CORRELATING PERFORMANCE DATA

• US 20160226731A1
• Filed: 01/30/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Maroulis, Nikolaos
• Granted Patent: US 10,469,346 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3433 for load management allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/00 Network arrangements or protocols for supporting network services or applications user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/5681 Pre-fetching or pre-delivering data based on network characteristics
• CPC Class Codes: H04L 69/02 Protocol performance
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04W 4/025 using location based information parameters

Abstract

A data intake and query system collects performance data from client devices and host devices and stores the performance data in one or more indexes. The system is further configured to facilitate correlation of the performance data collected from the client devices and the separate performance data collected from the host devices. For example, based on a determination that one or more identifiers stored in a portion of performance data received from client devices match one or more identifiers stored in a portion of the performance data received from host devices, a data intake and query may determine that the data portions are related. The portions of performance data, for example, may correspond to events the data intake and query system derives from the performance data collected from both client devices and host devices.

Claims

1. A method, comprising:

receiving, from a client device, first performance data generated by a first application executing on the client device, the first performance data including at least an application instance identifier, a session identifier, and information related to the operation of the client device during a time when the first application encountered an application event related to network communications with a host device;

receiving, from the host device, second performance data generated by a second application executing on the host device, the second performance data including the application instance identifier, the session identifier, and information related to the operation of the host device during the time when the first application encountered the application event related to network communications with the host device;

determining, based on at least the application instance identifier and the session identifier, that at least a portion of the first performance data is related to at least a portion of the second performance data;

in response to determining that at least a portion of the first performance data is related to at least a portion of the second performance data, performing an action.

2. The method of claim 1, wherein the application event is associated with one or more network errors or performance issues experienced by the client device.

3. The method of claim 1, wherein the application event is associated with one or more network errors or performance issues experienced by the host device.

4. The method of claim 1, wherein the application event is associated with one or more network errors or performance issues associated with one or more networks connecting the client device and the host device.

5. The method of claim 1, wherein the first performance data includes information related to the operation of the client device during a time when the first application encountered one or more application events related to network communications with two or more host devices, the one or more application events associated with one or more network errors or performance issues.

6. The method of claim 1, wherein the first performance data includes information related to the operation of two or more client devices, wherein each of the two or more client devices encountered at least one application event associated with a network error or performance issue related to network communications with the host device.

7. The method of claim 1, wherein the application event is associated with a network error or performance issue, and wherein the first application stores the first performance data offline for a period of time prior to sending the first performance data to a data intake and query system.

8. The method of claim 1, wherein the second performance data includes data generated by a plurality of second applications executing on a plurality of host devices.

9. The method of claim 1, wherein the client device stores the application instance identifier and session identifier in one or more packet headers of a request sent to the host device.

10. The method of claim 1, wherein the application event is associated with one or more network errors or performance issues associated with the client device, and wherein the first performance data includes network performance information related to a network to which the client device was connected during the time when the first application encountered the application event related to network communications with the host device.

11. The method of claim 1, wherein the application event is associated with one or more network errors or performance issues associated with the client device, and wherein the first performance data includes information related to a geographic location of the client device during the time when the first application encountered the application event.

12. The method of claim 1, wherein the first performance data includes information identifying one or more of:

a manufacturer and model of the client device, one or more software applications installed on the client device, and a network carrier.

13. The method of claim 1, wherein the first application is a mobile application and wherein the second application is one or more of:

a web server, an application server, and a database server.

14. The method of claim 1, wherein determining that at least a portion of the first performance data is related to at least a portion of the second performance data includes determining that the application instance identifier of the first performance data matches the application instance identifier of the second performance data, and determining that the session identifier of the first performance data matches the session identifier of the second performance data.

15. The method of claim 1, wherein performing the action includes causing display of a report that includes information from both the first performance data and the second performance data, the information including a plurality of events derived from the first performance data and the second performance data.

16. The method of claim 1, wherein the application event is associated with one or more network errors or performance issues, and wherein performing the action comprises generating an alert indicating the one or more network errors or performance issues.

