Back to results
US 9,753,961 B2Granted
Identifying events using informational fields
AssigneeSplunk Inc.
InventorsBrent Boe, Alok Anant Bhide, Sonal Maheshwari
Life of this patent
Estimating the term…
Abstract
A computer system determines if events in a machine data store satisfy event selection criteria. The events may pertain to a service entity represented by a stored entity definition. The entity definition may include information to identify the events from the machine data. Other informational fields in the entity definition may be effectively attributed to the identified events and take part in satisfying the event selection criteria.
Claims30
A method comprising:
- storing identifier information and metadata information for an entity definition, the entity definition representing an entity that performs a service, wherein the service is represented by a stored service definition that associates definitions for one or more entities that perform the service, the service having a key performance indicator (KPI) defined by a KPI search query that derives a value from machine data identified in the entity definitions, thereby transforming the machine data to the value which indicates how the service is performing at a point in time or during a period of time;
- executing a search query, including determining that an event satisfies a selection criterion of the search query, wherein the determining includes matching the selection criterion of the search query with the metadata information of the entity definition and matching the identifier information of the entity definition with machine data of the event;
- and
- storing a search query result reflective of said determining in computer memory;
- wherein the method is performed by a computer system comprising one or more processing devices coupled to the computer memory.
2 more elements
A system comprising:
- a memory;
- and
- a processing device coupled with the memory to:
- store identifier information and metadata information for an entity definition, the entity definition representing an entity that performs a service, wherein the service is represented by a stored service definition that associates definitions for one or more entities that perform the service, the service having a key performance indicator (KPI) defined by a KPI search query that derives a value from machine data identified in the entity definitions, thereby transforming the machine data to the value which indicates how the service is performing at a point in time or during a period of time;
- execute a search query, including determining that an event satisfies a selection criterion of the search query, wherein the determining includes matching the selection criterion of the search query with the metadata information of the entity definition in conjunction with matching the identifier information of the entity definition with the machine data of the event;
- and
- store a search query result reflective of said determining in computer memory;
- wherein the method is performed by a computer system comprising one or more processing devices coupled to the computer memory.
5 more elements
A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
- storing identifier information and metadata information for an entity definition, the entity definition representing an entity that performs a service, wherein the service is represented by a stored service definition that associates definitions for one or more entities that perform the service, the service having a key performance indicator (KPI) defined by a KPI search query that derives a value from machine data identified in the entity definitions, thereby transforming the machine data to the value which indicates how the service is performing at a point in time or during a period of time;
- executing a search query, including determining that an event satisfies a selection criterion of the search query, wherein the determining includes matching the selection criterion of the search query with the metadata information of the entity definition in conjunction with matching the identifier information of the entity definition with the machine data of the event;
- and
- storing a search query result reflective of said determining in computer memory;
- wherein the method is performed by a computer system comprising one or more processing devices coupled to the computer memory.
2 more elements
Dependencies are inferred from the claim text.