Conveying data to a user via field-attribute mappings in a three-dimensional model

• US 10,403,041 B2
• Filed: 04/26/2017
• Issued: 09/03/2019
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Arsan, Roy, Raitz, Alexander, Allan, Clark, Noel, Cary Glen
• Primary Examiner(s): Cobb, Michael J
• Application Number:
  US15/498,430
• Publication Number:
  US 20170228943A1
• Time in Patent Office: 860 Days
• Field of Search: None
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06T 15/005 General purpose rendering architectures
• CPC Class Codes: G06T 15/04 Texture mapping
• CPC Class Codes: G06T 15/20 Perspective computation
• CPC Class Codes: G06T 15/205 Image-based rendering
• CPC Class Codes: G06T 19/00 Manipulating 3D models or images for computer graphics
• CPC Class Codes: G06T 19/003 Navigation within 3D models or images
• CPC Class Codes: G06T 19/20 Editing of 3D images, e.g. changing shapes or colours, aligning objects or positioning parts
• CPC Class Codes: G06T 2215/16 Using real world measurements to influence rendering

Abstract

Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object'"'"'s data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

Claims

1. A computer-implemented method, comprising:

receiving unstructured data from an external data source;

determining a mapping between a first set of value ranges associated with one or more fields defined for the unstructured data and a first set of values associated with one or more modeling attributes;

generating, based on the mapping, a three-dimensional model that includes a first three-dimensional object having multiple attributes of the one or more modeling attributes, wherein each of the multiple attributes is mapped to a different field of the one or more fields defined for the unstructured data;

updating, via a processor, each of the multiple attributes over a period of time to visually convey any changes in values associated with the different fields over the period of time;

modifying a first visual characteristic of a first cluster designator that encloses and is associated with a plurality of three-dimensional objects that includes the first three-dimensional object based on the one or more modeling attributes; and

displaying at least a first portion of the three-dimensional model that includes the first three-dimensional object over the period of time as each of the multiple attributes is updated.

2. The method of claim 1, wherein the unstructured data received from the external data source comprises real-time data that reflects activity within an information technology environment.

3. The method of claim 1, wherein the unstructured data received from the external data source comprises real-time data, updating each of the multiple attributes comprises updating each of the multiple attributes in real-time over the period of time to visually convey the changes in the values associated with the different fields, and the at least first portion of the three-dimensional model is displayed over the period of time as each of the multiple attributes is updated in real-time.

4. The method of claim 1, further comprising receiving user-defined mappings between the first set of value ranges and the first set of values via a setup module that includes a command line interface accessible to a user.

5. The method of claim 1, wherein the unstructured data received from the external data source comprises time series data having time stamps, and further comprising performing one or more operations on the time series data via a late binding schema that defines the different fields for the unstructured data.

6. The method of claim 1, wherein the unstructured data received from the external data source comprises machine data, and the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the machine data is generated by at least one of the server machine, the processor, and the virtual machine.

7. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first field defined for the unstructured data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second field defined for the unstructured data, and wherein the width and depth of the first three-dimensional object are updated over the period of time to visually convey the changes in the values associated with the first field and the second field over the period of time.

8. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first field defined for the unstructured data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second field defined for the unstructured data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third field defined for the unstructured data, and wherein the width and depth of the first three-dimensional object are updated over the period of time to visually convey the changes in the values associated with the first field and the second field over the period of time, and the color of the first three-dimensional object is updated over the period of time according to the color scale to visibly convey changes in the values associated with the third field over the period of time.

9. The method of claim 1, wherein each value range included in the first set of value ranges is associated with a different value included in the first set of values.

10. The method of claim 1, further comprising:

generating a semi-indexed version of the unstructured data based on one or more time stamps associated with the unstructured data;

receiving a definition of a schema to extract a second set of values from the semi-indexed version of the unstructured data; and

searching the semi-indexed version of the unstructured data for the second set of values based on the schema;

wherein the mapping between the first set of value ranges and the first set of values is based on the second set of values.

11. The method of claim 1, further comprising modifying a second visual characteristic of a second cluster designator associated with a plurality of cluster designators that includes the first cluster designator based on the one or more modeling attributes.

12. The method of claim 1, wherein each three-dimensional object included in the plurality of three-dimensional objects performs a first activity, and the first visual characteristic is based on at least one of a state, measurement, or metric indicative of the first activity.

