Inline visualizations of metrics related to captured network data

• US 10,693,742 B2
• Filed: 01/29/2015
• Issued: 06/23/2020
• Est. Priority Date: 04/15/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Hsiao, Fang I., Ching, Clayton S., Dickey, Michael R., Shcherbakov, Vladimir A., Noel, Cary Glen
• Primary Examiner(s): Wilson, Kimberly L
• Application Number:
  US14/609,223
• Publication Number:
  US 20150295778A1
• Time in Patent Office: 1,972 Days
• Field of Search: 707741
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0894 Packet rate

Abstract

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system obtains a set of event streams from one or more remote capture agents over one or more networks, wherein the set of event streams comprises time-series event data generated from network packets captured by the one or more remote capture agents. Next, the system causes for display, within a graphical user interface (GUI), a first set of user interface elements, wherein the first set of user interface elements includes event stream information for an event stream in the set of event streams and a first graph of a metric associated with the time-series event data in the event stream. The system then updates the first graph in real-time with the time-series event data from the one or more remote capture agents.

Claims

1. A method performed by a computer-implemented component of an event-processing system, the method comprising:

obtaining, over one or more networks, a plurality of event streams generated by one or more remote capture agents, each event stream of the plurality of event streams including time-series event data generated by the one or more remote capture agents from network packets captured by the one or more remote capture agents;

executing at least one correlation search used to identify notable events in each event stream of the plurality of event streams;

for each event stream of the plurality of event streams, generating a respective time-series for a metric corresponding to a number of notable events identified in the event stream over time based on execution of the at least one correlation search; and

causing display of a graphical user interface (GUI) including, for each event stream of the plurality of event streams;

at least one first interface element displaying event stream information related to the event stream of the plurality of event streams, and

at least one second interface element displaying an event stream-specific graph of the respective time-series for the metric associated with the event stream.

2. The method of claim 1, further comprising:

aggregating the metric across the plurality of event streams to generate an aggregated metric; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric.

3. The method of claim 1, further comprising:

receiving input identifying a subset of the plurality of event streams;

aggregating the metric across the subset of the plurality of event streams to generate an aggregated metric; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric.

4. The method of claim 1, further comprising:

receiving input used to identify a subset of the plurality of event streams;

aggregating the metric across the subset of the plurality of event streams to generate an aggregated metric; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric and at least one fourth interface element displaying event stream information for the subset of the plurality of event streams.

5. The method of claim 1, further comprising:

aggregating the metric across the plurality of event streams to generate an aggregated metric, wherein the aggregated metric is generated using at least one of a sum, an average, and a summary statistic; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric.

6. The method of claim 1, further comprising:

causing display of a value of the metric based on a position of a cursor over the event stream-specific graph.

7. The method of claim 1, wherein the GUI further includes at least one third interface element for changing a view of the event stream-specific graph.

8. The method of claim 1, wherein the GUI further includes at least one third interface element for changing a view of the event stream-specific graph, and wherein changing the view of the event stream-specific graph comprises at least one of:

changing a scale of the event stream-specific graph;

scrolling across different portions of the event stream-specific graph; and

viewing the metric for multiple event streams in the event stream-specific graph.

9. The method of claim 1, further comprising:

aggregating the metric across the plurality of event streams to generate an aggregated metric, wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric; and

causing display of a value of the aggregated metric based on a position of a cursor over the graph of the aggregated metric.

10. The method of claim 1, wherein the event stream-specific graph comprises a sparkline of network traffic over time.

11. The method of claim 1, further comprising:

updating the event stream-specific graph in real-time based on additional time-series event data obtained from the one or more remote capture agents, wherein updating the event stream-specific graph comprises updating the event stream-specific graph as additional time-series event data is collected within a time window spanned by the event stream-specific graph.

12. The method of claim 1, wherein the GUI includes at least one third interface element for performing a search of the time-series event data.

13. The method of claim 1, wherein the GUI includes at least one third interface element for managing an ephemeral event stream of the plurality of event streams, wherein managing the ephemeral event stream comprises at least one of:

modifying an end time for terminating the capture of time-series event data in the ephemeral event stream;

disabling the ephemeral event stream; and

deleting the ephemeral event stream.

