Conveying machine data to a user via attribute mapping in a three-dimensional model

• US 10,388,067 B2
• Filed: 04/26/2017
• Issued: 08/20/2019
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Arsan, Roy, Raitz, Alexander, Allan, Clark, Noel, Cary Glen
• Primary Examiner(s): Cobb, Michael J
• Application Number:
  US15/498,421
• Publication Number:
  US 20170228942A1
• Time in Patent Office: 846 Days
• Field of Search: None
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06T 15/005 General purpose rendering architectures
• CPC Class Codes: G06T 15/04 Texture mapping
• CPC Class Codes: G06T 15/20 Perspective computation
• CPC Class Codes: G06T 15/205 Image-based rendering
• CPC Class Codes: G06T 19/00 Manipulating 3D models or images for computer graphics
• CPC Class Codes: G06T 19/003 Navigation within 3D models or images
• CPC Class Codes: G06T 19/20 Editing of 3D images, e.g. changing shapes or colours, aligning objects or positioning parts
• CPC Class Codes: G06T 2215/16 Using real world measurements to influence rendering

Abstract

Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object'"'"'s data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

Claims

1. A computer-implemented method, comprising:

receiving a stream of unstructured real-time machine data from an external data source, wherein the real-time machine data reflects activity within an information technology environment;

determining a mapping between a first set of value ranges associated with one or more aspects of the unstructured real-time machine data and a first set of values associated with one or more modeling attributes;

generating, based on the mapping, a three-dimensional model that includes a first three-dimensional object having multiple attributes of the one or more modeling attributes, wherein each of the multiple attributes is mapped to a different aspect of the one or more aspects of the unstructured real-time machine data;

updating, via a processor, each of the multiple attributes in real-time to visually convey changes in the different aspects of the unstructured real-time machine data;

modifying a first visual characteristic of a first cluster designator that encloses and is associated with a plurality of three-dimensional objects that includes the first three-dimensional object based on the one or more modeling attributes; and

displaying at least a first portion of the three-dimensional model that includes the first three-dimensional object as each of the multiple attributes is updated in real-time.

2. The method of claim 1, wherein the unstructured real-time machine data comprises at least one of server logs, activity logs, configuration files, messages, database records, data from one or more sensors or computing devices, and web logs from one or more web servers or web clients.

3. The method of claim 1, wherein the unstructured real-time machine data comprises time series data that includes time stamps.

4. The method of claim 1, wherein the unstructured real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

5. The method of claim 1, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the unstructured real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

6. The method of claim 1, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, and a second clustering object that encompasses the first clustering object, wherein the second clustering object represents a data center, the first clustering object represents a server machine within the data center, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the unstructured real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

7. The method of claim 1, further comprising receiving user-defined mappings between the first set of value ranges and the first set of values via a setup module that includes a command line interface accessible to a user.

8. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the unstructured real-time machine data.

9. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and a third attribute of the at least one three-dimensional object comprises a height of the first three-dimensional object that is mapped to third aspect of the unstructured real-time machine data, and wherein the width, depth, and height of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect, the second aspect, and the third aspect of the unstructured real-time machine data.

10. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third aspect of the unstructured real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the unstructured real-time machine data, and the color of the first three-dimensional object is updated in real-time according to the color scale to visibly convey changes in the third aspect of the unstructured real-time machine data.

11. The method of claim 1, wherein each value range included in the first set of value ranges is associated with a different value included in the first set of values.

12. The method of claim 1, further comprising:

generating a semi-indexed version of the stream of unstructured real-time machine data based on one or more time stamps associated with the unstructured real-time machine data;

receiving a definition of a schema to extract a second set of values from the semi-indexed version of the stream of the unstructured real-time machine data; and

searching the semi-indexed version of the stream of the unstructured real-time machine data for the second set of values based on the schema;

wherein the mapping between the first set of value ranges and the first set of values is based on the second set of values.

13. The method of claim 1, further comprising modifying a second visual characteristic of a second cluster designator associated with a plurality of cluster designators that includes the first cluster designator based on the one or more modeling attributes.

14. The method of claim 1, wherein each three-dimensional object included in the plurality of three-dimensional objects performs a first activity, and the first visual characteristic is based on at least one of a state, measurement, or metric indicative of the first activity.

