Automatic event group actions

• US 10,209,956 B2
• Filed: 09/26/2016
• Issued: 02/19/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Fletcher, Tristan Antonio, Choudhary, Hemendra Singh, Lazerowitz, Ross Andrew, Sridhar, Chakravarthy
• Primary Examiner(s): Choi, David E
• Application Number:
  US15/276,776
• Publication Number:
  US 20170046127A1
• Time in Patent Office: 876 Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 7/10 Selecting, i.e. obtaining data of one kind from those record carriers which are identifiable by data of a second kind from a mass of ordered or randomly- distributed record carriers
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data
• CPC Class Codes: G06Q 30/0204 Market segmentation
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data

Abstract

An automatic service monitor in an information technology environment is equipped to automatically identify and group recognized events based on user-defined criteria, and to automatically perform user-defined operations against the group and its members at the detection of user-specified conditions.

Claims

1. A method comprising:

identifying a group of events from among a plurality of events in an event datastore based at least in part on group membership criteria of an event group policy definition;

automatically determining a satisfaction of a precondition based at least in part on information about the precondition included in the event group policy definition;

automatically causing a group action to be performed based at least in part on the satisfaction of the precondition and on information about the group action included in the event group policy definition;

wherein a performance of the group action updates stored information reflective of each of the events identified for the group;

wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by one or more processing devices.

2. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data.

3. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data;

and

wherein the event datastore and the machine data event datastore are a common datastore.

4. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of events each including a segment of machine data and a timestamp.

5. The method of claim 1 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema.

6. The method of claim 1 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema having one or more field extraction rules.

7. The method of claim 1 wherein the machine data is produced by more than one source.

8. The method of claim 1 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

9. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore.

10. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and a group breaking condition.

11. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and an identification of a source of information descriptive of the group.

12. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore and an identification of a group splitting field.

13. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, an identification of a group splitting field, and a group breaking condition.

14. The method of claim 1 wherein the information about the precondition includes information about at least one from among a group size limit, a group time limit, and an event identification.

15. The method of claim 1 wherein the information about the precondition includes information about a group time limit including at least one from among a group duration time limit and a group idle time limit.

16. The method of claim 1 wherein the information about the precondition includes information about at least one group time limit from among a group timespan limit and a group idle time limit.

17. The method of claim 1 wherein the information about the group action includes whether the group action applies to all or some of the events of the group.

18. The method of claim 1 wherein the information about the group action includes an identification of a field to be modified.

19. The method of claim 1 wherein the information about the group action includes a field value to store.

20. The method of claim 1 wherein the stored information reflective of each of the events identified for the group is information of an event group description instance.

21. The method of claim 1 wherein the stored information reflective of each of the events identified for the group is information representing the events of the group in the event datastore.

22. The method of claim 1 wherein the stored information reflective of each of the events identified for the group is information of an event group description instance and information representing each event in the event datastore.

23. A system comprising:

a memory; and

a processing device coupled with the memory to;

identify a group of events from among a plurality of events in an event datastore based at least in part on group membership criteria of an event group policy definition;

automatically determine a satisfaction of a precondition based at least in part on information about the precondition included in the event group policy definition;

automatically cause a group action to be performed based at least in part on the satisfaction of the precondition and on information about the group action included in the event group policy definition;

wherein a performance of the group action updates stored information reflective of each of the events identified for the group;

wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

24. The system of claim 23 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data.

25. The system of claim 23 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of events each including a segment of machine data and a timestamp.

26. The system of claim 23 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema.

27. The system of claim 23 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

28. The system of claim 23 wherein the group membership criteria includes a matching criteria for field data of the event datastore.

29. The system of claim 23 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and a group breaking condition.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

identifying a group of events from among a plurality of events in an event datastore based at least in part on group membership criteria of an event group policy definition;

automatically determining a satisfaction of a precondition based at least in part on information about the precondition included in the event group policy definition;

automatically causing a group action to be performed based at least in part on the satisfaction of the precondition and on information about the group action included in the event group policy definition;

wherein a performance of the group action updates stored information reflective of each of the events identified for the group;

wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.