Machine-learning data analysis tool

• US 10,607,150 B2
• Filed: 02/23/2016
• Issued: 03/31/2020
• Est. Priority Date: 02/23/2016
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Sainani, Manish, Slepian, Sergey, Makaremi, Iman, Oliner, Adam Jamison, Leverich, Jacob, Lu, Di
• Primary Examiner(s): Afshar, Kamran
• Assistant Examiner(s): Hoover, Brent Johnston
• Application Number:
  US15/050,785
• Publication Number:
  US 20170243132A1
• Time in Patent Office: 1,498 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

Disclosed herein is a computer-implemented tool that facilitates data analysis by use of machine learning (ML) techniques. The tool cooperates with a data intake and query system and provides a graphical user interface (GUI) that enables a user to train and apply a variety of different ML models on user-selected datasets of stored machine data. The tool can provide active guidance to the user, to help the user choose data analysis paths that are likely to produce useful results and to avoid data analysis paths that are less likely to produce useful results.

Claims

1. A method comprising:

generating, by a computer system, a graphical user interface that enables a user of a processing device to;

select a machine learning (ML) model for training, from a plurality of selectable ML models,

specify a first dataset of timestamped machine data events based on which the selected ML model is to be trained;

invoke training of the selected ML model based on the first dataset and view a trained ML model as a result of the training, and

invoke application of the trained ML model to a second dataset of timestamped machine data events and view a result of the application of the trained ML model to the second dataset;

dynamically generating user guidance on potential analysis paths for the user to take, based on the first dataset, wherein the user guidance on potential ML analysis paths for the user to take comprises

a suggested data field of the first dataset upon which to base training of the ML model; and

a suggested type of ML analysis to apply; and

causing the user guidance to be output to the user via the graphical user interface.

2. The method of claim 1, further comprising:

receiving user inputs from the user via the graphical user interface; and

in response to the user inputs, executing a process that includes at least one of;

training the selected ML model on the first dataset based on the user inputs,

displaying the result of the training, or

applying the selected ML model to the second user-identified set of data based on the user inputs; and

outputting to the user a result of the process, via the graphical user interface.

3. The method of claim 1, wherein generating the graphical user interface comprises providing a plurality of user input fields to receive user inputs that specify particular data fields of the first dataset, for training the selected ML model.

4. The method of claim 1, wherein generating the graphical user interface comprises providing a plurality of user input fields to receive user inputs that specify particular data fields for applying the selected ML model.

5. The method of claim 1, wherein generating the graphical user interface comprises:

providing a user input field for receiving user input that specifies a particular data field of the first dataset, based on which the selected ML model is to be trained;

identifying a subset of data fields in the first dataset as satisfying a predetermined criterion for relevance to the selected ML model; and

suggesting to the user the identified subset of the data fields of the first dataset, for possible selection by the user in the user input field.

6. The method of claim 1, wherein generating the graphical user interface comprises:

providing a user input field for receiving user input that specifies at least one of;

a particular data field of the first dataset, based on which the selected ML model is to be trained;

or

a particular data field of a second dataset, for applying the selected ML model; and

suggesting to the user a subset of data fields of the first dataset or a subset of the data fields of the second dataset, for possible selection by the user in the user input fields.

7. The method of claim 1, wherein the first dataset comprises a plurality of data fields, the method further comprising:

identifying a subset of the data fields in the first dataset as satisfying a predetermined criterion for relevance to the selected ML model.

8. The method of claim 1, wherein the first dataset comprises a plurality of data fields, the method further comprising:

identifying a subset of the data fields in the first dataset as satisfying a predetermined criterion for relevance to the selected ML model;

wherein generating the graphical user interface comprises;

providing a plurality of user input fields to receive user input specifying fields to use in training the ML model; and

indicating to the user the subset of the data fields in the first dataset identified as satisfying the predetermined criterion for relevance, in relation to at least one of the user input fields.

9. The method of claim 1, wherein the first dataset comprises a plurality of data fields, the method further comprising:

identifying a subset of the data fields in the first dataset as satisfying a predetermined criterion for relevance to the selected ML model;

receiving user inputs at the plurality of user input fields, the user inputs indicating user selections of data fields in the first dataset that are to be used to train the ML model; and

training the ML on the first dataset based on the user selections.

