Systems and methods for exploratory analysis of data for event management

• US 6,836,894 B1
• Filed: 07/27/1999
• Issued: 12/28/2004
• Est. Priority Date: 07/27/1999
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Demion, Steven S., Ma, Sheng, Hellerstein, Joseph L.
• Primary Examiner(s): Lee, Thomas
• Assistant Examiner(s): HO, ANDY
• Application Number:
  US09/359,874
• Time in Patent Office: 1,981 Days
• Field of Search: 709/318, 709/310, 709/100, 709/328
• US Class Current: 719/318
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data

Abstract

Systems and methods are provided for exploratory analysis of event messages. The invention includes a parsing engine to translate textual messages into structured event data, a selection and control engine (SCE) to provide data management and communication channels for a set of analysis methods, and viewers to support different kinds of analysis methods. The invention further includes a mechanism for viewers to exchange information, a mechanism for interactively and iteratively refining parsing rules, and a mechanism to visualize events through event graphs.

Claims

1. A processor-based method for use in analyzing non-fully structured data which is associated with one or more events, the method comprising the steps of:

parsing at least a portion of the non-fully structured data according to one or more parsing rules to convert the at least a portion of non-fully structured data to structured data;

providing presentation operations which are respectively able to provide a presentation of at least a portion of the non-fully structured data, format at least a portion of the structured data to provide a presentation of a graphical representation of the at least a portion of structured data, and format at least a portion of the structured data to provide a presentation of a summary representation of the at least a portion of structured data; and

coordinating data associated with two or more of the presentations, when desired, to enable a coordinated analysis of the data wherein at least a portion of the data associated with the two or more presentations is exchangeable in accordance with the two or more presentations.

2. The method of claim 1, further comprising the step of providing coordinated views for at least two of the graphical representation, the summary representation and the non-fully structured data presentation.

3. The method of claim 1, further comprising the step of modifying the one or more parsing rules to affect the parsing operation.

4. The method of claim 1, further comprising the step of providing a rubber-banding operation in association with the graphical representation.

5. The method of claim 1, further comprising the step of providing a zooming operation in association with the graphical representation.

6. The method of claim 1, wherein the summary representation includes one or more attributes associated with the at least a portion of structured data.

7. The method of claim 1, further comprising the step of providing a selection operation in association with aspects of at least one of the non-fully structured data and the structured data.

8. The method of claim 1, further comprising the step of providing a filtering operation in association with aspects of at least one of the non-fully structured data and the structured data.

9. A system for use in analyzing non-fully structured data which is associated with one or more events, the system comprising:

a parsing engine which parses at least a portion of the non-fully structured data according to one or more parsing rules to convert the at least a portion of non-fully structured data to structured data;

viewers which are respectively able to provide a presentation of at least a portion of the non-fully structured data, format at least a portion of the structured data to provide a presentation of a graphical representation of the at least a portion of structured data, and format at least a portion of the structured data to provide a presentation of a summary representation of the at least a portion of structured data, wherein data associated with two or more of the presentations is coordinated, when desired, to enable a coordinated analysis of the data wherein at least a portion of the data associated with the two or more presentations is exchangeable in accordance with the two or more presentations; and

a selection and control engine coupled to the parsing engine and the viewers which controls operations associated with the parsing engine and the viewers.

10. The system of claim 9, wherein the operations controlled by the selection and control engine include at least one of data and parsing rule access.

11. The system of claim 9, wherein the operations controlled by the selection and control engine include communications between the viewers.

12. Apparatus for use in analyzing non-fully structured data which is associated with one or more events, the apparatus comprising:

at least one processor operable to;

(i) parse at least a portion of the non-fully structured data according to one or more parsing rules to convert the at least a portion of non-fully structured data to structured data;

(ii) provide presentation operations which are respectively able to provide a presentation of at least a portion of the non-fully structured data, format at least a portion of the structured data to provide a presentation of a graphical representation of the at least a portion of structured data, and format at least a portion of the structured data to provide a presentation of a summary representation of the at least a portion of structured data; and

(iii) coordinate data associated with two or more of the presentations, when desired, to enable a coordinated analysis of the data wherein at least a portion of the data associated with the two or more presentations is exchangeable in accordance with the two or more presentations; and

memory coupled to the at least one processor for storing at least one of the non-fully structured data, the structured data and the one or more parsing rules.

13. The apparatus of claim 12, wherein the at least one processor is further operable to provide coordinated views for at least two of the graphical representation, the summary representation and the non-fully structured data presentation.

14. The apparatus of claim 12, wherein the at least one processor is further operable to modify the one or more parsing rules to affect the parsing operation.

15. The apparatus of claim 12, wherein the at least one processor is further operable to provide a rubber-banding operation in association with the graphical representation.

16. The apparatus of claim 12, wherein the at least one processor is further operable to provide a zooming operation in association with the graphical representation.

17. The apparatus of claim 12, wherein the summary representation includes one or more attributes associated with the at least a portion of structured data.

18. The apparatus of claim 12, wherein the at least one processor is further operable to provide a selection operation in association with aspects of at least one of the non-fully structured data and the structured data.

19. The apparatus of claim 12, wherein the at least one processor is further operable to provide a filtering operation in association with aspects of at least one of the non-fully structured data and the structured data.

20. An article of manufacture for use in analyzing non-fully structured data which is associated with one or more events, comprising a machine readable medium containing one or more programs which when executed implement the steps of:

parsing at least a portion of the non-fully structured data according to one or more parsing rules to convert the at least a portion of non-fully structured data to structured data;

providing presentation operations which are respectively able to provide a presentation of at least a portion of the non-fully structured data, format at least a portion of the structured data to provide a presentation of a graphical representation of the at least a portion of structured data, and format at least a portion of the structured data to provide a presentation of a summary representation of the at least a portion of structured data; and

coordinating data associated with two or more of the presentations, when desired, to enable a coordinated analysis of the data wherein at least a portion of the data associated with the two or more presentations is exchangeable in accordance with the two or more presentations.