# US 2021/0334154 A1 · Enriched high fidelity metrics > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0334154 A1 - Document ID: US20210334154A1 - Status: Published application - Kind: A1 - Application number: 16/860,224 - Filed: 2020-04-28 - Published: 2021-10-28 - Earliest claimed: 2020-04-28 - Assignees: Intuit Inc. - Applicants: Intuit Inc. - Inventors: Amit Shriram Kalamkar; Edward K. Lee; Vigith Maurice - Web page: https://patentgrep.com/patent/US20210334154A1 ## CPC - G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs} - G06F 11/0775: {Content or structure details of the error report, e.g. specific table structure, specific error fields} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3419: {by assessing time} - G06F 2201/86: Event-based monitoring - G06F 2201/88: Monitoring involving counting - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method including receiving events from different data sources for a service automatically executing in an enterprise system. A first event is enriched by providing the first event with first metadata that associates the first event with a first application used by the service. The first event is assigned to a time slice associated with the first application. A second event is enriched in a similar manner. A correlation graph of nodes and edges is built using the enriched events, with nodes representing the events and edges indicating relationships between the edges. A third event indicating a fault in the first application associated with the first node is received. The source of the error for the third event is identified using the second updated correlation graph and the time slice. The source of error is then mitigated. ## Claims ### Claim 1 A method comprising: receiving a plurality of events from a plurality of different data sources for a service automatically executing in an enterprise system; enriching at least a first event in the plurality of events by providing the first event with first metadata that associates the first event with a first application used by the service, wherein enriching the first event generates a first enriched event; assigning the first event to a time slice associated with the first application; creating, based on the first enriched event, a first node of a correlation graph that represents the first application, wherein the correlation graph comprises one node and zero edges; enriching a second event in the plurality of events by providing the second event with second metadata that associates the second event with a second application, wherein enriching the second event generates a second enriched event; assigning the second enriched event to the time slice; creating, based on the second enriched event, a second node of a first updated correlation graph that represents the second application, wherein the first updated correlation graph comprises two nodes and zero edges; correlating the second node with the first node, wherein the second node is dependent on the first node to generate a second updated correlation graph that represents the first application and the second application, wherein the second updated correlation graph comprises two nodes and one edge; receiving a third event indicating a fault in the first application associated with the first node; identifying, using the second updated correlation graph and the time slice, a source of error for the third event; and mitigating the source of error. ### Claim 2 (depends on 1) The method of claim 1, further comprising: responsive to receiving the third event, identifying a second fault in the second application associated with the second node; identifying, using the second updated correlation graph, a second source of error for the second fault; and mitigating the second source of error. ### Claim 3 (depends on 1) The method of claim 1, further comprising: displaying only a plurality of time slices, including the time slice. ### Claim 4 (depends on 3) The method of claim 3, further comprising: responsive to receiving user input selecting the time slice, displaying the second updated correlation graph. ### Claim 5 (depends on 3) The method of claim 3, further comprising: responsive to receiving user input selecting the time slice, displaying a heat map indicating the fault. ### Claim 6 (depends on 5) The method of claim 5, further comprising: responsive to receiving additional user input selecting an indication of the fault in the heat map, displaying detailed information regarding the fault. ### Claim 7 (depends on 1) The method of claim 1, further comprising: displaying the time slice among a plurality of additional time slices associated with concurrently updated correlation graphs that indicate time-based behavior of the first application and the second application within the plurality of additional time slices. ### Claim 8 (depends on 7) The method of claim 7, further comprising: responsive to a user selecting one of the time slice or one of the plurality of additional time slices, displaying operational information for at least one of the first application and the second application in a corresponding time slice that was selected. ### Claim 9 (depends on 1) The method of claim 1, wherein the first application and the second application are different logical applications, and wherein the first event and the second event are different events. ### Claim 10 (depends on 1) The method of claim 1, wherein the first application and the second application comprise different corresponding functions of a single logical software program. ### Claim 11 A system comprising: a data repository storing: a plurality of metrics describing operational behavior of a plurality of software programs