Generating state-on-state data for hierarchical clusters in a three-dimensional model representing machine data

• US 10,204,450 B2
• Filed: 04/30/2018
• Issued: 02/12/2019
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Arsan, Roy, Raitz, Alexander, Allan, Clark, Noel, Cary Glen
• Primary Examiner(s): Cobb, Michael J
• Application Number:
  US15/967,436
• Publication Number:
  US 20180253898A1
• Time in Patent Office: 288 Days
• Field of Search: None
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06T 15/005 General purpose rendering architectures
• CPC Class Codes: G06T 15/04 Texture mapping
• CPC Class Codes: G06T 15/20 Perspective computation
• CPC Class Codes: G06T 15/205 Image-based rendering
• CPC Class Codes: G06T 19/00 Manipulating 3D models or images for computer graphics
• CPC Class Codes: G06T 19/003 Navigation within 3D models or images
• CPC Class Codes: G06T 19/20 Editing of 3D images, e.g. changing shapes or colours, aligning objects or positioning parts
• CPC Class Codes: G06T 2215/16 Using real world measurements to influence rendering

Abstract

Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object'"'"'s data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

Claims

1. A computer-implemented method, comprising:

receiving data from an external data source, wherein the data comprises real-time machine data that reflects activity within an information technology environment;

generating a three-dimensional model that includes a first plurality of three-dimensional objects, wherein each three-dimensional object included in the first plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and each of the multiple attributes of the first three-dimensional object is mapped to one or more different aspects of the real-time machine data;

generating a first clustering object within the three-dimensional model, wherein the first clustering object encompasses the first plurality of three-dimensional objects;

determining a first state associated with a first three-dimensional object included in the first plurality of three-dimensional objects, wherein the first state comprises a variable alert state having one of at least three alert states, and wherein the first state is determined based on at least one aspect of the real-time machine data mapped to the first three-dimensional object and any corresponding aspects inherited from one or more lower level hierarchical components associated with the at least one first three-dimensional object;

determining a second state associated with a second three-dimensional object included in the plurality of three-dimensional objects, wherein the second state comprises a variable alert state having one of at least three alert states, and wherein the second state determination is based on at least one aspect of real-time machine data mapped to the second three dimensional object and at least one corresponding aspect inherited from one or more lower level hierarchical components associated with the at least one second three-dimensional object, wherein the first and second three-dimensional object are different three-dimensional objects within the plurality of three-dimensional objects;

determining a clustering object alert level associated with the first clustering object based on a comparison between the alert state associated with the first state and the alert state associated with the second state, wherein the alert level comprises one of at least three alert states, and wherein the first clustering object inherits the alert state from each of the first three-dimensional object and the second three-dimensional object;

selecting a cluster state associated with the first clustering object based on the clustering object alert level, wherein the cluster state causes a visual aspect of the first clustering object to change as the cluster state changes, wherein the visual aspect is different for each of the at least three alert states; and

displaying a first portion of the three-dimensional model that includes the first clustering object and a graphical representation of the cluster state.

2. The method of claim 1, wherein selecting the cluster state is further based on the first state indicating a higher alert state relative to the second state.

3. The method of claim 1, wherein the first state is selected as the cluster state based on the first graphical object representing a first component within the information technology environment having a higher priority than a priority associated with a second component within the information technology infrastructure represented by the second graphical object.

4. The method of claim 1, wherein the change in the visual aspect of the first clustering object comprises beaconing or pulsating clustering object beacons or pulsates with a first frequency as the first state of the first three-dimensional object comprises a first alert state and beaconing or pulsating with a second frequency as the first state of the first three-dimensional object comprises a second alert state.

5. The method of claim 1, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects; and

displaying a second portion of the three-dimensional model that includes the second clustering object.

6. The method of claim 1, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object.

7. The method of claim 1, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object,

wherein the third clustering object represents a data center, the first clustering object represents a first sever machine within the data center, the second clustering object represents a second server machine within the data center.