15. A non-transitory computer-readable medium including instructions that, when executed by a processor, cause the processor to perform the steps of:

receiving a stream of unstructured real-time machine data from an external data source, wherein the real-time machine data reflects activity within an information technology environment;

determining a mapping between a first set of value ranges associated with one or more aspects of the unstructured real-time machine data and a first set of values associated with one or more modeling attributes;

generating, based on the mapping, a three-dimensional model that includes a first three-dimensional object having multiple attributes of the one or more modeling attributes, wherein each of the multiple attributes is mapped to a different aspect of the one or more aspects of the unstructured real-time machine data;

updating each of the multiple attributes in real-time to visually convey changes in the different aspects of the unstructured real-time machine data;

modifying a first visual characteristic of a first cluster designator that encloses and is associated with a plurality of three-dimensional objects that includes the first three-dimensional object based on the one or more modeling attributes; and

displaying at least a first portion of the three-dimensional model that includes the first three-dimensional object as each of the multiple attributes is updated in real-time.

16. The non-transitory computer-readable medium of claim 15, wherein the unstructured real-time machine data comprises at least one of server logs, activity logs, configuration files, messages, database records, data from one or more sensors or computing devices, and web logs from one or more web servers or web clients.

17. The non-transitory computer-readable medium of claim 15, wherein the unstructured real-time machine data comprises time series data that includes time stamps.

18. The non-transitory computer-readable medium of claim 15, wherein the unstructured real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

19. The non-transitory computer-readable medium of claim 15, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the unstructured real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

20. The non-transitory computer-readable medium of claim 15, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, and a second clustering object that encompasses the first clustering object, wherein the second clustering object represents a data center, the first clustering object represents a server machine within the data center, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the unstructured real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

21. The non-transitory computer-readable medium of claim 15, further comprising receiving user-defined mappings between the first set of value ranges and the first set of values via a setup module that includes a command line interface accessible to a user.

22. The non-transitory computer-readable medium of claim 15, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the unstructured real-time machine data.

23. The non-transitory computer-readable medium of claim 15, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and a third attribute of the at least one three-dimensional object comprises a height of the first three-dimensional object that is mapped to third aspect of the unstructured real-time machine data, and wherein the width, depth, and height of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect, the second aspect, and the third aspect of the unstructured real-time machine data.

24. The non-transitory computer-readable medium of claim 15, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third aspect of the unstructured real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the unstructured real-time machine data, and the color of the first three-dimensional object is updated in real-time according to the color scale to visibly convey changes in the third aspect of the unstructured real-time machine data.

25. A computer system, comprising:

a memory storing instructions; and

a processor that is coupled to the memory and, when executing the instructions, is configured to;

receive a stream of unstructured real-time machine data from an external data source, wherein the real-time machine data reflects activity within an information technology environment;

determine a mapping between a first set of value ranges associated with one or more aspects of the real-time machine data and a first set of values associated with one or more modeling attributes;

generate, based on the mapping, a three-dimensional model that includes a first three-dimensional object having multiple attributes of the one or more modeling attributes, wherein each of the multiple attributes is mapped to a different aspect of the one or more aspects of the unstructured real-time machine data;

update each of the multiple attributes in real-time to visually convey changes in the different aspects of the unstructured real-time machine data;

modify a first visual characteristic of a first cluster designator that encloses and is associated with a plurality of three-dimensional objects that includes the first three-dimensional object based on the one or more modeling attributes; and

display at least a first portion of the three-dimensional model that includes the first three-dimensional object as each of the multiple attributes is updated in real-time.

26. The computer system of claim 25, wherein the unstructured real-time machine data comprises at least one of server logs, activity logs, configuration files, messages, database records, data from one or more sensors or computing devices, and web logs from one or more web servers or web clients.

27. The computer system of claim 25, wherein the unstructured real-time machine data comprises time series data that includes time stamps.

28. The computer system of claim 25, wherein the unstructured real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

29. The computer system of claim 25, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the unstructured real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

30. The computer system of claim 25, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, and a second clustering object that encompasses the first clustering object, wherein the second clustering object represents a data center, the first clustering object represents a server machine within the data center, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the unstructured real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

31. The computer system of claim 25, wherein the processor is further configured to receive user-defined mappings between the first set of value ranges and the first set of values via a setup module that includes a command line interface accessible to a user.

32. The computer system of claim 25, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the unstructured real-time machine data.

33. The computer system of claim 25, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and a third attribute of the at least one three-dimensional object comprises a height of the first three-dimensional object that is mapped to third aspect of the unstructured real-time machine data, and wherein the width, depth, and height of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect, the second aspect, and the third aspect of the unstructured real-time machine data.

34. The computer system of claim 25, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the unstructured real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the unstructured real-time machine data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third aspect of the unstructured real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the unstructured real-time machine data, and the color of the first three-dimensional object is updated in real-time according to the color scale to visibly convey changes in the third aspect of the unstructured real-time machine data.