Real-time reporting based on instrumentation of software

• US 10,437,705 B2
• Filed: 12/18/2017
• Issued: 10/08/2019
• Est. Priority Date: 10/08/2014
• Status: Active Grant

• Current Assignee: SignalFx LLC (Splunk Inc.)
• Original Assignee: SignalFx, Inc. (Splunk Inc.)
• Inventors: Liu, Phillip, Mukherji, Arijit, Raman, Rajesh, Grandy, Kris, Lindamood, Jack
• Primary Examiner(s): Nguyen, Duy Khuong T
• Assistant Examiner(s): Hebert, Theodore E
• Application Number:
  US15/845,991
• Publication Number:
  US 20180307586A1
• Time in Patent Office: 659 Days
• Field of Search: 717158
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3644 by instrumenting at runtime
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/88 Monitoring involving counting

Abstract

A data analysis system processes data generated by instrumented software. The data analysis system receives data streams generated by instances of instrumented software executing on systems. The data analysis system also receives metadata describing data streams. The data analysis system receives an expression based on the metadata. The data analysis system receives data of data streams for each time interval and computes the result of the expression based on the received data values. The data analysis system repeats these steps for each time interval. The data analysis system may quantize data values of data streams for each time interval by generating an aggregate value for the time interval based on data received for each data stream for that time interval. The data analysis system evaluates the expression using the quantized data for the time interval.

Claims

1. A method for processing data generated by instrumented software, the method comprising:

receiving, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on the one or more external systems, each data stream comprising tuples, each tuple including values of a first set of attributes of the data stream;

receiving metadata objects describing each of the plurality of data streams, the metadata objects for a data stream describing a second set of attributes, each attribute of the second set distinct from the first set, wherein each metadata object is associated with information identifying a data stream and is associated with one or more properties each comprising a property name and a property value;

receiving a specification of an expression, the expression aggregating data across at least two of the plurality of data streams, the expression based on at least an attribute of the first set and an attribute of the second set, wherein the expression specifies a metadata object having a property name and property value;

selecting the at least two of the plurality of data streams based on the specified metadata object, the at least two of the plurality of data streams having metadata objects with a property value matching the property value of the specified metadata object;

evaluating the expression using at least two of the data streams over a plurality of time intervals to generate an output data stream, the evaluation of the expression comprising, for each time interval;

receiving one or more tuples from the plurality of data streams, each tuple comprising a data value associated with a point in time,

determining a value of the expression based on the data values of the received tuples, and

providing the value of the expression for the output data stream; and

sending the output data stream for display via a user interface.

2. The method of claim 1, where determining the value of the expression based on data values of the received tuples comprises aggregating data values of at least two of the plurality of data streams, each data value associated with the time interval.

3. The method of claim 1, further comprising:

receiving a first set of data streams during a first time interval;

generating a first plurality of output data streams by evaluating the expression using the first set of data streams;

receiving a second set of data streams during a second time interval; and

generating a second plurality of output data streams by evaluating the expression using the second set of data streams.

4. The method of claim 1, wherein the data of a data stream is generated by an instruction executed by the instrumented software, the instruction associated with one of a counter or a gauge.

5. The method of claim 1, further comprising:

receiving instructions for modifying the metadata objects describing a data stream; and

for subsequent time intervals, for each time interval;

evaluating the expression based on the modified metadata objects to generate a second output data stream, and

sending the second output data stream based on the modified metadata objects for display via the user interface.