8. The method of claim 1, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object,

wherein the third clustering object represents a data center, the first clustering object represents a first sever machine within the data center, the second clustering object represents a second server machine within the data center, the first plurality of three-dimensional objects represent different processors or virtual machines executing within the first server machine, and the second plurality of three-dimensional objects represent different processors or virtual machines executing within the second server machine.

9. The method of claim 1, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

10. The method of claim 1, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine, and each of the multiple attributes of the first three-dimensional object is mapped to different aspects of the real-time machine data.

11. A non-transitory computer-readable medium including instructions that, when executed by a processor, cause the processor to perform the steps of:

receiving data from an external data source, wherein the data comprises real-time machine data that reflects activity within an information technology environment;

generating a three-dimensional model that includes a first plurality of three-dimensional objects, wherein each three-dimensional object included in the first plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and each of the multiple attributes of the first three-dimensional object is mapped to one or more different aspects of the real-time machine data;

generating a first clustering object within the three-dimensional model, wherein the first clustering object encompasses the first plurality of three-dimensional objects;

determining a first state associated with a first three-dimensional object included in the first plurality of three-dimensional objects, wherein the first state comprises a variable alert state having one of at least three alert states, and wherein the first state is determined based on at least one aspect of the real-time machine data mapped to the first three-dimensional object and any corresponding aspects inherited from one or more lower level hierarchical components associated with the at least one first three-dimensional object;

determining a second state associated with a second three-dimensional object included in the plurality of three-dimensional objects, wherein the second state comprises a variable alert state having one of at least three alert states, and wherein the second state determination is based on at least one aspect of real-time machine data mapped to the second three dimensional object and at least one corresponding aspect inherited from one or more lower level hierarchical components associated with the at least one second three-dimensional object, wherein the first and second three-dimensional object are different three-dimensional objects within the plurality of three-dimensional objects;

determining a clustering object alert level associated with the first clustering object based on a comparison between the alert state associated with the first state and the alert state associated with the second state, wherein the alert level comprises one of at least three alert states, and wherein the first clustering object inherits the alert state from each of the first three-dimensional object and the second three-dimensional object;

selecting a cluster state associated with the first clustering object based on the clustering object alert level, wherein the cluster state causes a visual aspect of the first clustering object to change as the cluster state changes, wherein the visual aspect is different for each of the at least three alert states; and

displaying a first portion of the three-dimensional model that includes the first clustering object and a graphical representation of the cluster state.

12. The non-transitory computer-readable medium of claim 11, wherein selecting the cluster state is further based on the first state indicating a higher alert state relative to the second state.

13. The non-transitory computer-readable medium of claim 11, wherein the first state is selected as the cluster state based on the first graphical object representing a first component within the information technology environment having a higher priority than a priority associated with a second component within the information technology infrastructure represented by the second graphical object.

14. The non-transitory computer-readable medium of claim 11, wherein the change in the visual aspect of the first clustering object comprises beaconing or pulsating clustering object beacons or pulsates with a first frequency as the first state of the first three-dimensional object comprises a first alert state and beaconing or pulsating with a second frequency as the first state of the first three-dimensional object comprises a second alert state.

15. The non-transitory computer-readable medium of claim 11, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects; and

displaying a second portion of the three-dimensional model that includes the second clustering object.

16. The non-transitory computer-readable medium of claim 11, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object.

17. The non-transitory computer-readable medium of claim 11, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object,

wherein the third clustering object represents a data center, the first clustering object represents a first sever machine within the data center, the second clustering object represents a second server machine within the data center.

18. The non-transitory computer-readable medium of claim 11, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object,

wherein the third clustering object represents a data center, the first clustering object represents a first sever machine within the data center, the second clustering object represents a second server machine within the data center, the first plurality of three-dimensional objects represent different processors or virtual machines executing within the first server machine, and the second plurality of three-dimensional objects represent different processors or virtual machines executing within the second server machine.

19. The non-transitory computer-readable medium of claim 11, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

20. The non-transitory computer-readable medium of claim 11, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine, and each of the multiple attributes of the first three-dimensional object is mapped to different aspects of the real-time machine data.