10. The method of claim 1, wherein the first dataset comprises a plurality of data fields, the method further comprising:

identifying a subset of the data fields in the first dataset as satisfying a predetermined criterion for relevance to the selected ML model; and

wherein identifying the subset of the data fields in the first dataset as satisfying the predetermined criterion for relevance to the selected ML model comprises executing a heuristic or a statistical method on the data fields in the first dataset to identify the subset of data fields.

11. The method of claim 1, wherein the first dataset comprises a plurality of data fields, the method further comprising:

identifying a subset of the data fields in the first dataset as satisfying a predetermined criterion for relevance to the selected ML model, by;

identifying a type of data upon which the selected ML model is designed to operate; and

identifying fields in the first dataset that are of said type, as the subset of the data fields in the first dataset.

12. The method of claim 1, wherein the first dataset includes a plurality of existing data fields, each having one or more corresponding data values;

the method further comprising;

applying a transformation to data values of a plurality of data fields of the first dataset, to produce new data values;

training the selected ML model based on the transformed data values; and

identifying a data field to suggest to the user, for possible selection by the user, based on a result of the training the selected ML model in relation to a predetermined quality criterion.

13. The method of claim 1, wherein the first dataset includes a plurality of existing data fields, each having one or more corresponding data values;

the method further comprising;

applying a transformation to the data values of at least one of the existing data fields of the first dataset, to produce a plurality of new data values associated with at least one new data field;

training the selected ML model based on the new data values; and

identifying one of the existing data fields, for possible selection by the user, based on a result of the training the selected ML model;

wherein providing the user guidance comprises indicating the identified existing data field to the user as the suggested data field.

14. The method of claim 1, wherein the first dataset includes a plurality of existing data fields, each having one or more corresponding data values;

the method further comprising;

applying a transformation to the data values of at least one of the existing data fields of the first dataset, to produce a plurality of new data values associated with at least one new data field;

training the selected ML model based on the new data values; and

identifying one of the new data fields to suggest to the user, for possible selection by the user, based on a result of the training the selected ML model;

wherein providing the user guidance comprises indicating the identified new data field to the user as the suggested data field.

15. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of types of data analysis.

16. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of types of data analysis;

wherein each of the query templates corresponds to a different type of data analysis, selectable by the user, for application to the result of training the ML model.

17. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of types of data analysis;

receiving, via the graphical user interface, first user inputs directed to a plurality of user input fields, the first user inputs identifying metadata of the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the identified metadata; and

generating a plurality of analysis queries related to the first dataset, by combining the metadata of the first dataset with each of the query templates, wherein each of the analysis queries can be executed to perform a different data analysis on the result of training the ML model on the first dataset.

18. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of types of data analysis;

receiving, via the graphical user interface, first user inputs directed to a plurality of user input fields, the first user inputs identifying metadata of the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the identified metadata; and

generating a plurality of analysis queries related to the first dataset automatically in response to the user-initiated request to invoke training of the ML model, by combining the metadata of the first dataset with each of the query templates, wherein each of the analysis queries can be executed to perform a different data analysis on the result of training the ML model on the first dataset.

19. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of types of data analysis;

receiving, via the graphical user interface, first user inputs directed to a plurality of user input fields, the first user inputs specifying data fields in the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the specified data fields; and

generating a plurality of analysis queries related to the first dataset, by combining the specified data fields of the first dataset with each of the query templates, wherein each of the analysis queries can be executed to perform a different data analysis on the result of training the ML model on the first dataset.

20. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of types of data analysis, each of the query templates including a plurality of variables;

receiving, via the graphical user interface, first user inputs directed to a plurality of user input fields, the first user inputs specifying data fields in the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the specified data fields; and

generating a plurality of analysis queries related to the first dataset, by replacing the variables in each of the query templates with appropriate ones of the data fields specified by the first user inputs, wherein each of the analysis queries can be executed to perform a different data analysis on the result of training the ML model on the first dataset.

21. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of analysis types;

receiving, via the graphical user interface, first user inputs directed to a plurality of user input fields, the first user inputs identifying metadata of the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the identified metadata; and

generating a plurality of analysis queries related to the first dataset, by combining the metadata of the first dataset with each of the query templates, wherein each of the analysis queries can be executed to perform a different analysis on the result of training the ML model on the first dataset;

displaying, in the graphical user interface, a plurality of analysis identifiers, each associated with a different one of the analysis queries;

receiving second user input selecting one of the analysis identifiers;

in response to the second user input, executing the analysis query corresponding to the selected analysis identifier to perform a corresponding data analysis; and

displaying to the user, via the graphical user interface, a result of executing the analysis query.

