IP Library Granted Patent US 10,949,180
Granted Patent B2
US 10,949,180 · App. 15/697,451 · Granted Mar 16, 2021

Dynamically changing input data streams processed by data stream language programs

Inventors: Rajesh Raman (Palo Alto, CA); Arijit Mukherji (Fremont, CA); Kris Grandy (San Carlos, CA); Phillip Liu (Palo Alto, CA)
Assignee: Splunk Inc.
G06F8/443G06F9/466G06F9/542G06F11/07G06F11/3086G06F11/34G06F11/3452G06F11/3466G06F11/3604G06F16/164G06F16/24568G06F11/3006G06F11/3072G06F11/3409G06F2201/81G06F2201/835G06F2201/86G06F2201/88
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,949,180
App. No.
15/697,451
Filed
Sep 7, 2017
Granted
Mar 16, 2021
Kind
B2
Examiner
DO, CHAT C
Art Unit
2193
USPC
717/158
Abstract

An instrumentation analysis system processes data streams by executing instructions specified using a data stream language program. The data stream language allows users to specify a search condition using a find block for identifying the set of data streams processed by the data stream language program. The set of identified data streams may change dynamically. The data stream language allows users to group data streams into sets of data streams based on distinct values of one or more metadata attributes associated with the input data streams. The data stream language allows users to specify a threshold block for determining whether data values of input data streams are outside boundaries specified using low/high thresholds. The elements of the set of data streams input to the threshold block can dynamically change. The low/high threshold values can be specified as data streams and can dynamically change.

Claims (61)

1. A method for generating and storing data streams generated by a data stream language program, the method comprising:

receiving data from a plurality of data streams, each data stream received from an instance of instrumented software executing on an external system;

storing metadata describing the plurality of data streams, the metadata for each data stream including one or more attributes associated with the data stream;

receiving a set of instructions specified using a data stream language program for processing the plurality of data streams;

generating one or more result data streams by executing the set of instructions;

for each of the one or more result data streams:

determining a set of values of attributes describing the result data stream, the determining based on the set of instructions;

storing the set of values as metadata describing the result data stream;

generating an identifier for tuples of the result data stream and associating the identifier with the metadata describing the tuples of the result data stream, each tuple comprising at least a metric name; and

storing data of the result data stream in association with the identifier; and

providing one or more result data streams as input to another data stream language program.

2. The method of claim 1 , wherein the data stream language program comprises a grouping command specifying grouping of data across data streams, wherein the grouping command identifies one or more attributes and wherein the set of values corresponds to the one or more attributes of the grouping command specified in the data stream language program.

3. The method of claim 2 , wherein the grouping command groups data of the data streams by a set of metadata attributes and each result data stream corresponds to a distinct set of values of the set of metadata attributes.

4. The method of claim 1 , wherein the data stream language program specifies a plurality of grouping commands, each of the plurality of grouping commands identifying one or more attributes, and wherein the set of values is based on the one or more attributes of the last grouping command from the plurality of grouping commands specified in the data stream language program.

5. The method of claim 1 , further comprising:

sending the data of the result stream for display on a screen.

6. The method of claim 1 , wherein the set of result data streams is associated with a publish block, the publish block associated with the metric name, further comprising:

for each result data stream:

using the metric name of the publish block as an attribute describing the result data stream; and

storing the attribute based on the metric name with metadata describing the result data stream.

7. The method of claim 1 , wherein one or more data streams from the plurality of data streams are generated as result data streams obtained as a result of execution of instructions of another data stream language program.

8. The method of claim 1 , wherein the metadata describing the plurality of data streams is received independent of the data of the data stream.

9. A computer-readable non-transitory storage medium storing instructions for:

receiving data from a plurality of data streams, each data stream received from an instance of instrumented software executing on an external system;

storing metadata describing the plurality of data streams, the metadata for each data stream including one or more attributes associated with the data stream;

receiving a set of instructions specified using a data stream language program for processing the plurality of data streams;

generating one or more result data streams by executing the set of instructions;

for each of the one or more result data streams:

determining a set of values of attributes describing the result data stream, the determining based on the set of instructions;

storing the set of values as metadata describing the result data stream;

generating an identifier for tuples of the result data stream and associating the identifier with the metadata describing the tuples of the result data stream, each tuple comprising at least a metric name; and

storing data of the result data stream in association with the identifier; and

providing one or more result data streams as input to another data stream language program.

10. The computer-readable non-transitory storage medium of claim 9 , wherein the data stream language program comprising a grouping command specifying grouping of data across data streams, wherein the grouping command identifies one or more attributes and wherein the set of values corresponds to the one or more attributes of the grouping command specified in the data stream language program.