21. A computer system, comprising:

a memory that includes instructions; and

a processor that is coupled to the memory and, when executing the instructions, is configured to perform the steps of;

receiving data from an external data source, wherein the data comprises real-time machine data that reflects activity within an information technology environment;

generating a three-dimensional model that includes a first plurality of three-dimensional objects, wherein each three-dimensional object included in the first plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and each of the multiple attributes of the first three-dimensional object is mapped to one or more different aspects of the real-time machine data;

generating a first clustering object within the three-dimensional model, wherein the first clustering object encompasses the first plurality of three-dimensional objects;

determining a first state associated with a first three-dimensional object included in the first plurality of three-dimensional objects, wherein the first state comprises a variable alert state having one of at least three alert states, and wherein the first state is determined based on at least one aspect of the real-time machine data mapped to the first three-dimensional object and any corresponding aspects inherited from one or more lower level hierarchical components associated with the at least one first three-dimensional object;

determining a second state associated with a second three-dimensional object included in the plurality of three-dimensional objects, wherein the second state comprises a variable alert state having one of at least three alert states, and wherein the second state determination is based on at least one aspect of real-time machine data mapped to the second three dimensional object and at least one corresponding aspect inherited from one or more lower level hierarchical components associated with the at least one second three-dimensional object, wherein the first and second three-dimensional object are different three-dimensional objects within the plurality of three-dimensional objects;

determining a clustering object alert level associated with the first clustering object based on a comparison between the alert state associated with the first state and the alert state associated with the second state, wherein the alert level comprises one of at least three alert states, and wherein the first clustering object inherits the alert state from each of the first three-dimensional object and the second three-dimensional object;

selecting a cluster state associated with the first clustering object based on the clustering object alert level, wherein the cluster state causes a visual aspect of the first clustering object to change as the cluster state changes, wherein the visual aspect is different for each of the at least three alert states; and

displaying a first portion of the three-dimensional model that includes the first clustering object and a graphical representation of the cluster state.

22. The computer system of claim 21, wherein selecting the cluster state is further based on the first state indicating a higher alert state relative to the second state.

23. The computer system of claim 21, wherein the first state is selected as the cluster state based on the first graphical object representing a first component within the information technology environment having a higher priority than a priority associated with a second component within the information technology infrastructure represented by the second graphical object.

24. The computer system of claim 21, wherein the change in the visual aspect of the first clustering object comprises beaconing or pulsating clustering object beacons or pulsates with a first frequency as the first state of the first three-dimensional object comprises a first alert state and beaconing or pulsating with a second frequency as the first state of the first three-dimensional object comprises a second alert state.

25. The computer system of claim 21, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects; and

displaying a second portion of the three-dimensional model that includes the second clustering object.

26. The computer system of claim 21, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object.

27. The computer system of claim 21, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object,

wherein the third clustering object represents a data center, the first clustering object represents a first sever machine within the data center, the second clustering object represents a second server machine within the data center.

28. The computer system of claim 21, wherein the three-dimensional model includes a second plurality of three-dimensional objects, wherein each three-dimensional object included in the second plurality of three-dimensional objects has multiple attributes and a state derived from at least one aspect of the data, and further comprising:

generating a second clustering object within the three-dimensional model, wherein the second clustering object encompasses the second plurality of three-dimensional objects and has a state derived from the states associated with the second plurality of three-dimensional objects;

generating a third clustering object within the three dimensional model, wherein the third clustering object encompasses the first clustering object and the second clustering object and has a state derived from the clustering state of the first clustering object and the state of the second clustering object; and

displaying a third portion of the three-dimensional model that includes the third clustering object,

wherein the third clustering object represents a data center, the first clustering object represents a first sever machine within the data center, the second clustering object represents a second server machine within the data center, the first plurality of three-dimensional objects represent different processors or virtual machines executing within the first server machine, and the second plurality of three-dimensional objects represent different processors or virtual machines executing within the second server machine.

29. The computer system of claim 21, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

30. The computer system of claim 21, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine, and each of the multiple attributes of the first three-dimensional object is mapped to different aspects of the real-time machine data.