Creating entity definition from a search result set

• US 9,146,954 B1
• Filed: 01/31/2015
• Issued: 09/29/2015
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Boe, Brent, Hardin, Alan, Hsiao, Fang I., Reyes, Brian C.
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/611,195
• Time in Patent Office: 241 Days
• Field of Search: 709/203, 709223-229, 709/250
• US Class Current: 1/1
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A processing device performs a search query to produce a search result set having entries having data items. Each data item has an ordinal position. A table, having rows and columns, is displayed in a graphical user interface. Each data item of a particular entry appears in a respective column of the same row of the table. Each column corresponds to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each data item of the particular entry an element value of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Claims

1. A method comprising:

performing a search query in response to user input to produce a search result set comprising one or more entries each having one or more data items, each data item having an ordinal position within the entry;

causing display of a table in a graphical user interface (GUI), the table having one or more rows each having one or more columns, wherein each of the data items of a particular entry of the search result set appears in a respective column of the same row of the table, each respective column corresponding to the ordinal position of its respective data item within the entry;

receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains; and

creating or modifying and entity definition stored in computer memory, including storing for each of the data items of the particular entry of the search results set a value of an element of the entity definition, wherein;

the element of the entity definition has the element name designated for the respective column in which the data item appeared, and

the element of the entity definition is associated with an entity definition component having the type designated for the respective column in which the data item appeared;

wherein the entity definition represents an entity having corresponding machine data; and

wherein the method is performed by a computer system comprising one or more processing devices coupled to the computer memory.

2. The method of claim 1, wherein the search query is an ad-hoc search query.

3. The method of claim 1, wherein the search query is a saved search query.

4. The method of claim 1, wherein the search query specifies a tabular format for the search result set.

5. The method of claim 1, wherein the user input designating, for each respective column, the element name and the type of entity definition component to which the respective column pertains, comprises an indication of acceptance of one or more default values.

6. The method of claim 1, wherein causing display of a table in a GUI comprises displaying, for each respective column, a corresponding data item from a header entry of the search result set as the element name to which the respective column pertains.

7. The method of claim 1, wherein the type of entity definition component to which the respective column pertains corresponds to at least one of a name component, an alias component, and/or an informational field component.

8. The method of claim 1, further comprising:

receiving an indication to save an import configuration; and

storing the import configuration in response to the indication, the import configuration comprising information regarding, for at least one respective column, the element name and the type of entity definition component to which the respective column pertains as designated by the user input.

9. The method of claim 1, further comprising:

detecting a change between the search result set and a search result set produced by a secondary performance of the search query; and

performing the receiving and the storing of a particular entry of the search result set produced by the secondary performance of the search query, in accordance with a stored import configuration.

10. The method of claim 1, further comprising:

detecting a change between the search result set and a search result set produced by a secondary performance of the search query; and

performing the receiving and the storing of a particular entry of the search result set produced by the secondary performance of the search query, in accordance with a stored import configuration; and

wherein the secondary performance of the search query is a periodic performance.

11. The method of claim 1, further comprising:

receiving an indication to save an import configuration;

storing the import configuration in response to the indication, the import configuration comprising information regarding, for at least one respective column, the element name and the type of entity definition component to which the respective column pertains as designated by the user input;

detecting a change between the search result set and a search result set produced by a secondary performance of the search query;

performing the receiving and the storing of a particular entry of the search result set produced by the secondary performance of the search query, in accordance with a stored import configuration; and

wherein the secondary performance of the search query is a periodic performance.

12. The method of claim 1, wherein storing for each of the data items of the particular entry of the search result set a value of an element of an entity definition comprises at least one of:

adding an entity definition record for the entity definition to a data store, the entity definition record comprising the value of the element and the element name of the element,

replacing an existing entity definition record in the data store with a new entity definition record for the entity definition, the new entity definition record comprising the value of the element and the element name of the element, and/or

combining the value of the element with a second value of the element in an existing entity definition record in the data store.

13. The method of claim 1, wherein the entity is included in providing a service and the entity definition is associated with a service definition representing the service in a service monitoring system.

14. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data.

15. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data, the events identifiable using information of the entity definition.

16. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data, the events identifiable using alias component information of the entity definition.

17. The method of claim 1:

wherein the machine data associated with a particular entity by the entity definition is represented as events comprising a portion of raw data; and

wherein the entity provides a service; and

wherein the entity definition is associated with a service definition representing the service in a service monitoring system.

18. The method of claim 1, wherein receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains, comprises:

receiving a user input indicating, for a particular respective column, a selection from a list of one or more types of entity definition components.

19. The method of claim 1, wherein receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains, comprises:

receiving a user input indicating, for a particular respective column, a selection from a list of one or more types of entity definition components, the list being displayed in response to user interaction with a GUI element related to the type of entity definition component to which the particular respective column pertains.

20. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition is obtained through an application programming interface (API) from software that monitors the performance of the entity.

21. The method of claim 1, wherein the machine data corresponding with the entity is derived from network packet data including one or more identifiers associated with the entity.

22. The method of claim 1, wherein the entity comprises a component of an information technology environment.

23. The method of claim 1, wherein the machine data associated with a particular entity by the entity definition includes machine data produced by the entity.

24. The method of claim 1, wherein the entity represented by the entity definition includes at least one of a host machine, a virtual machine, a switch, a firewall, a router, and/or a sensor.

25. A system comprising:

a memory; and

a processing device coupled with the memory to;

perform a search query in response to user input to produce a search result set comprising one or more entries each having one or more data items, each data item having an ordinal position within the entry;

cause display of a table in a graphical user interface (GUI), the table having one or more rows each having one or more columns, wherein each of the data items of a particular entry of the search result set appears in a respective column of the same row of the table, each respective column corresponding to the ordinal position of its respective data item within the entry;

receive user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains; and

create or modify an entity definition stored in the memory, including to store for each of the data items of the particular entry of the search results set a value of an element of the entity definition, wherein;

the element of the entity definition has the element name designated for the respective column in which the data item appeared, and

the element of the entity definition is associated with an entity definition component having the type designated for the respective column in which the data item appeared;

wherein the entity definition represents an entity having corresponding machine data.

26. The system of claim 25, wherein the search query is an ad-hoc search query.

27. The system of claim 25, wherein the search query is a saved search query.

28. The system of claim 25, wherein the search query specifies a tabular format for the search result set.

29. The system of claim 25, wherein to cause display of a table in a GUI comprises displaying, for each respective column, a corresponding data item from a header entry of the search result set as the element name to which the respective column pertains.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

performing a search query in response to user input to produce a search result set comprising one or more entries each having one or more data items, each data item having an ordinal position within the entry;

causing display of a table in a graphical user interface (GUI), the table having one or more rows each having one or more columns, wherein each of the data items of a particular entry of the search result set appears in a respective column of the same row of the table, each respective column corresponding to the ordinal position of its respective data item within the entry;

receiving user input designating, for each respective column, an element name and a type of entity definition component to which the respective column pertains; and

creating or modifying an entity definition stored in computer memory, including storing for each of the data items of the particular entry of the search results set a value of an element of the entity definition, wherein;

the element of the entity definition has the element name designated for the respective column in which the data item appeared, and

the element of the entity definition is associated with an entity definition component having the type designated for the respective column in which the data item appeared; and

wherein the entity definition represents an entity having corresponding machine data.