Analyzing machine data based on relationships between log data and network traffic data
Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.
1. A computer-implemented method for analyzing machine data generated in an information system environment, the method comprising:
obtaining machine data including log data generated at a first component in the information system environment and network traffic data generated at a second component in the information system environment;
generating a plurality of events based on the log data and the network traffic data, wherein generating an event of the plurality of events includes identifying boundaries of the event in the log data or the network traffic data;
receiving a search request to get data from the plurality of events, the data from the plurality of events including a relationship between a first event generated based on the log data and a second event generated based on the network traffic data; and
providing, in response to the search request, access to the data from the plurality of events, the data from the plurality of events including machine data upon which the first event and the second event were generated.
2. The computer-implemented method of claim 1 , wherein at least one component of the first component and the second component in the information system environment includes: a web server, an application server, a host, a database, a router, an operating system, or a software application.
3. The computer-implemented method of claim 1 , wherein the relationship between the first event and the second event is based at least in part on the first event and the second event each being associated with a time stamp within a common time range.
4. The computer-implemented method of claim 1 , wherein the relationship between the first event and the second event is based at least in part on the first event and the second event each being associated with a same value.
5. The computer-implemented method of claim 1 , wherein the log data includes: an operating system log, an application server log, a web server log, a software application log, or an activity log.
6. The computer-implemented method of claim 1 , wherein the first component in the information system environment is different from second component in the information system environment.
7. The computer-implemented method of claim 1 , wherein the first component in the information system environment is the same as the second component in the information system environment.
8. The computer-implemented method of claim 1 , wherein the relationship is based on the first event and the second event relating to a same component in the information system environment.
9. The computer-implemented method of claim 1 , wherein obtaining the log data includes collecting the log data from a plurality of separate data sources.
10. A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
obtaining machine data including log data generated at a first component in an information system environment and network traffic data generated at a second component in the information system environment;
generating a plurality of events based on the log data and the network traffic data, wherein generating an event of the plurality of events includes identifying boundaries of the event in the log data or the network traffic data;
receiving a search request to get data from the plurality of events, the data from the plurality of events including a relationship between a first event generated based on the log data and a second event generated based on the network traffic data; and
providing, in response to the search request, access to the data from the plurality of events, the data from the plurality of events including machine data upon which the first event and the second event were generated.
11. The non-transitory computer-readable storage medium of claim 10 , wherein at least one component of the first component and the second component in the information system environment includes: a web server, an application server, a host, a database, a router, an operating system, or a software application.
12. The non-transitory computer-readable storage medium of claim 10 , wherein the relationship between the first event and the second event is based at least in part on the first event and the second event each being associated with a time stamp within a common time range.
13. The non-transitory computer-readable storage medium of claim 10 , wherein the relationship between the first event and the second event is based at least in part on the first event and the second event each being associated with a same value.
14. The non-transitory computer-readable storage medium of claim 10 , wherein the log data includes: an operating system log, an application server log, a web server log, a software application log, or an activity log.
15. The non-transitory computer-readable storage medium of claim 10 , wherein the first component in the information system environment is different from second component in the information system environment.
16. The non-transitory computer-readable storage medium of claim 10 , wherein the first component in the information system environment is the same as the second component in the information system environment.
17. The non-transitory computer-readable storage medium of claim 10 , wherein the relationship is based on the first event and the second event relating to a same component in the information system environment.
18. The non-transitory computer-readable storage medium of claim 10 , wherein obtaining the log data includes collecting the log data from a plurality of separate data sources.
19. An apparatus, comprising:
one or more processors;
a non-transitory computer-readable storage medium coupled to the one or more processors, the non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
obtain machine data including log data generated at a first component in an information system environment and network traffic data generated at a second component in the information system environment;
generate a plurality of events based on the log data and the network traffic data, wherein generating an event of the plurality of events includes identifying boundaries of the event in the log data or the network traffic data;
receive a search request to get data from the plurality of events, the data from the plurality of events including a relationship between a first event generated based on the log data and a second event generated based on the network traffic data; and
provide, in response to the search request, access to the data from the plurality of events, the data from the plurality of events including machine data upon which the first event and the second event were generated.
20. The apparatus of claim 19 , wherein at least one component of the first component and the second component in the information system environment includes: a web server, an application server, a host, a database, a router, an operating system, or a software application.
21. The apparatus of claim 19 , wherein the relationship between the first event and the second event is based at least in part on the first event and the second event each being associated with a time stamp within a common time range.
22. The apparatus of claim 19 , wherein the relationship between the first event and the second event is based at least in part on the first event and the second event each being associated with a same value.
23. The apparatus of claim 19 , wherein the log data includes: an operating system log, an application server log, a web server log, a software application log, or an activity log.
24. The apparatus of claim 19 , wherein the first component in the information system environment is different from second component in the information system environment.
25. The apparatus of claim 19 , wherein the first component in the information system environment is the same as the second component in the information system environment.
26. The apparatus of claim 19 , wherein the relationship is based on the first event and the second event relating to a same component in the information system environment.
27. The apparatus of claim 19 , wherein obtaining the log data includes collecting the log data from a plurality of separate data sources.