14. The method of claim 1, wherein events of the time-series event data are searchable using a late-binding schema.

15. An apparatus, comprising:

one or more hardware processors; and

memory storing instructions that, when executed by the one or more processors, cause the apparatus to;

obtain, over one or more networks, a plurality of event streams generated by one or more remote capture agents, each event stream of the plurality of event streams including time-series event data generated by the one or more remote capture agents from network packets captured by the one or more remote capture agents;

execute at least one correlation search used to identify notable events in each event stream of the plurality of event streams;

for each event stream of the plurality of event streams, generating a respective time-series for a metric corresponding to a number of notable events identified in the event stream over time based on execution of the at least one correlation search; and

cause display of a graphical user interface (GUI) including, for each event stream of the plurality of event streams;

at least one first interface element displaying event stream information related to the event stream of the plurality of event streams, and

at least one second interface element displaying an event stream-specific graph of the respective time-series for the metric associated with the event stream.

16. The apparatus of claim 15, wherein the memory further stores instructions that, when executed by the one or more hardware processors, cause the apparatus to:

aggregate the metric across the plurality of event streams to generate an aggregated metric; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric.

17. The apparatus of claim 15, wherein the memory further stores instructions that, when executed by the one or more hardware processors, cause the apparatus to:

obtain a subset of the plurality of event streams associated with a grouping of the event streams by an event stream attribute;

receive input identifying a subset of the plurality of event streams;

aggregate the metric across the subset of the plurality of event streams to generate an aggregated metric; and

wherein the GUI further includes at least one third interface element displaying a graph of the aggregated metric.

18. The apparatus of claim 15, wherein the memory further stores instructions that, when executed by the one or more hardware processors, cause the apparatus to:

aggregate the metric across the plurality of event streams to generate an aggregated metric, wherein the aggregated metric is generated using at least one of a sum, an average, and a summary statistic; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric.

19. The apparatus of claim 15, wherein the memory further stores instructions that, when executed by the one or more hardware processors, cause the apparatus to:

cause display of a value of the metric based on a position of a cursor over the event stream-specific graph.

20. The apparatus of claim 15, wherein the GUI further includes at least one third interface element for changing a view of the event stream-specific graph.

21. The apparatus of claim 15, wherein the event stream-specific graph comprises a sparkline of network traffic over time.

22. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

obtaining, over one or more networks, a plurality of event streams generated by one or more remote capture agents, each event stream of the plurality of event streams including time-series event data generated by the one or more remote capture agents from network packets captured by the one or more remote capture agents;

executing at least one correlation search used to identify notable events in each event stream of the plurality of event streams;

for each event stream of the plurality of event streams, generating a respective time-series for a metric corresponding to a number of notable events identified in the event stream over time based on execution of the at least one correlation search; and

causing display of a graphical user interface (GUI) including, for each event stream of the plurality of event streams;

at least one first interface element displaying event stream information related to the event stream of the plurality of event streams, and

at least one second interface element displaying an event stream-specific graph of the respective time-series for the metric associated with the event stream.

23. The non-transitory computer-readable storage medium of claim 22, wherein the instructions, when executed by the one or more processors, further cause performance of operations comprising:

aggregating the metric across the plurality of event streams to generate an aggregated metric; and

wherein the GUI includes at least one third interface element displaying a graph of the aggregated metric.

24. The non-transitory computer-readable storage medium of claim 22, wherein the instructions, when executed by the one or more processors, further cause performance of operations comprising:

obtaining a subset of the plurality of event streams associated with a grouping of the event streams by an event stream attribute;

receiving input identifying a subset of the plurality of event streams;

aggregating the metric across the subset of the plurality of event streams to generate an aggregated metric; and

wherein the GUI further includes at least one third interface element displaying a graph of the aggregated metric.

25. The non-transitory computer-readable storage medium of claim 22, wherein the instructions, when executed by the one or more processors, further cause performance of operations comprising:

causing display of a value of the metric based on a position of a cursor over the event stream-specific graph.

26. The non-transitory computer-readable storage medium of claim 22, wherein the GUI further includes at least one third interface element for changing a view of the event stream-specific graph.

27. The non-transitory computer-readable storage medium of claim 22, wherein the event stream-specific graph comprises a sparkline of network traffic over time.