Creating entity definition from a file

• US 9,130,832 B1
• Filed: 01/31/2015
• Issued: 09/08/2015
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Boe, Brent, Hardin, Alan, Reyes, Brian C., Hsiao, Fang I.
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/611,190
• Time in Patent Office: 220 Days
• Field of Search: 709/203, 709223-229, 709/250
• US Class Current: 1/1
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/2282 Tablespace storage structures; Management thereof
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 41/5083 wherein the managed service relates to web hosting
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Processing devices receive a file having entries having data items separated by delimiters. Each data item has an ordinal position. The processing device(s) cause display of a table, having rows and columns, in a graphical user interface. Each data items of a particular entry appears in a respective column of the same row. Each column corresponds to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each of the data items of the particular entry a value of an element of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Claims

1. A method comprising:

receiving a file comprising a plurality of entries, each entry comprising one or more data items separated by one or more delimiters, each data item having an ordinal position within the entry;

causing display of a table in a graphical user interface (GUI), the table having one or more rows each having one or more columns, wherein each of the data items of a particular entry of the file appears in a respective column of the same row of the table, each respective column corresponding to the ordinal position of its respective data item within the entry;

receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains; and

creating or modifying an entity definition stored in computer memory, including storing for each of the data items of the particular entry of the file a value of an element of the entity definition, wherein;

the element of the entity definition has the element name designated for the respective column in which the data item appeared, and

the element of the entity definition is associated with an entity definition component having the type designated for the respective column in which the data item appeared;

wherein the entity definition represents an entity having corresponding machine data; and

wherein the method is performed by a computer system comprising one or more processing devices coupled to the computer memory.

2. The method of claim 1, wherein the user input designating, for each respective column, the element name and the type of entity definition component to which the respective column pertains, comprises an indication of acceptance of one or more default values.

3. The method of claim 1, wherein causing display of a table in a GUI comprises displaying, for each respective column, a corresponding data item from a header entry of the file as the element name to which the respective column pertains.

4. The method of claim 1, wherein the type of entity definition component to which the respective column pertains corresponds to at least one of a name component, an alias component, and/or an informational field component.

5. The method of claim 1, further comprising:

receiving an indication to save an import configuration; and

storing the import configuration in response to the indication, the import configuration comprising information regarding, for at least one respective column, the element name and the type of entity definition component to which the respective column pertains as designated by the user input.

6. The method of claim 1, further comprising:

monitoring for a change to the file; and

performing the receiving and the storing of a particular entry of the changed file in accordance with a stored import configuration.

7. The method of claim 1, further comprising:

receiving an indication to save an import configuration;

storing the import configuration in response to the indication, the import configuration comprising information regarding, for at least one respective column, the element name and the type of entity definition component to which the respective column pertains as designated by the user input;

monitoring for a change to the file; and

performing the receiving and the storing of a particular entry of the changed file in accordance with the stored import configuration.

8. The method of claim 1, wherein storing for each of the data items of the particular entry of the file a value of an element of an entity definition comprises at least one of:

adding an entity definition record for the entity definition to a data store, the entity definition record comprising the value of the element and the element name of the element,

replacing an existing entity definition record in the data store with a new entity definition record for the entity definition, the new entity definition record comprising the value of the element and the element name of the element, and/or

combining the value of the element with a second value of the element in an existing entity definition record in the data store.

9. The method of claim 1, wherein the entity is included in providing a service and the entity definition is associated with a service definition representing the service in a service monitoring system.

10. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data.

11. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data, the events identifiable using information of the entity definition.

12. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data, the events identifiable using alias component information of the entity definition.

13. The method of claim 1:

wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data; and

wherein the entity provides a service; and

wherein the entity definition is associated with a service definition representing the service in a service monitoring system.

14. The method of claim 1, wherein receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains, comprises:

receiving a user input indicating, for a particular respective column, a selection from a list of one or more types of entity definition components.

15. The method of claim 1, wherein receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains, comprises:

receiving a user input indicating, for a particular respective column, a selection from a list of one or more types of entity definition components, the list being displayed in response to user interaction with a GUI element related to the type of entity definition component to which the particular respective column pertains.

16. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is obtained through an application programming interface (API) from software that monitors the performance of the entity.

17. The method of claim 1, wherein the machine data corresponding with the entity is derived from network packet data including one or more identifiers associated with the entity.

18. The method of claim 1, wherein the entity comprises a component of an information technology environment.

19. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition includes machine data produced by the entity.

20. The method of claim 1, wherein the entity represented by the entity definition includes at least one of a host machine, a virtual machine, a switch, a firewall, a router, and/or a sensor.

22. The system of claim 20, wherein the user input designating, for each respective column, the element name and the type of entity definition component to which the respective column pertains, comprises an indication of acceptance of one or more default values.

23. The system of claim 20, wherein to cause display of a table in a GUI comprises causing to display, for each respective column, a corresponding data item from the header entry of the file as the element name to which the respective column pertains.

24. The system of claim 20, wherein the type of entity definition component to which the respective column pertains corresponds to at least one of a name component, an alias component, and/or an informational field component.

25. The system of claim 20, wherein the entity provides a service, and the entity definition is associated with a service definition representing the service in a service monitoring system.

26. The system of claim 20, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data.

27. The system of claim 20, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data, the events identifiable using information of the entity definition.

28. The system of claim 20:

wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data, and the entity provides a service, and the entity definition is associated with a service definition representing the service in a service monitoring system.

29. The system of claim 20, wherein to receive user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains, comprises:

to receive a user input indicating, for a particular respective column, a selection from a list of one or more types of entity definition components, the list being displayed in response to user interaction with a GUI element related to the type of entity definition component to which the particular respective column pertains.

21. A system comprising:

a memory; and

a processing device coupled with the memory to;

receive a file comprising a plurality of entries, each entry comprising one or more data items separated by one or more delimiters, each data item having an ordinal position within the entry;

cause display of a table in a graphical user interface (GUI), the table having one or more rows each having one or more columns, wherein each of the data items of a particular entry of the file appears in a respective column of the same row of the table, each respective column corresponding to the ordinal position of its respective data item within the entry;

receive user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains; and

create or modify an entity definition stored in the memory, including to store for each of the data items of the particular entry of the file a value of an element of the entity definition, wherein;

the element of the entity definition has the element name designated for the respective column in which the data item appeared, and

the element of the entity definition is associated with an entity definition component having the type designated for the respective column in which the data item appeared;

wherein the entity definition represents an entity having corresponding machine data.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

receiving a file comprising a plurality of entries, each entry comprising one or more data items separated by one or more delimiters, each data item having an ordinal position within the entry;

causing display of a table in a graphical user interface (GUI), the table having one or more rows each having one or more columns, wherein each of the data items of a particular entry of the file appears in a respective column of the same row of the table, each respective column corresponding to the ordinal position of its respective data item within the entry;

receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains; and

creating or modifying an entity definition stored in computer memory, including storing for each of the data items of the particular entry of the file a value of an element of the entity definition, wherein;

the element of the entity definition has the element name designated for the respective column in which the data item appeared, and

the element of the entity definition is associated with an entity definition component having the type designated for the respective column in which the data item appeared; and

wherein the entity definition represents an entity having corresponding machine data.