CONVEYING MACHINE DATA TO A USER VIA ATTRIBUTE MAPPING IN A THREE-DIMENSIONAL MODEL

• US 20170228942A1
• Filed: 04/26/2017
• Published: 08/10/2017
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Noel, Cary Glen, Raitz, Alexander, Arsan, Roy, Allan, Clark
• Granted Patent: US 10,388,067 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06T 15/005 General purpose rendering architectures
• CPC Class Codes: G06T 15/04 Texture mapping
• CPC Class Codes: G06T 15/20 Perspective computation
• CPC Class Codes: G06T 15/205 Image-based rendering
• CPC Class Codes: G06T 19/00 Manipulating 3D models or images for computer graphics
• CPC Class Codes: G06T 19/003 Navigation within 3D models or images
• CPC Class Codes: G06T 19/20 Editing of 3D images, e.g. changing shapes or colours, aligning objects or positioning parts
• CPC Class Codes: G06T 2215/16 Using real world measurements to influence rendering

Abstract

Systems and methods according to various embodiments enable a user to view three-dimensional representations of data objects (“nodes”) within a 3D environment from a first person perspective. The system may be configured to allow the user to interact with the nodes by moving a virtual camera through the 3D environment. The nodes may have one or more attributes that may correspond, respectively, to particular static or dynamic values within the data object'"'"'s data fields. The attributes may include physical aspects of the nodes, such as color, size, or shape. The system may group related data objects within the 3D environment into clusters that are demarked using one or more cluster designators, which may be in the form of a dome or similar feature that encompasses the related data objects. The system may enable multiple users to access the 3D environment simultaneously, or to record their interactions with the 3D environment.

Claims

1. A computer-implemented method, comprising:

receiving a stream of real-time machine data from an external data source, wherein the real-time machine data reflects activity within an information technology infrastructure of an organization;

generating a three-dimensional model that includes a first three-dimensional object having multiple attributes, wherein each of the multiple attributes is mapped to a different aspect of the real-time machine data;

updating each of the multiple attributes in real-time to visually convey changes in the different aspects of the real-time machine data; and

displaying at least a first portion of the three-dimensional model that includes the first three-dimensional object as each of the multiple attributes is updated in real-time.

2. The method of claim 1, wherein the real-time machine data comprises at least one of server logs, activity logs, configuration files, messages, database records, data from one or more sensors or computing devices, and web logs from one or more web servers or web clients.

3. The method of claim 1, wherein the real-time machine data comprises time series data that includes time stamps.

4. The method of claim 1, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

5. The method of claim 1, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

6. The method of claim 1, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, and a second clustering object that encompasses the first clustering object, wherein the second clustering object represents a data center, the first clustering object represents a server machine within the data center, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

7. The method of claim 1, further comprising receiving user-defined mappings between the multiple attributes of the first three-dimensional object and the different aspects of the real-time machine data via a setup module that includes a command line interface accessible to a user.

8. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the real-time machine data.

9. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and a third attribute of the at least one three-dimensional object comprises a height of the first three-dimensional object that is mapped to third aspect of the real-time machine data, and wherein the width, depth, and height of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect, the second aspect, and the third aspect of the real-time machine data.

10. The method of claim 1, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third aspect of the real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the real-time machine data, and the color of the first three-dimensional object is updated in real-time according to the color scale to visibly convey changes in the third aspect of the real-time machine data.

11. A non-transitory computer-readable medium including instructions that, when executed by a processor, cause the processor to perform the steps of:

receiving a stream of real-time machine data from an external data source, wherein the real-time machine data reflects activity within an information technology infrastructure of an organization;

generating a three-dimensional model that includes a first three-dimensional object having multiple attributes, wherein each of the multiple attributes is mapped to a different aspect of the real-time machine data;

updating each of the multiple attributes in real-time to visually convey changes in the different aspects of the real-time machine data; and

displaying at least a first portion of the three-dimensional model that includes the first three-dimensional object as each of the multiple attributes is updated in real-time.

