Back to results
US 9,311,387 B1Granted
Automatic parser generation
AssigneeSumo Logic, Inc.
InventorsKumar Saurabh, Christian Friedrich Beedgen, Bruno Kurtic
Life of this patent
Estimating the term…
Abstract
Automatically generating a parser is disclosed. Raw data is received from a first remote device. A determination that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules is made. A clustering function is performed on the raw data. At least one parser rule is generated based on the clustering.
Claims15
A system, comprising:
- a set of one or more processors;
- and
- a memory coupled to the set of one or more processors, wherein instructions provided by the memory to the set of one or more processors, when executed, cause the set of one or more processors to:
- receive raw data from a first remote device;
- determine that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules;
- perform a clustering function on the raw data;
- generate at least one parser rule based at least in part on the clustering;
- store, in a data store, the generated at least one parser rule;
- receive additional raw data from a second remote device, wherein the additional raw data received from the second remote device has an undefined source type;
- and
- recommend to an administrator of the second remote device that the source type of the additional raw data be set to a name specified by an administrator of the first remote device.
8 more elements
A method, comprising:
- receiving, via a set of one or more interfaces, raw data from a first remote device;
- determining, using a set of one or more processors, that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules;
- performing, using the set of one or more processors, a clustering function on the raw data;
- generating, using the set of one or more processors, at least one parser rule based at least in part on the clustering;
- storing, using the set of one or more processors, the generated at least one parser rule in a data store;
- receiving, via the set of one or more interfaces, additional raw data from a second remote device, wherein the additional raw data received from the second remote device has an undefined source type;
- and
- recommending, using the set of one or more processors, to an administrator of the second remote device that the source type of the additional raw data be set to a name specified by an administrator of the first remote device.
5 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving, via a set of one or more interfaces, raw data from a first remote device;
- determining, using a set of one or more processors, that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules;
- performing, using the set of one or more processors, a clustering function on the raw data;
- generating, using the set of one or more processors, at least one parser rule based at least in part on the clustering;
- and
- storing, using the set of one or more processors, the generated at least one parser rule in a data store;
- and
- receiving, via the set of one or more interfaces, additional raw data from a second remote device, wherein the additional raw data received from the second remote device has an undefined source type;
- and
- recommending, using the set of one or more processors, to an administrator of the second remote device that the source type of the additional raw data be set to a name specified by an administrator of the first remote device.
7 more elements
Dependencies are inferred from the claim text.