# US 8,380,752 B2 · Customized reporting and mining of event data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,380,752 B2 - Document ID: US8380752B2 - Status: Granted - Kind: B2 - Application number: 13/084,288 - Filed: 2011-04-11 - Published: 2011-08-04 - Granted: 2013-02-19 - Earliest claimed: 2007-01-12 - Assignees: LogLogic, Inc. - Applicants: Sherif Botros; Jian L. Zhen; Minjun Liu; Boris Galitsky - Inventors: Sherif Botros; Jian L. Zhen; Minjun Liu; Boris Galitsky - Web page: https://patentgrep.com/patent/US8380752B2 ## CPC - G06F 16/9038: Presentation of query results - Y10S 707/99943: Generating database or data structure, e.g. via user interface - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS ## Abstract Event data (e.g., log messages) are represented as sets of attribute/value pairs. An index maps each attribute/value pair or attribute/value tuple to a pointer that points to event data which contains the attribute/value pair or attribute/value tuple. An attribute co-occurrence map or matrix can be generated that includes attribute names that co-occur together. Queries and custom reports can be generated by projecting event data into one or more attributes or attribute/value pairs, and then determining statistics on other attributes using a combination of the inverted index, the attribute co-occurrence map or matrix, operations on sets and/or math and statistical functions. ## Claims ### Claim 1 A method executed by a computer, comprising: receiving a report search query from one more event data collectors; parsing the report search query to determine a specified attribute of an event being searched; retrieving values or statistics associated with the specified attribute; determining a co-occurring attribute of the specified attribute; aggregating at least one of values or statistics associated with the co-occurring attribute; and generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises: projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data; and determining the statistics on the co-occurring attribute using a combination of: an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute; and an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the co-occurring attribute includes searching the attribute co-occurrence data structure for the co-occurring attribute. ### Claim 3 (depends on 1) The method of claim 1, wherein the relationship between the specified attribute and the co-occurring attribute indicates that the report search query for finding a textual message including both the specified attribute and the co-occurring attribute is allowable. ### Claim 4 (depends on 3) The method of claim 3, wherein: the one or more attribute/value pairs are generated from event data in a log file; and generating the report comprises providing access to the event data in the log file using the reference pointer. ### Claim 5 (depends on 4) The method of claim 4, wherein the instance of the event data includes a textual message based on which each of the one or more attribute/value pairs was generated. ### Claim 6 A non-transitory computer-readable storage medium storing instructions, the instructions configured to cause a computer to perform operations comprising: receiving a report search query from one more event data collectors; parsing the report search query to determine a specified attribute of an event being searched; retrieving values or statistics associated with the specified attribute; determining a co-occurring attribute of the specified attribute; aggregating at least one of values or statistics associated with the co-occurring attribute; and generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises: projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data; and determining the statistics on the co-occurring attribute using a combination of: an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute; and an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair. ### Claim 7 (depends on 6) The non-transitory computer-readable storage medium of claim 6, wherein determining the co-occurring attribute includes searching the attribute co-occurrence data structure for the co-occurring attribute. ### Claim 8 (depends on 6) The non-transitory computer-readable storage medium of claim 6, wherein the relationship between the specified attribute and the co-occurring attribute indicates that the report search query for finding a textual message including both the specified attribute and the co-occurring attribute is allowable. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein: the one or more attribute/value pairs are generated from event data in a log file; and generating the report comprises providing access to the event data in the log file using the reference pointer. ### Claim 10 (depends on 9) The non-transitory computer-readable storage medium of claim 9, wherein the instance of the event data includes a textual message based on which each of the one or more attribute/value pairs was generated. ### Claim 11 A system comprising: one or more computing devices configured to perform operations comprising: receiving a report search query from one more event data collectors; parsing the report search query to determine a specified attribute of an event being searched; retrieving values or statistics associated with the specified attribute; determining a co-occurring attribute of the specified attribute; aggregating at least one of values or statistics associated with the co-occurring attribute; and generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises: projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data; and determining the statistics on the co-occurring attribute using a combination of: an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute; and an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair. ### Claim 12 (depends on 11) The system of claim 11, wherein determining the co-occurring attribute includes searching the attribute co-occurrence data structure for the co-occurring attribute. ### Claim 13 (depends on 11) The system of claim 11, wherein the relationship between the specified attribute and the co-occurring attribute indicates that the report search query for finding a textual message including both the specified attribute and the co-occurring attribute is allowable. ### Claim 14 (depends on 13) The system of claim 13, wherein: the one or more attribute/value pairs are generated from event data in a log file; and generating the report comprises providing access to the event data in the log file using the reference pointer. ### Claim 15 (depends on 14) The system of claim 14, wherein the instance of the event data includes a textual message based on which each of the one or more attribute/value pairs was generated.