22. The method of claim 1, further comprising:

storing a plurality of query templates, each corresponding to a different one of a plurality of analysis types, each of the query templates including a plurality of variables;

receiving, via the graphical user interface, first user inputs directed to a plurality of user input fields, the first user inputs identifying metadata of the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the identified metadata;

generating a plurality of analysis queries related to the first dataset, by replacing the variables in each of the query templates with appropriate ones of data fields specified by the first user inputs, wherein each of the analysis queries can be executed to perform a different analysis on the result of training the ML model on the first dataset;

displaying, in the graphical user interface, a plurality of analysis identifiers, each associated with a different one of the analysis queries;

receiving second user input selecting one of the analysis identifiers;

in response to the second user input, executing the analysis query corresponding to the selected analysis identifier; and

displaying to the user, via the graphical user interface, a result of executing the analysis query.

23. The method of claim 1, wherein generating the graphical user interface comprises:

providing a plurality of user input fields to receive user inputs that specify at least one of;

particular data fields for training the selected ML model on the first dataset;

or

particular data fields for applying the selected ML model to a second dataset; and

identifying data fields that satisfy a predetermined criterion for relevance to the selected ML model, for selection by the user; and

indicating to the user the identified data fields that satisfy the predetermined criterion for relevance to the selected ML model, for possible selection by the user in the user input fields;

the method further comprising;

storing a plurality of query templates, each corresponding to a different one of a plurality of analysis types, wherein each of the query templates corresponds to a different type of analysis, selectable by the user, for application to the result of training the ML model;

receiving, via the graphical user interface, the user inputs directed to the user input fields, the user inputs specifying metadata of the first dataset;

receiving, via the graphical user interface, a user-initiated request to invoke training of the ML model using the identified data fields; and

generating a plurality of analysis queries related to the first dataset in response to the user-initiated request to invoke training of the ML model, by combining the metadata of the first dataset with each of the query templates, wherein each of the analysis queries can be executed to perform a different analysis on the result of training the ML model on the first dataset.

24. The method of claim 1, further comprising:

acquiring machine data from a plurality of machine data sources;

parsing the acquired machine data into a plurality of machine data events;

associating a timestamp for each of the machine data events to produce timestamped machine data events; and

using an indexer to index the timestamped machine data events.

25. The method of claim 1, further comprising:

acquiring machine data from a plurality of machine data sources;

parsing the acquired machine data into a plurality of machine data events;

associating a timestamp for each of the machine data events to produce timestamped machine data events;

using an indexer to index the timestamped machine data events;

retrieving at least a subset of the timestamped machine data events from the data store in response to a search query specified by the user through the graphical user interface; and

displaying the retrieved at least a subset of the timestamped machine data events to the user via the graphical user interface.

26. A computer system comprising:

a communication device through which to communicate on a computer network; and

at least one processor operatively coupled to the communication device and configured to execute operations including

generating a graphical user interface that enables a user of a processing device to;

select a machine learning (ML) model for training, from a plurality of selectable ML models,

specify a first dataset of timestamped machine data events based on which the selected ML model is to be trained;

invoke training of the selected ML model based on the first dataset and view a trained ML model as a result of the training, and

invoke application of the trained ML model to a second dataset of timestamped machine data events and view a result of the application of the trained ML model to the second dataset;

dynamically generating user guidance on potential analysis paths for the user to take, based on the first dataset, wherein the user guidance on potential ML analysis paths for the user to take comprises

a suggested data field of the first dataset upon which to base training of the ML model; and

a suggested type of ML analysis to apply; and

causing the user guidance to be output to the user via the graphical user interface.

27. A non-transitory machine-readable storage medium for use in a processing system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:

generating a graphical user interface that enables a user of a processing device to;

select a machine learning (ML) model for training, from a plurality of selectable ML models,

specify a first dataset of timestamped machine data events based on which the selected ML model is to be trained;

invoke training of the selected ML model based on the first dataset and view a trained ML model as a result of the training, and

invoke application of the trained ML model to a second dataset of timestamped machine data events and view a result of the application of the trained ML model to the second dataset;

dynamically generating user guidance on potential analysis paths for the user to take, based on the first dataset, wherein the user guidance on potential ML analysis paths for the user to take comprises

a suggested data field of the first dataset upon which to base training of the ML model; and

a suggested type of ML analysis to apply; and

causing the user guidance to be output to the user via the graphical user interface.