ADJUSTING NETWORK DATA STORAGE BASED ON EVENT STREAM STATISTICS

• US 20150295796A1
• Filed: 04/29/2015
• Published: 10/15/2015
• Est. Priority Date: 04/15/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Hsiao, Fang I., Jiang, Wei, Shcherbakov, Vladimir A., Chandrasekharan, Ramkumar, Ching, Clayton S.
• Granted Patent: US 10,700,950 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0894 Packet rate

Abstract

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for managing one or more event streams containing the time-series event data, wherein managing the one or more event streams includes enabling the generation of a set of statistics from an event stream without subsequently storing and processing at least a first portion of the event stream by one or more components on a network. The GUI then updates the configuration information based on input received through the first set of user-interface elements.

Claims

1. A method for facilitating the processing of network data, comprising:

causing for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

causing for display, in the GUI, a first set of user-interface elements for managing one or more event streams comprising the time-series event data, wherein managing the one or more event streams comprises enabling the generation of a set of statistics from an event stream without subsequently storing and processing at least a first portion of the event stream by one or more components on a network; and

updating the configuration information based on input received through the first set of user-interface elements.

2. The method of claim 1, further comprising:

providing the configuration information over a network to the one or more remote capture agents, wherein the configuration information is used to configure the generation of the time-series event data at the one or more remote capture agents during runtime of the one or more remote capture agents.

3. The method of claim 1, further comprising:

generating, by the computer system, the set of statistics from the time-series event data.

4. The method of claim 1, further comprising:

generating, by the computer system, the set of statistics from the time-series event data; and

causing for display, in the GUI, a second set of user-interface elements comprising the set of statistics generated from the event stream.

5. The method of claim 1, further comprising:

providing, in the GUI, a second set of user-interface elements for storing at least a second portion of the event stream based on the set of statistics.

6. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of at least a second portion of the event stream by the one or more components on the network based on the set of statistics.

7. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of at least a second portion of the event stream based on a storage limit associated with the time-series event data.

8. The method of claim 1, further comprising:

providing, in the GUI, a second set of user-interface elements for adjusting an amount of storage of the event stream based on the set of statistics and a storage limit associated with the time-series event data; and

causing for display, in the GUI, a suggestion for setting the amount of storage of the event stream based on the set of statistics and the storage limit.

9. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements for adjusting an amount of storage of the event stream based on the set of statistics and a storage limit associated with the time-series event data; and

causing for display, in the GUI, a price associated with storing the event stream above the storage limit.

10. The method of claim 1, wherein the first set of user-interface elements is displayed in the GUI with:

event stream information for a set of event streams; and

a graph of a metric associated with the time-series event data in the event stream.

11. The method of claim 1, wherein the first set of user-interface elements is displayed in the GUI with:

event stream information for a set of event streams comprising the event stream;

a first graph of a metric associated with the time-series event data in the event stream; and

a second graph of an aggregated metric across the set of event streams.

12. The method of claim 1, wherein the first set of user-interface elements is displayed in the GUI with a second set of user-interface elements for including one or more event attributes in the time-series event data of the event stream.

13. The method of claim 1, wherein the GUI further comprises a second set of user-interface elements containing the time-series event data.

14. The method of claim 1, wherein managing the one or more event streams further comprises:

enabling the event stream;

disabling the event stream;

or

deleting the event stream.

15. The method of claim 1, wherein the set of statistics comprises at least one of:

a total number of events;

a total incoming traffic;

a total outgoing traffic;

a total traffic; and

an index volume.

16. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements comprising the set of statistics generated from the event stream; and

updating the set of statistics in real-time with the time-series event data by the one or more remote capture agents.

17. The method of claim 1, further comprising:

upon determining that a size of the one or more event streams does not exceed a storage limit associated with the time-series event data, updating the configuration information to trigger the subsequent storage and processing of the event stream.

18. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of at least a second portion of the event stream by the one or more components on the network based on an index volume of the event stream.

19. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of at least a second portion of the event stream upon detecting a high traffic volume associated with the event stream.

20. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements comprising the set of statistics generated from the event stream and one or more additional sets of statistics generated from one or more additional event streams captured by the one or more remote capture agents.

21. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements comprising the set of statistics generated from the event stream and one or more additional sets of statistics generated from one or more additional event streams that are not subsequently stored and processed by the one or more components on the network.

22. The method of claim 1, further comprising:

causing for display, in the GUI, a second set of user-interface elements comprising the set of statistics generated from the event stream; and

causing for display, in the GUI, a third set of user-interface elements comprising the set of statistics generated from an additional event stream, wherein at least a second portion of the additional event stream is subsequently stored and processed by the one or more components on the network.

23. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of at least a second portion of the event stream by the one or more components on the network based on a remaining storage limit associated with the time-series event data.

24. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of at least a second portion of the event stream by the one or more components on the network based on a historical trend associated with the set of statistics.

25. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of the event stream upon detecting a high traffic volume associated with the event stream.

26. The method of claim 1, further comprising:

updating, by the computer system, the configuration information to trigger the subsequent storage and processing of the event stream upon detecting a light traffic volume associated with the event stream.

27. The method of claim 1, further comprising:

generating, by the computer system, the set of statistics from the time-series event data for the event stream and one or more additional event streams; and

aggregating the set of statistics across the event stream and the one or more additional event streams.

28. The method of claim 1, further comprising:

generating, by the computer system, the set of statistics from the time-series event data for the event stream and one or more additional event streams;

aggregating the set of statistics across the event stream and the one or more additional event streams; and

causing for display, in the GUI, a second set of user-interface elements comprising the aggregated set of statistics.

29. An apparatus, comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the apparatus to;

cause for display a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

cause for display, in the GUI, a first set of user-interface elements for managing one or more event streams comprising the time-series event data, wherein managing the one or more event streams comprises enabling the generation of a set of statistics from an event stream without subsequently storing and processing at least a first portion of the event stream by one or more components on a network; and

update the configuration information based on input received through the first set of user-interface elements.

30. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating the processing of network data, the method comprising:

causing for display a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents;

causing for display, in the GUI, a first set of user-interface elements for managing one or more event streams comprising the time-series event data, wherein managing the one or more event streams comprises enabling the generation of a set of statistics from an event stream without subsequently storing and processing at least a first portion of the event stream by one or more components on a network; and

updating the configuration information based on input received through the first set of user-interface elements.