IP Library Granted Patent US 11,010,278
Granted Patent B2
US 11,010,278 · App. 16/542,318 · Granted May 18, 2021

Real-time reporting based on instrumentation of software

Inventors: Phillip Liu (Palo Alto, CA); Arijit Mukherji (Fremont, CA); Rajesh Raman (Palo Alto, CA); Kris Grandy (San Carlos, CA); Jack Lindamood (San Mateo, CA)
Assignee: Splunk Inc.
G06F11/3644G06F11/3082G06F11/3466G06F2201/865G06F2201/88
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,010,278
App. No.
16/542,318
Granted
May 18, 2021
Kind
B2
Abstract

A data analysis system processes data generated by instrumented software. The data analysis system receives data streams generated by instances of instrumented software executing on systems. The data analysis system also receives metadata describing data streams. The data analysis system receives an expression based on the metadata. The data analysis system receives data of data streams for each time interval and computes the result of the expression based on the received data values. The data analysis system repeats these steps for each time interval. The data analysis system may quantize data values of data streams for each time interval by generating an aggregate value for the time interval based on data received for each data stream for that time interval. The data analysis system evaluates the expression using the quantized data for the time interval.

Claims (107)

1. A computer-implemented method for processing data generated by instrumented software, the method comprising:

receiving metadata describing a data stream of a plurality of data streams, the metadata for the data stream including a first set of attributes, wherein attributes comprise a property having a value;

quantizing data received for the plurality of data streams over an initial time interval, the quantizing comprising an operation type that is based at least in part on a type of the data, the operation type comprising at least one of adding, determining a minimum, determining a maximum, or determining a latest value, the type of the data comprising at least one of a count of a value, a minimum value, a maximum value, or a latest value;

receiving, through a user interface, an expression for aggregating quantized data across at least two data streams of the plurality of data streams, the expression based on at least an attribute of the first set of attributes and an attribute of a second set of attributes, each attribute of the second set of attributes distinct from the first set of attributes;

selecting, for evaluation by the expression, at least two of the data streams matching the value of the attribute of the first set of attributes;

removing, from evaluation by the expression, any data streams having values not matching the value of the attribute of the first set of attributes;

evaluating the expression using the selected at least two of the data streams over a plurality of time intervals to generate an output data stream;

sending the output data stream for display through the user interface; and

causing display of the output data stream through the user interface.

2. The computer-implemented method of claim 1 , further comprising:

receiving, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on the one or more external systems, each data stream comprising tuples, each tuple including values of the second set of attributes of the data stream.

3. The computer-implemented method of claim 1 , further comprising, for each time interval:

receiving one or more tuples from the plurality of data streams, each tuple comprising a data value associated with a point in time;

determining a value of the expression based on the data values of the received tuples; and

providing the value of the expression for the output data stream.

4. The computer-implemented method of claim 3 , further comprising:

aggregating data values of at least two of the plurality of data streams, each data value associated with the time interval.

5. The computer-implemented method of claim 1 , further comprising:

updating in real-time the output data stream based on new data streams received during a subsequent time interval.

6. The computer-implemented method of claim 1 , wherein the quantizing further comprises:

receiving a data stream of the plurality of data streams, the data stream comprising data values occurring over arbitrary time intervals; and

processing the data stream to generate a quantized data stream comprising data available at regular time intervals.

7. The computer-implemented method of claim 1 , further comprising:

receiving a first set of data streams during a first time interval;

generating a first plurality of output data streams by evaluating the expression using the first set of data streams;

receiving a second set of data streams during a second time interval; and

generating a second plurality of output data streams by evaluating the expression using the second set of data streams.

8. The computer-implemented method of claim 1 , further comprising:

receiving instructions for modifying metadata objects of the metadata describing a data stream; and for subsequent time intervals, for each time interval:

evaluating the expression based on the modified metadata objects to generate a second output data stream, and

sending the second output data stream based on the modified metadata objects for display via the user interface.

9. The computer-implemented method of claim 1 , further comprising:

receiving information describing metadata objects, each metadata object associated with one or more properties, each property comprising a name and a value; and

receiving information describing associations between the metadata objects and the information identifying the plurality of data streams.

10. The computer-implemented method of claim 1 , wherein the expression specifies a property value for selecting the at least two of the plurality of data streams, the at least two of the plurality of data streams matching the property value.

