User interface for automatic creation of related event groups for IT service monitoring

• US 10,515,096 B1
• Filed: 04/29/2017
• Issued: 12/24/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Choudhary, Hemendra Singh, Fletcher, Tristan Antonio, Lazerowitz, Ross Andrew, Bettaiah, Vineetha
• Primary Examiner(s): Choi, David E
• Application Number:
  US15/582,689
• Time in Patent Office: 969 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/24573 using data annotations, e.g. user-defined metadata
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/174 Form filling; Merging
• CPC Class Codes: G06F 40/177 of tables; using ruled lines
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

The operation of an automatic service monitoring system (SMS) is directed by stored control information. Methods and mechanisms are provided to create control information that directs operations of the SMS regarding the grouping together of related notable events for unified display and processing. The methods and mechanisms include interfacing with a user for selection of similarity scoring regimes for association with a particular field that are engaged for event grouping. The control information directs grouping operations that automatically correlate the events without requiring, for example, a set of declarative grouping rules.

Claims

1. A method comprising:

causing display of a user interface enabling a user to indicate a selection of a similarity scoring regime from among a plurality of similarity scoring regimes for association with a field identifier, the field identifier corresponding to field data identifiable in a notable event from among a plurality of notable events represented in computer storage, wherein each of the plurality of similarity scoring regimes comprises logic that when performed determines a score representing a measure of similarity between comparands each identified by the field identifier;

receiving user input indicating the selection of the similarity scoring regime; and

determining one or more event groups for the plurality of notable events within an interactive timeframe, wherein said determining includes performing the logic of the similarity scoring regime indicated by the user input with a said comparand comprising the field data identifiable in the notable event;

wherein the method is performed by one or more processors coupled to the computer storage.

2. The method of claim 1 wherein the identifier is a field name.

3. The method of claim 1 wherein the identifier is a field name represented in a late-binding schema.

4. The method of claim 1 wherein the notable events each include a segment of machine data.

5. The method of claim 1 wherein the notable events each include a segment of machine data and one or more metadata fields.

6. The method of claim 1 wherein the notable events each include a segment of machine data and one or more metadata fields including at least one from among an identifier field, a status field, an owner field, and a severity field.

7. The method of claim 1 wherein the notable events each include one or more metadata fields.

8. The method of claim 1 wherein the notable events each include one or more metadata fields including at least one from among an identifier field, a status field, an owner field, and a severity field.

9. The method of claim 1 wherein the plurality of similarity scoring regimes includes at least one from among a text regime, a category regime, and a topology regime.

10. The method of claim 1 wherein the plurality of similarity scoring regimes includes at least one from among a time sequence mapping regime and a timing regime.

11. The method of claim 1 wherein the field data identifiable in the notable event is identifiable based at least in part on information in a late-binding schema.

12. The method of claim 1 wherein the field data identifiable in the notable event is identifiable based at least in part on information in a schema applicable to JSON data.

13. The method of claim 1 wherein the interactive timeframe is less than about two minutes.

14. The method of claim 1 wherein the interactive timeframe is less than about one minute.

15. The method of claim 1 wherein the interactive timeframe is less than about thirty seconds.

16. The method of claim 1 wherein the plurality of notable events includes less than about ten thousand notable events.

17. The method of claim 1 wherein the plurality of notable events includes less than about five thousand notable events.

18. The method of claim 1 wherein the plurality of notable events includes less than about one thousand notable events.

19. The method of claim 1 wherein the plurality of notable events includes between about one thousand and ten thousand notable events.

20. The method of claim 1 wherein the plurality of notable events includes between about one thousand and five thousand notable events.

21. The method of claim 1 wherein the plurality of notable events includes between about five thousand and ten thousand notable events.

22. The method of claim 1 wherein the interactive timeframe is less than about two minutes and the plurality of notable events includes between about one thousand and ten thousand notable events.

23. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of a user interface enabling a user to indicate a selection of a similarity scoring regime from among a plurality of similarity scoring regimes for association with a field identifier, the field identifier corresponding to field data identifiable in a notable event from among a plurality of notable events represented in computer storage, wherein each of the plurality of similarity scoring regimes comprises logic that when performed determines a score representing a measure of similarity between comparands each identified by the field identifier;

receive user input indicating the selection of the similarity scoring regime; and

determine one or more event groups for the plurality of notable events within an interactive timeframe, wherein said determining includes performing the logic of the similarity scoring regime indicated by the user input with a said comparand comprising the field data identifiable in the notable event.

24. The system of claim 23 wherein the identifier is a field name represented in a late-binding schema.

25. The system of claim 23 wherein the notable events each include a segment of machine data.

26. The system of claim 23 wherein the plurality of similarity scoring regimes includes at least one from among a text regime, a category regime, and a topology regime.

27. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of a user interface enabling a user to indicate a selection of a similarity scoring regime from among a plurality of similarity scoring regimes for association with a field identifier, the field identifier corresponding to field data identifiable in a notable event from among a plurality of notable events represented in computer storage, wherein each of the plurality of similarity scoring regimes comprises logic that when performed determines a score representing a measure of similarity between comparands each identified by the field identifier;

receiving user input indicating the selection of the similarity scoring regime; and

determining one or more event groups for the plurality of notable events within an interactive timeframe, wherein said determining includes performing the logic of the similarity scoring regime indicated by the user input with a said comparand comprising the field data identifiable in the notable event.

28. The non-transitory computer readable storage medium of claim 27 wherein the identifier is a field name represented in a late-binding schema.

29. The non-transitory computer readable storage medium of claim 27 wherein the notable events each include a segment of machine data.

30. The non-transitory computer readable storage medium of claim 27 wherein the plurality of similarity scoring regimes includes at least one from among a text regime, a category regime, and a topology regime.