12. The non-transitory computer-readable medium of claim 11, wherein the real-time machine data comprises at least one of server logs, activity logs, configuration files, messages, database records, data from one or more sensors or computing devices, and web logs from one or more web servers or web clients.

13. The non-transitory computer-readable medium of claim 11, wherein the real-time machine data comprises time series data that includes time stamps.

14. The non-transitory computer-readable medium of claim 11, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

15. The non-transitory computer-readable medium of claim 11, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

16. The non-transitory computer-readable medium of claim 11, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, and a second clustering object that encompasses the first clustering object, wherein the second clustering object represents a data center, the first clustering object represents a server machine within the data center, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

17. The non-transitory computer-readable medium of claim 11, further comprising receiving user-defined mappings between the multiple attributes of the first three-dimensional object and the different aspects of the real-time machine data via a setup module that includes a command line interface accessible to a user.

18. The non-transitory computer-readable medium of claim 11, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the real-time machine data.

19. The non-transitory computer-readable medium of claim 11, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and a third attribute of the at least one three-dimensional object comprises a height of the first three-dimensional object that is mapped to third aspect of the real-time machine data, and wherein the width, depth, and height of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect, the second aspect, and the third aspect of the real-time machine data.

20. The non-transitory computer-readable medium of claim 11, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third aspect of the real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the real-time machine data, and the color of the first three-dimensional object is updated in real-time according to the color scale to visibly convey changes in the third aspect of the real-time machine data.

21. A computer system, comprising:

a memory storing instructions; and

a processor that is coupled to the memory and, when executing the instructions, is configured to;

receive a stream of real-time machine data from an external data source, wherein the real-time machine data reflects activity within an information technology infrastructure of an organization;

generate a three-dimensional model that includes a first three-dimensional object having multiple attributes, wherein each of the multiple attributes is mapped to a different aspect of the real-time machine data;

update each of the multiple attributes in real-time to visually convey changes in the different aspects of the real-time machine data; and

display at least a first portion of the three-dimensional model that includes the first three-dimensional object as each of the multiple attributes is updated in real-time.

22. The computer system of claim 21, wherein the real-time machine data comprises at least one of server logs, activity logs, configuration files, messages, database records, data from one or more sensors or computing devices, and web logs from one or more web servers or web clients.

23. The computer system of claim 21, wherein the real-time machine data comprises time series data that includes time stamps.

24. The computer system of claim 21, wherein the real-time machine data is generated by at least one of a server machine, a processor, and a virtual machine.

25. The computer system of claim 21, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, wherein the first clustering object represents a server machine, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

26. The computer system of claim 21, wherein the three-dimensional model includes a first clustering object that encompasses the first three-dimensional object, and a second clustering object that encompasses the first clustering object, wherein the second clustering object represents a data center, the first clustering object represents a server machine within the data center, and the first three-dimensional object represents a processor or a virtual machine executing within the server machine, and wherein the real-time machine data is generated by at least one of the server machine, the processor, and the virtual machine.

27. The computer system of claim 21, wherein the processor is further configured to receive user-defined mappings between the multiple attributes of the first three-dimensional object and the different aspects of the real-time machine data via a setup module that includes a command line interface accessible to a user.

28. The computer system of claim 21, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, and a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the real-time machine data.

29. The computer system of claim 21, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and a third attribute of the at least one three-dimensional object comprises a height of the first three-dimensional object that is mapped to third aspect of the real-time machine data, and wherein the width, depth, and height of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect, the second aspect, and the third aspect of the real-time machine data.

30. The computer system of claim 21, wherein a first attribute of the first three-dimensional object comprises a width that is mapped to a first aspect of the real-time machine data, a second attribute of the first three-dimensional object comprises a depth that is mapped to a second aspect of the real-time machine data, and a third attribute of the first three-dimensional object comprises a color associated with a color scale that is mapped to a third aspect of the real-time machine data, and wherein the width and depth of the first three-dimensional object are updated in real-time to visually convey changes in the first aspect and the second aspect of the real-time machine data, and the color of the first three-dimensional object is updated in real-time according to the color scale to visibly convey changes in the third aspect of the real-time machine data.