VISUALIZATIONS OF STATISTICS ASSOCIATED WITH CAPTURED NETWORK DATA

• US 20150341212A1
• Filed: 04/29/2015
• Published: 11/26/2015
• Est. Priority Date: 04/15/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Hsiao, Fang I., Jiang, Wei, Shcherbakov, Vladimir A., Chandrasekharan, Ramkumar, Ching, Clayton S.
• Granted Patent: US 10,462,004 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements containing a set of statistics associated with one or more event streams that comprise the time-series event data. The system then causes for display, in the GUI, one or more graphs comprising one or more values from the set of statistics. Finally, the system causes for display, in the GUI, a value of a statistic from the set of statistics based on a position of a cursor over the one or more graphs.

Claims

1. A method for facilitating the processing of network data, comprising:

causing for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

causing for display, in the GUI, a first set of user-interface elements comprising a set of statistics associated with one or more event streams that comprise the time-series event data;

causing for display, in the GUI, one or more graphs comprising one or more values from the set of statistics; and

causing for display, in the GUI, a value of a statistic from the set of statistics based on a position of a cursor over the one or more graphs.

2. The method of claim 1, further comprising:

updating, by the computer system, the set of statistics and the one or more graphs in real-time with the time-series event data from the one or more remote capture agents.

3. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements for changing a view of the one or more graphs.

4. The method of claim 1,

wherein the GUI further comprises a second set of user-interface elements for changing a view of the one or more graphs, and

wherein changing the view of the one or more graphs comprises at least one of:

changing a scale of a graph;

changing a time range associated with the set of statistics used to generate the graph; and

changing a host associated with the time-series event data and the set of statistics.

5. The method of claim 1, further comprising:

sorting the set of statistics by an attribute associated with the set of statistics.

6. The method of claim 1, further comprising:

sorting the set of statistics by an attribute associated with the set of statistics,

wherein the attribute is at least one of;

a name;

a total number of events;

a total incoming traffic;

a total outgoing traffic;

a total traffic; and

an index volume.

7. The method of claim 1, wherein the one or more graphs comprise a pie chart of an index volume across the one or more event streams.

8. The method of claim 1,

wherein the one or more graphs comprise a pie chart of an index volume across the one or more event streams, and

wherein the pie chart is updated with one or more values of an index volume of an event stream based on a position of a cursor over the pie chart.

9. The method of claim 1,

wherein the one or more graphs comprise a pie chart of an index volume across the one or more event streams,

wherein the pie chart is updated with one or more values of an index volume of an event stream based on a position of a cursor over the pie chart, and

wherein the one or more values comprise:

a percentage of a total index volume associated with the event stream; and

an amount of data associated with the index volume of the event stream.

10. The method of claim 1, wherein the set of statistics comprises at least one of:

a total number of events;

a total incoming traffic;

a total outgoing traffic;

a total traffic; and

an index volume.

11. The method of claim 1, wherein the one or more graphs comprise a bar chart of an index volume of the one or more event streams over time.

12. The method of claim 1,

wherein the one or more graphs comprise a bar chart of an index volume of the one or more event streams over time, and

wherein a bar in the bar chart comprises one or more segments representing the index volume of the one or more event streams over a time interval.

13. The method of claim 1,

wherein the one or more graphs comprise a bar chart of an index volume of the one or more event streams over time, and

wherein the bar chart is updated with a value of an index volume of an event stream based on a position of a cursor over the bar chart.

14. The method of claim 1,

wherein the one or more graphs comprise a bar chart of an index volume of the one or more event streams over time, and

wherein a portion of the bar chart is highlighted based on a position of a cursor over a legend of the bar chart.

15. The method of claim 1,

wherein the GUI further comprises a second set of user-interface elements for managing the one or more event streams, and

wherein managing the one or more event streams comprises enabling the generation of the set of statistics from an event stream without transmitting the event stream over a network for subsequent storage and processing of the event stream by one or more components on the network.

16. The method of claim 1,

wherein the GUI further comprises a second set of user-interface elements for managing the one or more event streams, and

wherein managing the one or more event streams comprises adjusting an amount of capture of the one or more event streams based on the set of statistics.

17. The method of claim 1, further comprising:

causing for display a value of a statistic from the set of statistics based on a position of a cursor over a legend associated with the one or more graphs.

18. The method of claim 1, wherein the value of the statistic comprises the index volume associated with the position of the cursor over the one or more graphs.

19. The method of claim 1, wherein the value of the statistic is at least one of:

a percentage of a total index volume associated with the one or more event streams; and

an amount of data associated with the index volume of the one or more event streams.

20. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over the one or more graphs.

21. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over the one or more graphs,

wherein changing the appearance of the one or more graphs comprises highlighting a portion of a graph based on the position of the cursor over the graph.

22. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over the one or more graphs,

wherein changing the appearance of the one or more graphs comprises dimming a portion of a graph based on the position of the cursor over the graph.

23. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over the one or more graphs,

wherein changing the appearance of the one or more graphs comprises highlighting a first portion of a graph and dimming a second portion of the graph based on the position of the cursor over the graph.

24. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over a legend associated with the one or more graphs.

25. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over a legend associated with the one or more graphs,

wherein changing the appearance of the one or more graphs comprises highlighting a portion of a graph based on the position of the cursor over the legend.

26. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over a legend associated with the one or more graphs,

wherein changing the appearance of the one or more graphs comprises dimming a portion of a graph based on the position of the cursor over the legend.

27. The method of claim 1, further comprising:

changing an appearance of the one or more graphs based on the position of the cursor over a legend associated with the one or more graphs,

wherein changing the appearance of the one or more graphs comprises highlighting a first portion of a graph and dimming a second portion of the graph based on the position of the cursor over the legend.

28. The method of claim 1, wherein causing for display, in the GUI, the value of the statistic comprises at least one of:

including the value of the statistic in a user-interface element of the GUI;

including a name of the statistic in the user-interface element;

including an identifier for the event stream in the user-interface element; and

displaying the user-interface element next to the position of the cursor.

29. An apparatus, comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the apparatus to;

cause for display a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

cause for display, in the GUI, a first set of user-interface elements comprising a set of statistics associated with one or more event streams that comprise the time-series event data;

cause for display, in the GUI, one or more graphs comprising one or more values from the set of statistics; and

cause for display, in the GUI, a value of a statistic from the set of statistics based on a position of a cursor over the one or more graphs

30. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating the processing of network data, the method comprising:

causing for display a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

causing for display, in the GUI, a first set of user-interface elements comprising a set of statistics associated with one or more event streams that comprise the time-series event data;

causing for display, in the GUI, one or more graphs comprising one or more values from the set of statistics; and

causing for display, in the GUI, a value of a statistic from the set of statistics based on a position of a cursor over the one or more graphs.