CIRCULAR TIMELINE DISPLAYS OF TIMESTAMPED EVENT DATA

• US 20170083585A1
• Filed: 01/30/2016
• Published: 03/23/2017
• Est. Priority Date: 09/21/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Chen, Peter, Zhang, Min, Shao, Feng, Zhong, Qianjie, QIN, Geng, Young, D. Randall, Zhang, Roy, ZHANG, Aaron
• Granted Patent: US 10,459,819 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 2201/835 Timestamp
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Techniques and mechanisms are disclosed that enable a data intake and query system to generate and cause display of circular timelines of timestamped event data. As used herein, a circular timeline generally refers to a graphical display of timestamped events stored by a data intake and query system, wherein the timestamped events may be displayed as arcs of one or more concentric circles and located in a circular timeline area according to a chronological ordering associated with the events. One or more display attributes of each arc may further depend on other data associated with the corresponding events. For example, each arc of a circular time may be displayed at a particular radial distance, with a particular thickness, using a particular shading and/or color, etc., depending on various data values associated with the one or more events represented by the arc.

Claims

1. A method, comprising:

receiving a request to display a plurality of timestamped events, each timestamped event of the plurality of timestamped events parsed from data related to performance and/or security characteristics of one or more computing devices of an information technology environment;

generating a circular timeline display including graphical indications of at least a subset of the plurality of timestamped events, each graphical indication forming an arc that begins at a first location corresponding to a start timestamp of a respective timestamped event and ends at a second location corresponding to an end timestamp of the respective timestamped event;

causing display of a graphical user interface including the circular timeline display.

2. The method of claim 1, wherein each timestamped event of the plurality of timestamped events is parsed from machine data received from at least one data source, and wherein each timestamped event of the plurality of timestamped events includes a portion of the machine data.

3. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events are parsed from machine data reflecting network traffic activity in an information technology environment, and wherein each timestamped event of the plurality of timestamped events includes a portion of the machine data.

4. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events are parsed from machine data reflecting computing device activities in an information technology environment, and wherein each timestamped event of the plurality of timestamped events includes a portion of the machine data.

5. The method of claim 1, wherein the arc for one or more timestamped events of the plurality of timestamped events is displayed at a radial distance that corresponds to a value associated with the one or more timestamped events.

6. The method of claim 1, wherein each timestamped event of the plurality of timestamped events includes an event host value indicating a network host from which the timestamped event originated, an event source value indicating a data input from which the timestamped event originated, and an event source type value indicating a format of the data input from the timestamped event originated.

7. The method of claim 1, wherein a particular radius of the circular timeline display defines both of a start time and an end time for the plurality of timestamped events displayed in the circular timeline display.

8. The method of claim 1, wherein the circular timeline display is less than a full circle.

9. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events includes a value identifying a geographic location, and wherein the arc for the one or more timestamped events is displayed at a radial distance that corresponds to the distance of the geographic location from another geographic location.

10. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events includes a value indicating a package size of a network request, and wherein the arc for the one or more timestamped events is displayed at a radial distance that corresponds to the package size of the network request relative to other timestamped events.

11. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events includes a value indicating a bandwidth measurement of a network request, and wherein the arc for the one or more timestamped events is displayed at a radial distance that corresponds to the bandwidth measurement value relative to other timestamped events.

12. The method of claim 1, further comprising:

wherein a particular radius of the circular timeline display defines a start time boundary and an end time boundary for the circular timeline display;

receiving a selection of a sector of the circular timeline display for a drill-down display, the sector comprising a subset of the plurality of timestamped events;

regenerating the circular timeline display, wherein the particular radius of the regenerated circular timeline display defines a new start time boundary and end time boundary corresponding to the selected sector of the circular timeline display;

causing display of the regenerated circular timeline display.

13. The method of claim 1, further comprising:

wherein a particular radius of the circular timeline display defines a start time boundary and an end time boundary for the circular timeline display;

receiving a selection for drill-down display of a portion of a sector of the circular timeline display, the portion of the sector comprising a subset of the plurality of timestamped events;

regenerating the circular timeline display, wherein the particular radius of the regenerated circular timeline display defines a new start time boundary and end time boundary corresponding to the selected portion of the sector of the circular timeline display;

causing display of the regenerated circular timeline display.

14. The method of claim 1, wherein overlapping timestamped events are displayed using a color from a gradient of colors based on a number of overlapping timestamped events.

15. The method of claim 1, wherein the arc for one or more timestamped events of the plurality of timestamped events is displayed at a radial distance that corresponds to a first value associated with each of the one or more timestamped events, and wherein the thickness of the arc is based on a second value associated with each of the one or more timestamped events.

16. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events includes a value indicating a geographic location, and wherein the arc for each of the one or more timestamped events is displayed at a radial distance that corresponds to the distance of the geographic location from another geographic location, and wherein the thickness of the arc is based on a value indicating a package size of a network request.

17. The method of claim 1, wherein the request to display the plurality of timestamped events is received via a graphical user interface displaying the plurality of timestamped events as a set of search results.

18. The method of claim 1, wherein the request to display the plurality of timestamped events is received via a graphical user interface displaying a topology map, the topology map generated based on performance data and relationship data related to a plurality of computing resources.

19. A non-transitory computer readable storage medium, storing instructions, which when executed by one or more processors causes:

receiving a request to display a plurality of timestamped events, each timestamped event of the plurality of timestamped events parsed from data related to performance and/or security characteristics of one or more computing devices of an information technology environment;

generating a circular timeline display including graphical indications of at least a subset of the plurality of timestamped events, each graphical indication forming an arc that begins at a first location corresponding to a start timestamp of a respective timestamped event and ends at a second location corresponding to an end timestamp of the respective timestamped event;

causing display of a graphical user interface including the circular timeline display.

20. An apparatus, comprising:

a subsystem, implemented at least partially in hardware, that receives a request to display a plurality of timestamped events, each timestamped event of the plurality of timestamped events parsed from data related to performance and/or security characteristics of one or more computing devices of an information technology environment;

a subsystem, implemented at least partially in hardware, that generates a circular timeline display including graphical indications of at least a subset of the plurality of timestamped events, each graphical indication forming an arc that begins at a first location corresponding to a start timestamp of a respective timestamped event and ends at a second location corresponding to an end timestamp of the respective timestamped event;

a subsystem, implemented at least partially in hardware, that causes display of a graphical user interface including the circular timeline display.