6. A computer readable non-transitory storage medium storing instructions for processing data generated by instrumented software, the instructions executable by a processor to perform operations comprising:

receiving, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on the one or more external systems, each data stream comprising tuples, each tuple including values of a first set of attributes of the data stream;

receiving metadata objects describing each of the plurality of data streams, the metadata objects for a data stream describing a second set of attributes, each attribute of the second set distinct from the first set, wherein each metadata object is associated with information identifying a data stream and is associated with one or more properties each comprising a property name and a property value;

receiving a specification of an expression, the expression aggregating data across at least two of the plurality of data streams, the expression based on at least an attribute of the first set and an attribute of the second set, wherein the expression specifies a metadata object having a property name and property value;

selecting the at least two of the plurality of data streams based on the specified metadata object, the at least two of the plurality of data streams having metadata objects with a property value matching the property value of the specified metadata object;

evaluating the expression using at least two of the data streams over a plurality of time intervals to generate an output data stream, the evaluation of the expression comprising, for each time interval;

receiving one or more tuples from the plurality of data streams, each tuple comprising a data value associated with a point in time,

determining a value of the expression based on the data values of the received tuples, and

providing the value of the expression for the output data stream; and

sending the output data stream for display via a user interface.

7. The computer readable non-transitory storage medium of claim 6, wherein determining the value of the expression based on data values of the received tuples comprises aggregating data values of at least two of the plurality of data streams, each data value associated with the time interval.

8. The computer readable non-transitory storage medium of claim 6, the operations further comprising:

receiving a first set of data streams during a first time interval;

generating a first plurality of output data streams by evaluating the expression using the first set of data streams;

receiving a second set of data streams during a second time interval; and

generating a second plurality of output data streams by evaluating the expression using the second set of data streams.

9. The computer readable non-transitory storage medium of claim 6, wherein the data of a data stream is generated by an instruction executed by the instrumented software, the instruction associated with one of a counter or a gauge.

10. The computer readable non-transitory storage medium of claim 6, the operations further comprising:

receiving instructions for modifying the metadata objects describing a data stream; and

for subsequent time intervals, for each time interval;

evaluating the expression based on the modified metadata objects to generate a second output data stream, and

sending the second output data stream based on the modified metadata objects for display via the user interface.

11. A computer-implemented system for processing data generated by instrumented software, the system comprising:

a computer processor; and

computer readable non-transitory storage medium storing instructions thereon, the instructions executable by a processor to perform operations comprising;

receiving, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on the one or more external systems, each data stream comprising tuples, each tuple including values of a first set of attributes of the data stream;

receiving metadata objects describing each of the plurality of data streams, the metadata objects for a data stream describing a second set of attributes, each attribute of the second set distinct from the first set, wherein each metadata object is associated with information identifying a data stream and is associated with one or more properties each comprising a property name and a property value;

receiving a specification of an expression, the expression aggregating data across at least two of the plurality of data streams, the expression based on at least an attribute of the first set and an attribute of the second set, wherein the expression specifies a metadata object having a property name and property value;

selecting the at least two of the plurality of data streams based on the specified metadata object, the at least two of the plurality of data streams having metadata objects with a property value matching the property value of the specified metadata object;

evaluating the expression using at least two of the data streams over a plurality of time intervals to generate an output data stream, the evaluation of the expression comprising, for each time interval;

receiving one or more tuples from the plurality of data streams, each tuple comprising a data value associated with a point in time,

determining a value of the expression based on the data values of the received tuples, and

providing the value of the expression for the output data stream; and

sending the output data stream for display via a user interface.

12. The system of claim 11, wherein the instructions for determining the value of the expression based on data values of the received tuples comprise instructions for aggregating data values of at least two of the plurality of data streams, each data value associated with the time interval.

13. The system of claim 11, the operations further comprising:

receiving a first set of data streams during a first time interval;

generating a first plurality of output data streams by evaluating the expression using the first set of data streams;

receiving a second set of data streams during a second time interval; and

generating a second plurality of output data streams by evaluating the expression using the second set of data streams.

14. The system of claim 11, wherein the data of a data stream is generated by an instruction executed by the instrumented software, the instruction associated with one of a counter or a gauge.

15. The system of claim 11, the operations further comprising:

receiving instructions for modifying the metadata objects describing a data stream; and

for subsequent time intervals, for each time interval;

evaluating the expression based on the modified metadata objects to generate a second output data stream, and

sending the second output data stream based on the modified metadata objects for display via the user interface.