13. A non-transitory computer-readable medium including instructions that, when executed by a processor, cause the processor to perform the steps of:

receiving unstructured data from an external data source;

determining a mapping between a first set of value ranges associated with one or more fields defined for the unstructured data and a first set of values associated with one or more modeling attributes;

generating, based on the mapping, a three-dimensional model that includes a first three-dimensional object having multiple attributes of the one or more modeling attributes, wherein each of the multiple attributes is mapped to a diffe rent field of the one or more fields defined for the unstructured data;

updating each of the multiple attributes over a period of time to visually convey any changes in values associated with the different fields over the period of time;

modifying a first visual characteristic of a first cluster designator that encloses and is associated with a plurality of three-dimensional objects that includes the first three-dimensional object based on the one or more modeling attributes; and

displaying at least a first portion of the three-dimensional model that includes the first three-dimensional object over the period of time as each of the multiple attributes is updated.

14. The non-transitory computer-readable medium of claim 13, wherein the unstructured data received from the external data source comprises real-time data that reflects activity within an information technology infrastructure of an organization.

15. The non-transitory computer-readable medium of claim 13, wherein the unstructured data received from the external data source comprises real-time data, updating each of the multiple attributes comprises updating each of the multiple attributes in real-time over the period of time to visually convey the changes in the values associated with the different fields, and the at least first portion of the three-dimensional model is displayed over the period of time as each of the multiple attributes is updated in real-time.

16. The non-transitory computer-readable medium of claim 13, further comprising receiving user-defined mappings between the first set of value ranges and the first set of values via a setup module that includes a command line interface accessible to a user.

17. The non-transitory computer-readable medium of claim 13, wherein the unstructured data received from the external data source comprises time series data having time stamps, and further comprising performing one or more operations on the time series data via a late binding schema that defines the different fields for the unstructured data.

18. The non-transitory computer-readable medium of claim 13, wherein the unstructured data received from the external data source comprises machine data, and the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the machine data is generated by at least one of the server machine, the processor, and the virtual machine.

19. The non-transitory computer-readable medium of claim 13, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first field defined for the unstructured data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second field defined for the unstructured data, and wherein the width and depth of the first three-dimensional object are updated over the period of time to visually convey the changes in the values associated with the first field and the second field over the period of time.

20. The non-transitory computer-readable medium of claim 13, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first field defined for the unstructured data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second field defined for the unstructured data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third field defined for the unstructured data, and wherein the width and depth of the first three-dimensional object are updated over the period of time to visually convey the changes in the values associated with the first field and the second field over the period of time, and the color of the first three-dimensional object is updated over the period of time according to the color scale to visibly convey changes in the values associated with the third field over the period of time.

21. A computer system, comprising:

a memory including instructions; and

a processor that is coupled to the memory and, when executing the instructions, is configured to;

receive unstructured data from an external data source;

determine a mapping between a first set of value ranges associated with one or more fields defined for the unstructured data and a first set of values associated with one or more modeling attributes;

generate, based on the mapping, a three-dimensional model that includes a first three-dimensional object having multiple attributes of the one or more modeling attributes, wherein each of the multiple attributes is mapped to a different field of the one or more fields defined for the unstructured data;

update each of the multiple attributes over a period of time to visually convey any changes in values associated with the different fields over the period of time;

modify a first visual characteristic of a first cluster designator that encloses and is associated with a plurality of three-dimensional objects that includes the first three-dimensional object based on the one or more modeling attributes; and

display at least a first portion of the three-dimensional model that includes the first three-dimensional object over the period of time as each of the multiple attributes is updated.

22. The computer system of claim 21, wherein the unstructured data received from the external data source comprises real-time data that reflects activity within an information technology infrastructure of an organization.

23. The computer system of claim 21, wherein the unstructured data received from the external data source comprises real-time data, the processor is configured to update each of the multiple attributes by updating each of the multiple attributes in real-time over the period of time to visually convey the changes in the values associated with the different fields, and the at least first portion of the three-dimensional model is displayed over the period of time as each of the multiple attributes is updated in real-time.

24. The computer system of claim 21, wherein the processor is further configured to receive user-defined mappings between the first set of value ranges and the first set of values via a setup module that includes a command line interface accessible to a user.

25. The computer system of claim 21, wherein the unstructured data received from the external data source comprises time series data having time stamps, and the processor is further configured to perform one or more operations on the time series data via a late binding schema that defines the different fields for the unstructured data.

26. The computer system of claim 21, wherein the unstructured data received from the external data source comprises machine data, and the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the machine data is generated by at least one of the server machine, the processor, and the virtual machine.

27. The computer system of claim 21, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first field defined for the unstructured data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second field defined for the unstructured data, and wherein the width and depth of the first three-dimensional object are updated over the period of time to visually convey the changes in the values associated with the first field and the second field over the period of time.

28. The computer system of claim 21, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first field defined for the unstructured data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second field defined for the unstructured data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third field defined for the unstructured data, and wherein the width and depth of the first three-dimensional object are updated over the period of time to visually convey the changes in the values associated with the first field and the second field over the period of time, and the color of the first three-dimensional object is updated over the period of time according to the color scale to visibly convey changes in the values associated with the third field over the period of time.