• receiving, by the processor, historical machine data generated by the device;
• creating, by the processor based on a predictive time epoch, a temporal association between the historical problem event data associated with the device and the machine data generated by the device;
• and
• generating, by the processor, a problem prediction rule associated with the device based on the temporal association between the historical problem event data associated with the device and the machine data generated by the device.