VISUALIZATION OF DATA FROM CLUSTERS

• US 20140075327A1
• Filed: 09/07/2012
• Published: 03/13/2014
• Est. Priority Date: 09/07/2012
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Noel, Cary Glen, Pakkirisamy, Kirubakaran, Raitz, Alex, Tsai, Pierre
• Granted Patent: US 9,047,181 B2
• Time in Patent Office: Days
• US Class Current: 715/744
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: G06N 5/048 Fuzzy inferencing

Abstract

Embodiments are directed towards the visualization of machine data received from computing clusters. Embodiments may enable improved analysis of computing cluster performance, error detection, troubleshooting, error prediction, or the like. Individual cluster nodes may generate machine data that includes information and data regarding the operation and status of the cluster node. The machine data is received from each cluster node for indexing by one or more indexing applications. The indexed machine data including the complete data set may be stored in one or more index stores. A visualization application enables a user to select one or more analysis lenses that may be used to generate visualizations of the machine data. The visualization application employs the analysis lens to produce visualizations of the computing cluster machine data.

Claims

1-30. -30. (canceled)

31. A method comprising:

receiving machine data pertaining to a plurality of computational units;

repeatedly receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

dynamically determining an analysis lens, wherein the analysis lens is determined in response to the input;

using the analysis lens to analyze the received machine data;

determining, for each computational unit of a the plurality of computational units, a value of the current metric of interest, wherein the determination is based on the analysis;

dynamically generating a visualization, wherein the visualization simultaneously includes the value of the current metric of interest for each computational unit of the plurality of computational units; and

presenting the visualization.

32. The method of claim 31, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

33. The method of claim 31, further comprising indexing the received machine data.

34. The method of claim 31, further comprising receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

35. The method of claim 31, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

36. The method of claim 31, further comprising:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data,

wherein presenting the values of the current metric comprises presenting the severity level.

37. The method of claim 31, wherein the machine data comprises a stream of data, the stream of data including events with timestamps.

38. A network device comprising:

a memory device for storing instructions; and

a processor device that executes at least a portion of the stored instructions to enable a performance of a plurality of actions, the actions including;

receiving machine data pertaining to a plurality of computational units;

repeatedly receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

dynamically determining an analysis lens, wherein the analysis lens is determined in response to the input;

using the analysis lens to analyze the received machine data;

determining, for each computational unit of a the plurality of computational units, a value of the current metric of interest, wherein the determination is based on the analysis;

dynamically generating a visualization, wherein the visualization simultaneously includes the value of the current metric of interest for each computational unit of the plurality of computational units; and

presenting the visualization.

39. The network device of claim 38, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

40. The network device of claim 38, wherein the actions further comprise indexing the received machine data.

41. The network device of claim 38, wherein the actions further comprise receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

42. The network device of claim 38, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

43. The network device of claim 38, wherein the actions further comprise:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data,

wherein presenting the values of the current metric comprises presenting the severity level.

44. The network device of claim 38, wherein the machine data comprises a stream of data, the stream of data including events with timestamps.

45. A non-transitive storage medium that includes instructions, wherein execution of the instructions by a processor device enables performance a plurality of actions, the actions comprising:

receiving machine data pertaining to a plurality of computational units;

repeatedly receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

dynamically determining an analysis lens, wherein the analysis lens is determined in response to the input;

using the analysis lens to analyze the received machine data;

determining, for each computational unit of a the plurality of computational units, a value of the current metric of interest, wherein the determination is based on the analysis;

dynamically generating a visualization, wherein the visualization simultaneously includes the value of the current metric of interest for each computational unit of the plurality of computational units; and

presenting the visualization.

46. The medium of claim 45, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

47. The medium of claim 45, wherein the actions further comprise indexing the received machine data.

48. The medium of claim 45, wherein the actions further comprise receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

49. The medium of claim 45, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

50. The medium of claim 45, wherein the actions further comprise:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data,

wherein presenting the values of the current metric comprises presenting the severity level.

51. The medium of claim 45, wherein the machine data comprises a stream of data, the stream of data including events with timestamps.

52. A system for visual analysis of data over a network, comprising:

a plurality of nodes; and

a network device, including;

a memory device for storing instructions; and

a processor device that executes at least a portion of the stored instructions to enable performance of a plurality of actions, the actions including;

receiving machine data pertaining to a plurality of computational units;

repeatedly receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

dynamically determining an analysis lens, wherein the analysis lens is determined in response to the input;

using the analysis lens to analyze the received machine data;

determining, for each computational unit of a the plurality of computational units, a value of the current metric of interest, wherein the determination is based on the analysis;

dynamically generating a visualization, wherein the visualization simultaneously includes the value of the current metric of interest for each computational unit of the plurality of computational units; and

presenting the visualization.

53. The system of claim 52, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

54. The system of claim 52, wherein the actions further comprise indexing the received machine data.

55. The system of claim 52, wherein the actions further comprise receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

56. The system of claim 52, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

57. The system of claim 52, wherein the actions further comprise:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data,

wherein presenting the values of the current metric comprises presenting the severity level.

58. The system of claim 52, wherein the machine data comprises a stream of data, the stream of data including events with timestamps.