executing in an enterprise system, wherein each set of the plurality of metrics represents data for a different time period in a plurality of time periods; a plurality of events, wherein each of the plurality of events represents a behavior of interest over time in the plurality of software programs, wherein at least one of the plurality of events comprises a fault in a first software program; metadata that correlates the plurality of events to at least some of the plurality of metrics over the plurality of time periods; a plurality of ingested metrics comprising the plurality of metrics enriched with the metadata; a plurality of time slices, wherein each of the plurality of time slices comprises a corresponding data structure for storing the plurality of ingested metrics in the plurality of time periods; a plurality of heat maps stored in the plurality of time slices, the plurality of heat maps summarizing operational behavior of the plurality of software programs in ones of the plurality of time periods; an application programming interface (API) gateway configured to receive the plurality of metrics; an ingestion layer configured to ingest the plurality of metrics to form the plurality of ingested metrics; and a tumbling window processor configured to process the plurality of ingested metrics and the plurality of events into the plurality of heat maps, sort the plurality of heat maps into the plurality of time slices, and populate the plurality of time slices with the plurality of ingested metrics. ### Claim 12 (depends on 11) The system of claim 11, further comprising: a display API configured to generate an output for displaying the plurality of time slices. ### Claim 13 (depends on 12) The system of claim 12, wherein the display API is further configured to: receive user input selecting one of the plurality of time slices displayed as a selected time slice; and responsive to selecting, display a first heat map from the plurality of heat maps that is associated with the selected time slice. ### Claim 14 (depends on 12) The system of claim 12, wherein the display API is further configured to: generate the output for displaying the plurality of time slices adjacent to each other, display a line longitudinally through the plurality of time slices, display metrics related to the plurality of software programs above the line, and display metrics related to the enterprise system below the line. ### Claim 15 (depends on 11) The system of claim 11, wherein the ingestion layer further comprises: a domain separation engine configured to separate the plurality of metrics into a first domain and a second domain, wherein the first domain comprises a first retention policy determining how long metrics in the first domain will be stored, and wherein the second domain comprises metrics related to the fault and a second retention policy determining how long metrics in the second domain will be stored, wherein the first retention policy is less than the second retention policy, and wherein the second domain further stores more data than the first domain. ### Claim 16 (depends on 15) The system of claim 15, further comprising: a caching module configured to: hash the second domain to generate hashed data, and cache the hashed data. ### Claim 17 A method comprising: receiving a first plurality of metrics describing a first plurality of behaviors of a plurality of applications; receiving a second plurality of metrics describing a second plurality of behaviors of an enterprise system in which the plurality of applications are executing, wherein at least one of the first plurality of metrics and the second plurality of metrics indicates a fault in at least one of the plurality of applications; ingesting the first plurality of metrics and the second plurality of metrics to generate ingested metrics, wherein ingesting comprises: assigning a first cardinality score to first metrics from at least one of the first plurality of metrics and the second plurality of metrics that are related to the fault, and assigning a second cardinality score to second metrics from at least one of the first plurality of metrics and the second plurality of metrics that are unrelated to the fault, wherein the first cardinality score is higher than the second cardinality score; performing tumbling window processing on the ingested metrics by: sorting the first plurality of metrics and the second plurality of metrics into a plurality of time slices, wherein each of the plurality of time slices comprises a corresponding data structure for storing data in different time periods, and storing more data in the plurality of time slices for the first metrics having the first cardinality score relative to the second metrics having the second cardinality score; and displaying the plurality of time slices on a display device. ### Claim 18 (depends on 17) The method of claim 17, further comprising: hashing the data in the plurality of time slices to generate hashed data; and caching the hashed data. ### Claim 19 (depends on 18) The method of claim 18, further comprising: receiving a user input selecting one of the plurality of time slices; and responsive to receiving, retrieving the hashed data; reconstituting the hashed data to regenerate the data; and displaying the data on the display device. ### Claim 20 (depends on 17) The method of claim 17, wherein the first plurality of metrics and the second plurality of metrics relate to a plurality of events, and wherein ingesting further comprises: enriching the plurality of events with a plurality of metadata that correlates the plurality of events to at least some of at least one of the first plurality of metrics and the second plurality of metrics.