11. The computer-readable non-transitory storage medium of claim 10 , wherein the grouping command groups data of the data streams by a set of metadata attributes and each result data stream corresponds to a distinct set of values of the set of metadata attributes.

12. The computer-readable non-transitory storage medium of claim 9 , wherein the data stream language program specifies a plurality of grouping commands, each of the plurality of grouping commands identifying one or more attributes, and wherein the set of values is based on the one or more attributes of the last grouping command from the plurality of grouping commands specified in the data stream language program.

13. The computer-readable non-transitory storage medium of claim 9 , wherein the set of result data streams is associated with a publish block, the publish block associated with the metric name, further storing instructions for:

for each result data stream:

using the metric name of the publish block as an attribute describing the result data stream; and

storing the attribute based on the metric name with metadata describing the result data stream.

14. The computer-readable non-transitory storage medium of claim 9 , further storing instructions for:

providing one or more result data streams as input to another data stream language program.

15. The computer-readable non-transitory storage medium of claim 9 , further storing instructions for:

sending data of a result stream for display on a screen.

16. The computer-readable non-transitory storage medium of claim 9 , wherein one or more data streams from the plurality of data streams are generated as result data streams obtained as a result of execution of instructions of another data stream language program.

17. A computer system comprising:

a computer processor; and

a computer-readable non-transitory storage medium storing instructions for:

receiving data from a plurality of data streams, each data stream received from an instance of instrumented software executing on an external system;

storing metadata describing the plurality of data streams, the metadata for each data stream including one or more attributes associated with the data stream;

receiving a set of instructions specified using a data stream language program for processing the plurality of data streams;

generating one or more result data streams by executing the set of instructions;

for each of the one or more result data streams:

determining a set of values of attributes describing the result data stream, the determining based on the set of instructions;

storing the set of values as metadata describing the result data stream;

generating an identifier for tuples of the result data stream and associating the identifier with the metadata describing the tuples of the result data stream, each tuple comprising at least a metric name; and

storing data of the result data stream in association with the identifier; and

providing one or more result data streams as input to another data stream language program.

18. The computer system of claim 17 , wherein the data stream language program comprising a grouping command specifying grouping of data across data streams, wherein the grouping command identifies one or more attributes and wherein the set of values corresponds to the one or more attributes of the grouping command specified in the data stream language program.

19. The computer system of claim 18 , wherein the grouping command groups data of the data streams by a set of metadata attributes and each result data stream corresponds to a distinct set of values of the set of metadata attributes.

20. The computer system of claim 17 , wherein the data stream language program specifies a plurality of grouping commands, each of the plurality of grouping commands identifying one or more attributes, and wherein the set of values is based on the one or more attributes of the last grouping command from the plurality of grouping commands specified in the data stream language program.

Assignments (8)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
CORRECTIVE ASSIGNMENT TO CORRECT THE MISSPACED COMPANY NAME OF SIGNAL FX, INC PREVIOUSLY RECORDED ON REEL 052858 FRAME 0782. ASSIGNOR(S) HEREBY CONFIRMS THE MERGER AND CHANGE OF NAME. Recorded Jun 16, 2020
From: SOLIS MERGER SUB II, LLC; SIGNALFX, INC.
To: SIGNALFX LLC
Reel/Frame 052958/0872 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 5, 2020
From: SIGNALFX LLC
To: SPLUNK INC.
Reel/Frame 052858/0787 →
MERGER AND CHANGE OF NAME Recorded Jun 5, 2020
From: SOLIS MERGER SUB II, LLC; SIGNAL FX, INC.; SIGNALFX LLC
To: SIGNALFX LLC
Reel/Frame 052858/0782 →
RELEASE OF SECURITY INTEREST Recorded Oct 1, 2019
From: SILVER LAKE WATERMAN FUND II, L.P.
To: SIGNALFX, INC.
Reel/Frame 050585/0240 →
SECURITY INTEREST Recorded Dec 14, 2017
From: SIGNALFX, INC.
To: SILVER LAKE WATERMAN FUND II, L.P.
Reel/Frame 044868/0541 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 8, 2017
From: RAMAN, RAJESH; MUKHERJI, ARIJIT; GRANDY, KRIS; LIU, PHILLIP
To: SIGNALFX, INC.
Reel/Frame 043528/0062 →
Continuity (3)
Continuation 14970451 · Dec 15, 2015
Provisional Application 62094935 · Dec 19, 2014
Related Publication 20180011695A1 · Jan 11, 2018
Cited By (1)
US 12,455,809