Circular timeline displays of timestamped event data

• US 10,459,819 B2
• Filed: 01/30/2016
• Issued: 10/29/2019
• Est. Priority Date: 09/21/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Chen, Peter, Zhang, Min, Shao, Feng, Zhong, Qianjie, Qin, Geng, Young, D. Randall, Zhang, Roy, Zhang, Aaron
• Primary Examiner(s): Beausoliel, Jr., Robert W
• Assistant Examiner(s): Santos, Pedro J
• Application Number:
  US15/011,517
• Publication Number:
  US 20170083585A1
• Time in Patent Office: 1,368 Days
• Field of Search: 707725
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 2201/835 Timestamp
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Techniques and mechanisms are disclosed that enable a data intake and query system to generate and cause display of circular timelines of timestamped event data. As used herein, a circular timeline generally refers to a graphical display of timestamped events stored by a data intake and query system, wherein the timestamped events may be displayed as arcs of one or more concentric circles and located in a circular timeline area according to a chronological ordering associated with the events. One or more display attributes of each arc may further depend on other data associated with the corresponding events. For example, each arc of a circular time may be displayed at a particular radial distance, with a particular thickness, using a particular shading and/or color, etc., depending on various data values associated with the one or more events represented by the arc.

Claims

1. A method, comprising:

receiving a request to display a plurality of timestamped events, each timestamped event of the plurality of timestamped events parsed from data related to performance and/or security characteristics of one or more computing devices of an information technology environment;

generating a circular timeline display displaying a period of time including a start time and an end time;

generating, for all events of a subset of the plurality of timestamped events, an arc within the circular timeline display representative of a respective event of the subset of timestamped events, wherein each respective arc comprises;

a beginning at a first location within the circular timeline display that is indicative of a start timestamp of the respective event relative to the start time and the end time;

an ending at a second location within the circular timeline display that is indicative of an end timestamp of the respective event relative to the start time and the end time; and

a length that is indicative of a duration between the start timestamp and the end timestamp of the respective event relative to the period of time displayed by the circular timeline display; and

causing display of a graphical user interface including the circular timeline display.

2. The method of claim 1, wherein each timestamped event of the plurality of timestamped events is parsed from machine data received from at least one data source, and wherein each timestamped event of the plurality of timestamped events includes a portion of the machine data.

3. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events are parsed from machine data reflecting network traffic activity in an information technology environment, and wherein each timestamped event of the plurality of timestamped events includes a portion of the machine data.

4. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events are parsed from machine data reflecting computing device activities in an information technology environment, and wherein each timestamped event of the plurality of timestamped events includes a portion of the machine data.

5. The method of claim 1, wherein each respective arc is displayed within the circular timeline display at a radial distance that corresponds to a value associated with the respective event of the subset of timestamped events that the respective arc is representative of.

6. The method of claim 1, wherein each timestamped event of the plurality of timestamped events includes an event host value indicating a network host from which the timestamped event originated, an event source value indicating a data input from which the timestamped event originated, and an event source type value indicating a format of the data input from the timestamped event originated.

7. The method of claim 1, wherein a particular radius of the circular timeline display defines both the start time and the end time of the circular timeline display.

8. The method of claim 1, wherein the circular timeline display is less than a full circle.

9. The method of claim 1, wherein each timestamped event of the plurality of timestamped events includes a value identifying a geographic location, and wherein each respective arc is displayed within the circular timeline display at a radial distance that corresponds to the distance from another geographic location to the geographic location identified by the respective event of the subset of timestamped events that the respective arc is representative of.

10. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events includes a value indicating a package size of a network request, and wherein the arc for the one or more timestamped events is displayed at a radial distance that corresponds to the package size of the network request relative to other timestamped events.

11. The method of claim 1, wherein one or more timestamped events of the plurality of timestamped events includes a value indicating a bandwidth measurement of a network request, and wherein the arc for the one or more timestamped events is displayed at a radial distance that corresponds to the bandwidth measurement value relative to other timestamped events.

12. The method of claim 1, further comprising:

wherein a particular radius of the circular timeline display defines a start time boundary and an end time boundary for the circular timeline display;

receiving a selection of a sector of the circular timeline display for a drill-down display, the sector comprising a subset of the plurality of timestamped events;

regenerating the circular timeline display, wherein the particular radius of the regenerated circular timeline display defines a new start time boundary and end time boundary corresponding to the selected sector of the circular timeline display;

causing display of the regenerated circular timeline display.

