# US 2018/0024901 A1 · Automatic entity control in a machine data driven service monitoring system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0024901 A1
- Document ID: US20180024901A1
- Status: Published application
- Kind: A1
- Application number: 15/713,606
- Filed: 2017-09-23
- Published: 2018-01-25
- Earliest claimed: 2015-09-18
- Assignees: Splunk Inc.
- Applicants: Splunk Inc.
- Inventors: Nicholas Matthew TANKERSLEY; Mingrui WEI; Arun RAMANI
- Web page: https://patentgrep.com/patent/US20180024901A1

## CPC

- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/324: {Display of status information}
- G06F 11/3409: {for performance assessment}
- G06F 16/2358: {Change logging, detection, and notification (replication G06F16/27)}
- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 16/2379: {Updates performed during online database operations; commit processing}
- G06F 16/245: Query processing
- G06F 16/24573: {using data annotations, e.g. user-defined metadata}
- G06F 16/288: {Entity relationship models}
- G06Q 10/06393: {Score-carding, benchmarking or key performance indicator [KPI] analysis}
- G06T 11/26: Drawing of charts or graphs
- G06T 2200/24: involving graphical user interfaces [GUIs]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL

## Abstract

Automated discovery of relationships between entities within an IT environment. A technique is performed by a relationship module that performs a discovery search for entity relationships to produce a set of relationship search results. The relationship module then generates a set of relationship definitions from the set of relationship search results which are stored to a relationship collection in a data store. A technique for automatically updating entity and relationship definitions and removing outdated entity and relationship definitions stored to a data store. An update module automatically updates entity and relationship definitions at predetermined time intervals. The update history in each definition is also modified to reflect the update process. A retire module automatically removes outdated definitions using the update history in each definition.

## Claims

### Claim 1

A computer-implemented method comprising:
retrieving a set of item definitions stored to a data store, each item definition describing an item comprising an entity or an entity relationship within a technology environment;
generating a set of item search results produced by a discovery search for items within the technology environment;
determining a set of changed items between the set of item definitions and the set of item search results; and
updating the set of item definitions stored to the data store based on the set of changed items.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein:
an item definition comprises an entity definition stored to the data store; and
an entity definition is defined by one or more values extracted from machine data collected from the technology environment.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein:
an item definition comprises an entity relationship definition stored to the data store; and
an entity relationship definition specifies a relationship between a first entity and a second entity within the technology environment.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein a changed item in the set of changed items comprises a new item, removed item, or modified item.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising:
performing a retire process on the set of item definitions stored to the data store based on one or more policies to determine whether to remove one or more item definitions from the data store.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein:
each item definition stores an update time of a last update performed on the item definition;
each item definition further comprises a state entry storing a state of the item definition; and
a stale policy specifies a time threshold between a current time and the update time.

### Claim 7 (depends on 6)

The computer-implemented method of claim 6, further comprising:
performing the retire process by applying the stale policy to each item definition in the set of item definitions, wherein the state of an item definition is set to stale if the difference between the current time and the update time exceeds the time threshold.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, wherein:
each item definition stores a stale time of when the state of the item definition is set to stale; and
a remove policy specifies a time threshold between a current time and the stale time.

### Claim 9 (depends on 8)

The computer-implemented method of claim 8, further comprising:
performing the retire process by further applying the remove policy to each item definition in the set of item definitions, wherein an item definition is removed from the data store if the difference between the current time and the stale time exceeds the time threshold.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, wherein updating the set of item definitions is performed automatically at predetermined intervals.

### Claim 11

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform the steps of:
retrieving a set of item definitions stored to a data store, each item definition describing an item comprising an entity or an entity relationship within a technology environment;
generating a set of item search results produced by a discovery search for items within the technology environment;
determining a set of changed items between the set of item definitions and the set of item search results; and
updating the set of item definitions stored to the data store based on the set of changed items.

### Claim 12 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein:
an item definition comprises an entity definition stored to the data store; and
an entity definition is defined by one or more values extracted from machine data collected from the technology environment.