17. The method of claim 1, wherein the first performance data includes information related to a geographic location of the client device during the time when the first application encountered the application event related to network communications with the host device, the geographic location determined based on Global Positioning System (GPS) data or an IP address obtained from the client device.

18. The method of claim 1, further comprising:

wherein the first performance data includes data received from a plurality of client devices that each encountered at least one application event associated with a network error or performance issue related to network communications with the host device;

determining, based on a geographic location determined for each client device of the plurality of client devices, that the network error or performance issue is associated with a geographic area containing each of the plurality of client devices.

19. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause:

receiving, from a client device, first performance data generated by a first application executing on the client device, the first performance data including at least an application instance identifier, a session identifier, and information related to the operation of the client device during a time when the first application encountered an application event related to network communications with a host device;

receiving, from the host device, second performance data generated by a second application executing on the host device, the second performance data including the application instance identifier, the session identifier, and information related to the operation of the host device during the time when the first application encountered the application event related to network communications with the host device;

determining, based on at least the application instance identifier and the session identifier, that at least a portion of the first performance data is related to at least a portion of the second performance data;

in response to determining that at least a portion of the first performance data is related to at least a portion of the second performance data, performing an action.

20. The one or more non-transitory storage media of claim 19, wherein the application event is associated with one or more network errors or performance issues experienced by the client device.

21. The one or more non-transitory storage media of claim 19, wherein the application event is associated with a network error or performance issue, and wherein the first application stores the first performance data offline for a period of time prior to sending the first performance data to a data intake and query system.

22. The one or more non-transitory storage media of claim 19, wherein the client device stores the application instance identifier and session identifier in one or more packet headers of a request sent to the host device.

23. The one or more non-transitory storage media of claim 19, wherein the application event is associated with one or more network errors or performance issues associated with the client device, and wherein the first performance data includes network performance information related to a network to which the client device was connected during the time when the first application encountered the application event related to network communications with the host device.

24. The one or more non-transitory storage media of claim 19, wherein the application event is associated with one or more network errors or performance issues associated with the client device, and wherein the first performance data includes information related to a geographic location of the client device during the time when the first application encountered the application event.

25. The one or more non-transitory storage media of claim 19, wherein the first performance data includes information identifying one or more of:

a manufacturer and model of the client device, one or more software applications installed on the client device, and a network carrier.

26. The one or more non-transitory storage media of claim 19, wherein determining that at least a portion of the first performance data is related to at least a portion of the second performance data includes determining that the application instance identifier of the first performance data matches the application instance identifier of the second performance data, and determining that the session identifier of the first performance data matches the session identifier of the second performance data.

27. A system comprising:

one or more components of a data intake and query system;

logic, implemented at least partially by hardware at a system component of the one or more components of the data intake and query system, that receives first performance data from a client device, the first performance data including at least an application instance identifier, a session identifier, and information related to the operation of the client device during a time when the first application encountered an application event related to network communications with a host device;

logic, implemented at least partially by hardware at a system component of the one or more components of the data intake and query system, that receives second performance data from a host device, the second performance data including the application instance identifier, the session identifier, and information related to the operation of the host device during the time when the first application encountered the application event related to network communications with the host device;

logic, implemented at least partially by hardware at a system component of the one or more components of the data intake and query system, that determines, based on at least the application instance identifier and the session identifier, that at least a portion of the first performance data is related to at least a portion of the second performance data;

logic, implemented at least partially by hardware at a system component of the one or more components of the data intake and query system, that, in response to determining that at least a portion of the first performance data is related to at least a portion of the second performance data, performs an action.

28. The system of claim 27, wherein the application event is associated with a network error or performance issue, and wherein the first application stores the first performance data offline for a period of time prior to sending the first performance data to a data intake and query system.

29. The system of claim 27, wherein the client device stores the application instance identifier and session identifier in one or more packet headers of a request sent to the host device.

30. The system of claim 27, wherein the application event is associated with one or more network errors or performance issues associated with the client device, and wherein the first performance data includes information related to a geographic location of the client device during the time when the first application encountered the application event.