11. A system for specifying data stream language programs through a user interface for processing data generated by instrumented software, the system comprising:

at least one memory having instructions stored thereon; and

at least one processor configured to execute the instructions, wherein the at least one processor is configured to:

receive metadata describing a data stream of a plurality of data streams, the metadata for the data stream including a first set of attributes, wherein attributes comprise a property having a value;

quantize data received for the plurality of data streams over an initial time interval, the quantizing comprising an operation type that is based at least in part on a type of the data, the operation type comprising at least one of adding, determining a minimum, determining a maximum, or determining a latest value, the type of the data comprising at least one of a count of a value, a minimum value, a maximum value, or a latest value;

receive, through a user interface, an expression for aggregating quantized data across at least two data streams of the plurality of data streams, the expression based on at least an attribute of the first set of attributes and an attribute of a second set of attributes, each attribute of the second set of attributes distinct from the first set of attributes;

select, for evaluation by the expression, at least two of the data streams matching the property value of each attribute of the first set of attributes;

remove, from evaluation by the expression, any data streams having values not matching the property value of the attribute of the first set of attributes;

evaluate the expression using the selected at least two of the data streams over a plurality of time intervals to generate an output data stream;

send the output data stream for display through the user interface; and

cause display of the output data stream through the user interface.

12. The system of claim 11 , further configured to:

receive, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on the one or more external systems, each data stream comprising tuples, each tuple including values of the second set of attributes of the data stream.

13. The system of claim 11 , further configured to, for each time interval:

receive one or more tuples from the plurality of data streams, each tuple comprising a data value associated with a point in time;

determine a value of the expression based on the data values of the received tuples; and

provide the value of the expression for the output data stream.

14. The system of claim 13 , further configured to:

aggregate data values of at least two of the plurality of data streams, each data value associated with the time interval.

15. The system of claim 11 , further configured to:

updating in real-time the output data stream based on new data streams received during a subsequent time interval.

16. The system of claim 11 , further configured to:

receive a data stream of the plurality of data streams, the data stream comprising data values occurring over arbitrary time intervals; and

process the data stream to generate a quantized data stream comprising data available at regular time intervals.

17. The system of claim 11 , further configured to:

receive a first set of data streams during a first time interval;

generate a first plurality of output data streams by evaluating the expression using the first set of data streams;

receive a second set of data streams during a second time interval; and

generate a second plurality of output data streams by evaluating the expression using the second set of data streams.

18. The system of claim 11 , further configured to:

receive instructions for modifying metadata objects of the metadata describing a data stream; and for subsequent time intervals, for each time interval:

evaluate the expression based on the modified metadata objects to generate a second output data stream, and

send the second output data stream based on the modified metadata objects for display via the user interface.

19. The system of claim 11 , further configured to:

receive information describing metadata objects, each metadata object associated with one or more properties, each property comprising a name and a value; and

receiving information describing associations between the metadata objects and the information identifying the plurality of data streams.

20. The system of claim 11 , wherein the expression specifies a property value for selecting the at least two of the plurality of data streams, the at least two of the plurality of data streams matching the property value.

21. A non-transitory computer-readable storage medium comprising instructions stored thereon, which when executed by one or more processors, cause the one or more processors to perform operations for processing data generated by instrumented software, comprising:

receiving metadata describing a data stream of a plurality of data streams, the metadata for the data stream including a first set of attributes, wherein attributes comprise a property having a value;

quantizing data received for the plurality of data streams over an initial time interval, the quantizing comprising an operation type that is based at least in part on a type of the data, the operation type comprising at least one of adding, determining a minimum, determining a maximum, or determining a latest value, the type of the data comprising at least one of a count of a value, a minimum value, a maximum value, or a latest value;

receiving, through a user interface, an expression for aggregating quantized data across at least two data streams of the plurality of data streams, the expression based on at least an attribute of the first set of attributes and an attribute of a second set of attributes, each attribute of the second set of attributes distinct from the first set of attributes;

selecting, for evaluation by the expression, at least two of the data streams matching the property value of each attribute of the first set of attributes;

removing, from evaluation by the expression, any data streams having values not matching the property value of the attribute of the first set of attributes;

evaluating the expression using the selected at least two of the data streams over a plurality of time intervals to generate an output data stream;

sending the output data stream for display through the user interface; and

causing display of the output data stream through the user interface.