### Claim 13 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein:
an item definition comprises an entity relationship definition stored to the data store; and
an entity relationship definition specifies a relationship between a first entity and a second entity within the technology environment.

### Claim 14 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein a changed item in the set of changed items comprises a new item, removed item, or modified item.

### Claim 15 (depends on 11)

The non-transitory computer-readable medium of claim 11, further comprising:
performing a retire process on the set of item definitions stored to the data store based on one or more policies to determine whether to remove one or more item definitions from the data store.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein:
each item definition stores an update time of a last update performed on the item definition;
each item definition further comprises a state entry storing a state of the item definition; and
a stale policy specifies a time threshold between a current time and the update time.

### Claim 17 (depends on 16)

The non-transitory computer-readable medium of claim 16, further comprising:
performing the retire process by applying the stale policy to each item definition in the set of item definitions, wherein the state of an item definition is set to stale if the difference between the current time and the update time exceeds the time threshold.

### Claim 18 (depends on 17)

The non-transitory computer-readable medium of claim 17, wherein:
each item definition stores a stale time of when the state of the item definition is set to stale; and
a remove policy specifies a time threshold between a current time and the stale time.

### Claim 19 (depends on 18)

The non-transitory computer-readable medium of claim 18, further comprising:
performing the retire process by further applying the remove policy to each item definition in the set of item definitions, wherein an item definition is removed from the data store if the difference between the current time and the stale time exceeds the time threshold.

### Claim 20 (depends on 11)

The non-transitory computer-readable medium of claim 11, wherein updating the set of item definitions is performed automatically at predetermined intervals.

### Claim 21

A system, comprising:
a memory that includes an update module; and
a processor that is coupled to the memory and, when executing the update module, performs the steps of:
retrieving a set of item definitions stored to a data store, each item definition describing an item comprising an entity or an entity relationship within a technology environment;
generating a set of item search results produced by a discovery search for items within the technology environment;
determining a set of changed items between the set of item definitions and the set of item search results; and
updating the set of item definitions stored to the data store based on the set of changed items.

### Claim 22 (depends on 21)

The system of claim 21, wherein:
an item definition comprises an entity definition stored to the data store; and
an entity definition is defined by one or more values extracted from machine data collected from the technology environment.

### Claim 23 (depends on 21)

The system of claim 21, wherein:
an item definition comprises an entity relationship definition stored to the data store; and
an entity relationship definition specifies a relationship between a first entity and a second entity within the technology environment.

### Claim 24 (depends on 21)

The system of claim 21, wherein a changed item in the set of changed items comprises a new item, removed item, or modified item.

### Claim 25 (depends on 21)

The system of claim 21, wherein the processor further performs the steps of:
performing a retire process on the set of item definitions stored to the data store based on one or more policies to determine whether to remove one or more item definitions from the data store.

### Claim 26 (depends on 25)

The system of claim 25, wherein:
each item definition stores an update time of a last update performed on the item definition;
each item definition further comprises a state entry storing a state of the item definition; and
a stale policy specifies a time threshold between a current time and the update time.

### Claim 27 (depends on 26)

The system of claim 26, wherein the processor further performs the steps of:
performing the retire process by applying the stale policy to each item definition in the set of item definitions, wherein the state of an item definition is set to stale if the difference between the current time and the update time exceeds the time threshold.

### Claim 28 (depends on 27)

The system of claim 27, wherein:
each item definition stores a stale time of when the state of the item definition is set to stale; and
a remove policy specifies a time threshold between a current time and the stale time.

### Claim 29 (depends on 28)

The system of claim 28, wherein the processor further performs the steps of:
performing the retire process by further applying the remove policy to each item definition in the set of item definitions, wherein an item definition is removed from the data store if the difference between the current time and the stale time exceeds the time threshold.

### Claim 30 (depends on 21)

The system of claim 21, wherein updating the set of item definitions is performed automatically at predetermined intervals.