Visualization of data from clusters

• US 9,047,181 B2
• Filed: 09/07/2012
• Issued: 06/02/2015
• Est. Priority Date: 09/07/2012
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Noel, Cary Glen, Pakkirisamy, Kirubakaran, Raitz, Alex, Tsai, Pierre
• Primary Examiner(s): BROWN, SHEREE N
• Application Number:
  US13/607,192
• Publication Number:
  US 20140075327A1
• Time in Patent Office: 998 Days
• Field of Search: 715/744, 707/741, 707/602
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0712 in a virtual computing platform, e.g. logically partitioned systems
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: G06N 5/048 Fuzzy inferencing

Abstract

Embodiments are directed towards the visualization of machine data received from computing clusters. Embodiments may enable improved analysis of computing cluster performance, error detection, troubleshooting, error prediction, or the like. Individual cluster nodes may generate machine data that includes information and data regarding the operation and status of the cluster node. The machine data is received from each cluster node for indexing by one or more indexing applications. The indexed machine data including the complete data set may be stored in one or more index stores. A visualization application enables a user to select one or more analysis lenses that may be used to generate visualizations of the machine data. The visualization application employs the analysis lens to produce visualizations of the computing cluster machine data.

Claims

1. A computer-implemented method comprising:

receiving machine data pertaining to a plurality of computational units;

generating time stamped events from the received machine data, each time stamped event having a time stamp derived from time stamp data parsed from the received machine data;

receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

selecting a set of analysis parameters, wherein the set of analysis parameters is selected in response to the input;

analyzing the time stamped events using the set of analysis parameters;

determining, for each computational unit of the plurality of computational units, a value of the metric of interest, wherein the determination is based on the analyzed time stamped events;

causing display of a visualization, wherein the visualization simultaneously includes the value of the metric of interest for each computational unit of the plurality of computational units, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

2. The method of claim 1, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

3. The method of claim 1, further comprising indexing the received machine data.

4. The method of claim 1, further comprising receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

5. The method of claim 1, further comprising:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data, wherein presenting the values of the current metric comprises presenting the severity level.

6. A network device comprising:

a device, implemented at least partially in hardware, that receives machine data pertaining to a plurality of computational units;

a device, implemented at least partially in hardware, that generates time stamped events from the received machine data, each time stamped event having a time stamp derived from time stamp data parsed from the received machine data;

a device, implemented at least partially in hardware, that receives input identifying a current metric of interest that characterizes an aspect of computational performance;

a device, implemented at least partially in hardware, that selects a set of analysis parameters, wherein the set of analysis parameters is selected in response to the input;

a device, implemented at least partially in hardware, that analyzes the time stamped events using the set of analysis parameters;

a device, implemented at least partially in hardware, that determines, for each computational unit of the plurality of computational units, a value of the metric of interest, wherein the determination is based on the analyzed time stamped events;

a device, implemented at least partially in hardware, that causes display of a visualization, wherein the visualization simultaneously includes the value of the metric of interest for each computational unit of the plurality of computational units, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

7. The network device of claim 6, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

8. The network device of claim 6, further comprising:

a device, implemented at least partially in hardware, that indexes the received machine data.

9. The network device of claim 6, further comprising:

a device, implemented at least partially in hardware, that receives second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

10. The network device of claim 6, further comprising:

a device, implemented at least partially in hardware, that associates, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

a device, implemented at least partially in hardware, that determines a severity level based on the machine data, wherein presenting the values of the current metric comprises presenting the severity level.

11. A non-transitive storage medium that includes instructions, wherein execution of the instructions by a processor device enables performance a plurality of actions, the actions comprising:

receiving machine data pertaining to a plurality of computational units;

generating time stamped events from the received machine data, each time stamped event having a time stamp derived from time stamp data parsed from the received machine data;

receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

selecting a set of analysis parameters, wherein the set of analysis parameters is selected in response to the input;

analyzing the time stamped events using the set of analysis parameters;

determining, for each computational unit of the plurality of computational units, a value of the metric of interest, wherein the determination is based on the analyzed time stamped events;

causing display of a visualization, wherein the visualization simultaneously includes the value of the metric of interest for each computational unit of the plurality of computational units, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest.

12. The medium of claim 11, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

13. The medium of claim 11, wherein the actions further comprise indexing the received machine data.

14. The medium of claim 11, wherein the actions further comprise receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

15. The medium of claim 11, wherein the actions further comprise:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data, wherein presenting the values of the current metric comprises presenting the severity level.

16. A system for visual analysis of data over a network, comprising:

a plurality of nodes; and

a network device, including;

a memory device for storing instructions; and

a processor device that executes at least a portion of the stored instructions to enable performance of a plurality of actions, the actions including;

receiving machine data pertaining to a plurality of computational units;

generating time stamped events from the received machine data, each time stamped event having a time stamp derived from time stamp data parsed from the received machine data;

repeatedly receiving input identifying a current metric of interest that characterizes an aspect of computational performance;

dynamically selecting a set of analysis parameters, wherein the set of analysis parameters is selected in response to the input;

analyzing the time stamped events using the set of analysis parameters;

determining, for each computational unit of the plurality of computational units, a value of the current metric of interest, wherein the determination is based on the analyzed time stamped events;

dynamically generating a visualization, wherein the visualization simultaneously includes the value of the current metric of interest for each computational unit of the plurality of computational units, wherein the metric of interest is presented via a heat map, such that an overlay on a representation of a computational unit of the plurality of computational units reflects the corresponding metric of interest; and

presenting the visualization.

17. The system of claim 16, wherein each computational unit of the plurality of computational units comprises a computational cluster node.

18. The system of claim 16, wherein the actions further comprise indexing the received machine data.

19. The system of claim 16, wherein the actions further comprise receiving second input identifying a time point of interest, wherein the determined metric of interest characterizes the aspect of computational performance at the time point of interest.

20. The system of claim 16, wherein the actions further comprise:

associating, for each computational unit of the plurality of computational units, a portion of the machine data with the computational unit; and

determining a severity level based on the machine data, wherein presenting the values of the current metric comprises presenting the severity level.

21. The system of claim 16, wherein the machine data comprises a stream of data, the stream of data including events with timestamps.