22. The non-transitory computer-readable storage medium of claim 21 , further configured for:

receiving, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on the one or more external systems, each data stream comprising tuples, each tuple including values of the second set of attributes of the data stream.

23. The non-transitory computer-readable storage medium of claim 21 , further configured for, for each time interval:

receiving one or more tuples from the plurality of data streams, each tuple comprising a data value associated with a point in time;

determining a value of the expression based on the data values of the received tuples; and

providing the value of the expression for the output data stream.

24. The non-transitory computer-readable storage medium of claim 23 , further configured for:

aggregating data values of at least two of the plurality of data streams, each data value associated with the time interval.

25. The non-transitory computer-readable storage medium of claim 21 , further configured for:

updating in real-time the output data stream based on new data streams received during a subsequent time interval.

26. The non-transitory computer-readable storage medium of claim 21 , further configured for:

receiving a data stream of the plurality of data streams, the data stream comprising data values occurring over arbitrary time intervals; and

processing the data stream to generate a quantized data stream comprising data available at regular time intervals.

27. The non-transitory computer-readable storage medium of claim 21 , further configured for:

receiving a first set of data streams during a first time interval;

generating a first plurality of output data streams by evaluating the expression using the first set of data streams;

receiving a second set of data streams during a second time interval; and

generating a second plurality of output data streams by evaluating the expression using the second set of data streams.

28. The non-transitory computer-readable storage medium of claim 21 , further configured for:

receiving instructions for modifying metadata objects of the metadata describing a data stream; and for subsequent time intervals, for each time interval:

evaluating the expression based on the modified metadata objects to generate a second output data stream, and

sending the second output data stream based on the modified metadata objects for display via the user interface.

29. The non-transitory computer-readable storage medium of claim 21 , further configured for:

receiving information describing metadata objects, each metadata object associated with one or more properties, each property comprising a name and a value; and

receiving information describing associations between the metadata objects and the information identifying the plurality of data streams.

30. The non-transitory computer-readable storage medium of claim 21 , wherein the expression specifies a property value for selecting the at least two of the plurality of data streams, the at least two of the plurality of data streams matching the property value.

Assignments (7)
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
CORRECTIVE ASSIGNMENT TO CORRECT THE SECOND INVENTOR'S LAST NAME PREVIOUSLY RECORDED AT REEL: 050155 FRAME: 0208. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Recorded Mar 8, 2021
From: LIU, PHILLIP; MUKHERJI, ARIJIT; RAMAN, RAJESH; GRANDY, KRIS; LINDAMOOD, JACK
To: SIGNALFX, INC.
Reel/Frame 055527/0552 →
CORRECTIVE ASSIGNMENT TO CORRECT THE MISSPACED COMPANY NAME OF SIGNAL FX, INC PREVIOUSLY RECORDED ON REEL 052858 FRAME 0782. ASSIGNOR(S) HEREBY CONFIRMS THE MERGER AND CHANGE OF NAME. Recorded Jun 16, 2020
From: SOLIS MERGER SUB II, LLC; SIGNALFX, INC.
To: SIGNALFX LLC
Reel/Frame 052958/0872 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 5, 2020
From: SIGNALFX LLC
To: SPLUNK INC.
Reel/Frame 052858/0787 →
MERGER AND CHANGE OF NAME Recorded Jun 5, 2020
From: SOLIS MERGER SUB II, LLC; SIGNAL FX, INC.; SIGNALFX LLC
To: SIGNALFX LLC
Reel/Frame 052858/0782 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Aug 23, 2019
From: LIU, PHILLIP; MUKHERJ, ARIJIT; RAMAN, RAJESH; GRANDY, KRIS; LINDAMOOD, JACK
To: SIGNALFX, INC.
Reel/Frame 050155/0208 →
Continuity (6)
Continuation 15845991 · Dec 18, 2017
Continuation 14800677 · Jul 15, 2015
Provisional Application 62109308 · Jan 29, 2015
Provisional Application 62094935 · Dec 19, 2014
Provisional Application 62061616 · Oct 8, 2014
Related Publication 20200042429A1 · Feb 6, 2020
Cited By (1)
US 12,455,809