13. The method of claim 1, further comprising:

wherein a particular radius of the circular timeline display defines a start time boundary and an end time boundary for the circular timeline display;

receiving a selection for drill-down display of a portion of a sector of the circular timeline display, the portion of the sector comprising a subset of the plurality of timestamped events;

regenerating the circular timeline display, wherein the particular radius of the regenerated circular timeline display defines a new start time boundary and end time boundary corresponding to the selected portion of the sector of the circular timeline display;

causing display of the regenerated circular timeline display.

14. The method of claim 1, wherein overlapping timestamped events are displayed using a color from a gradient of colors based on a number of overlapping timestamped events.

15. The method of claim 1, wherein each respective arc is displayed within the circular timeline display at a radial distance that corresponds to a first value associated with the respective event of the subset of timestamped events that the respective arc is representative of, and wherein the thickness of the respective arc is based on a second value associated with the respective event of the subset of timestamped events that the respective arc is representative of.

16. The method of claim 1, wherein each timestamped event of the plurality of timestamped events includes a value indicating a geographic location and a value indicating a package size of a network request, and wherein each respective arc is displayed within the circular timeline display at a radial distance that corresponds to the distance from another geographic location to the geographic location identified by the respective event of the subset of timestamped events that the respective arc is representative of, and with a thickness based on the package size of the network request indicated by the respective event of the subset of timestamped events that the respective arc is representative of.

17. The method of claim 1, wherein the request to display the plurality of timestamped events is received via a graphical user interface displaying the plurality of timestamped events as a set of search results.

18. The method of claim 1, wherein the request to display the plurality of timestamped events is received via a graphical user interface displaying a topology map, the topology map generated based on performance data and relationship data related to a plurality of computing resources.

19. The method of claim 1 further comprising:

receiving a query including criteria for identifying the plurality of timestamped events from a data store; and

executing the query against the data store to identify the plurality of timestamped events.

20. A non-transitory computer readable storage medium, storing instructions, which when executed by one or more processors causes:

receiving a request to display a plurality of timestamped events, each timestamped event of the plurality of timestamped events parsed from data related to performance and/or security characteristics of one or more computing devices of an information technology environment;

generating a circular timeline display displaying a period of time including a start time and an end time;

generating, for all events of a subset of the plurality of timestamped events, an arc within the circular timeline display representative of a respective event of the subset of timestamped events, wherein each respective arc comprises;

a beginning at a first location within the circular timeline display that is indicative of a start timestamp of the respective event relative to the start time and the end time;

an ending at a second location within the circular timeline display that is indicative of an end timestamp of the respective event relative to the start time and the end time; and

a length that is indicative of a duration between the start timestamp and the end timestamp of the respective event relative to the period of time displayed by the circular timeline display; and

causing display of a graphical user interface including the circular timeline display.

21. The non-transitory computer readable storage medium of claim 20, wherein the medium further stores instructions that when executed by the one or more processors causes:

receiving a query including criteria for identifying the plurality of timestamped events from a data store; and

executing the query against the data store to identify the plurality of timestamped events.

23. The apparatus of claim 22, wherein the non-transitory computer readable storage medium of claim 20, wherein execution of the computer-executable instructions further causes the apparatus to:

receive a query including criteria for identifying the plurality of timestamped events from a data store; and

execute the query against the data store to identify the plurality of timestamped events.

22. An apparatus, comprising:

a physical data store including computer-executable instructions; and

one or more physical processors configured to execute the computer-executable instructions, wherein execution of the computer-executable instructions causes the apparatus to;

receive a request to display a plurality of timestamped events, each timestamped event of the plurality of timestamped events parsed from data related to performance and/or security characteristics of one or more computing devices of an information technology environment;

generate a circular timeline display displaying a period of time including a start time and an end time;

generate, for all events of a subset of the plurality of timestamped events, an arc within the circular timeline display representative of a respective event of the subset of timestamped events, wherein each respective arc comprises;

a beginning at a first location within the circular timeline display that is indicative of a start timestamp of the respective event relative to the start time and the end time;

an ending at a second location within the circular timeline display that is indicative of an end timestamp of the respective event relative to the start time and the end time; and

a length that is indicative of a duration between the start timestamp and the end timestamp of the respective event relative to the period of time displayed by the circular timeline display; and

cause display of a graphical user interface including the circular timeline display.