IP Library Granted Patent US 11,411,804
Granted Patent B1
US 11,411,804 · App. 17/182,554 · Granted Aug 9, 2022

Actionable event responder

Inventors: Shalabh Goyal (Fremont, CA); Anish Shrigondekar (Sunnyvale, CA); Bhavin Thaker (Sunnyvale, CA); Zhenghui Xie (Cupertino, CA); Ruochen Zhang (Milpitas, CA)
Assignee: Splunk Inc.
H04L41/0631G06F16/2465G06F9/451
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,411,804
App. No.
17/182,554
Granted
Aug 9, 2022
Kind
B1
Abstract

An actionable event responder performs actions including a server cluster determining an actionable event occurrence from a member of a server cluster, determining an event-type code matching the actionable event occurrence, retrieving an event-type response map entry matching the event-type code, and determining, in response to determining that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry. The response action signifier indicates a response action performable by the server cluster. The server cluster further detects whether a preauthorization value is set in a dispatch field of the event-type response map entry, and generates an invocation message to a resolution handler based on the preauthorization value being set in the dispatch field of the event-type response map entry. The resolution handler performs the response action to the actionable event occurrence.

Claims (71)

1. A computer-implemented method comprising:

determining, by a server cluster, an actionable event instance from a member of the server cluster;

determining, by the server cluster, an event-type code matching the actionable event instance;

retrieving, by the server cluster, an event-type response map entry matching the event-type code;

determining, by the server cluster and in response to determining that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry, the response action signifier indicating a response action performable by the server cluster;

detecting, by the server cluster, whether a preauthorization value is set in a dispatch field of the event-type response map entry, wherein the dispatch field is configured to store a suspended value, an automatic value, and an interactive value;

generating, by the server cluster, an invocation message to a resolution handler based on the preauthorization value being set in the dispatch field of the event-type response map entry; and

performing, by the resolution handler, the response action to the actionable event instance.

2. The computer-implemented method of claim 1 , further comprising:

determining whether a time-based criterion in a criteria field of the event-type response map entry is satisfied, the time-based criterion defining when to apply the event-type response map entry,

wherein generating the invocation message is responsive to the time-based criterion being satisfied.

3. The computer-implemented method of claim 1 , further comprising:

receiving source data comprising a plurality of nonactionable event instances and the actionable event instance; and

filtering the actionable event instance from the plurality of nonactionable event instances.

4. The computer-implemented method of claim 1 , further comprising:

receiving source data comprising a plurality of log files from at least one application and at least one monitoring component of the server cluster;

filtering the source data for information about the actionable event instance from a plurality of nonactionable event instances in the source data;

generating a representation of the actionable event instance from the source data; and

forwarding the representation to an event injector.

5. The computer-implemented method of claim 1 , further comprising:

storing, in an event queue, an event queue entry comprising the event-type code of the actionable event instance and information about the actionable event instance.

6. The computer-implemented method of claim 1 , further comprising:

storing, in an event queue, an event queue entry comprising the event-type code of the actionable event instance and information about the actionable event instance, wherein the information about the actionable event instance comprises a timestamp, a source identifier, a description of the actionable event instance, an action information component, and a status.

7. The computer-implemented method of claim 1 , wherein the actionable event instance is a first actionable event instance, wherein the event-type code of the first actionable event instance is the same as an event-type code of a second actionable event instance.

8. The computer-implemented method of claim 1 , further comprising:

generating a fully qualified event-type code by combining an error code with a source-type information.

9. The computer-implemented method of claim 1 , further comprising:

determining, by the server cluster, a second actionable event instance from a second member of the server cluster;

retrieving, by the server cluster, a second event-type response map entry for the second actionable event instance;

detecting, by the server cluster, that the preauthorization value is not set in the dispatch field of the second event-type response map entry; and

sending, in response to the preauthorization value not being set, a request to a user for approval of a second responsive action to the second actionable event instance.

10. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

determining an actionable event instance from a member of a server cluster,

determining an event-type code matching the actionable event instance,

retrieving an event-type response map entry matching the event-type code,

determining, in response to determining that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry, the response action signifier indicating a response action performable by the server cluster,

detecting whether a preauthorization value is set in a dispatch field of the event-type response map entry, wherein the dispatch field is configured to store a suspended value, an automatic value, and an interactive value,

generating an invocation message to a resolution handler based on the preauthorization value being set in the dispatch field of the event-type response map entry, and

performing, by the resolution handler, the response action to the actionable event instance.

11. The computing device of claim 10 , wherein the operations further comprise:

determining whether a time-based criterion in a criteria field of the event-type response map entry is satisfied, the time-based criterion defining when to apply the event-type response map entry,

wherein generating the invocation message is responsive to the time-based criterion being satisfied.

12. The computing device of claim 10 , wherein the operations further comprise:

receiving source data comprising a plurality of nonactionable event instances and the actionable event instance; and

filtering the actionable event instance from the plurality of nonactionable event instances.

13. The computing device of claim 10 , wherein the operations further comprise:

receiving source data comprising a plurality of log files from at least one application and at least one monitoring component of the server cluster;

filtering the source data for information about an actionable event instance from a plurality of nonactionable event instances in the source data;

generating a representation of the actionable event instance from the source data; and

forwarding the representation to an event injector.

14. The computing device of claim 10 , wherein the operations further comprise:

storing, in an event queue, an event queue entry comprising the event-type code of the actionable event instance and information about the actionable event instance.

15. The computing device of claim 10 , wherein the operations further comprise:

storing, in an event queue, an event queue entry comprising the event-type code of the actionable event instance and information about the actionable event instance, wherein the information about the actionable event instance comprises a timestamp, a source identifier, a description of the actionable event instance, an action information component, and a status.

16. The computing device of claim 10 , wherein the actionable event instance is a first actionable event instance, wherein the event-type code of the first actionable event instance is the same as an event-type code of a second actionable event instance.

17. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:

determining an actionable event instance from a member of a server cluster;

determining an event-type code matching the actionable event instance;

retrieving an event-type response map entry matching the event-type code;

determining, in response to determining that the event-type response map entry matches the event-type code, a response action signifier in the event-type response map entry, the response action signifier indicating a response action performable by the server cluster;

detecting whether a preauthorization value is set in a dispatch field of the event-type response map entry, wherein the dispatch field is configured to store a suspended value, an automatic value, and an interactive value;

generating an invocation message to a resolution handler based on the preauthorization value being set in the dispatch field of the event-type response map entry; and

performing, by the resolution handler, the response action to the actionable event instance.

18. The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:

determining whether a time-based criterion in a criteria field of the event-type response map entry is satisfied, the time-based criterion defining when to apply the event-type response map entry,

wherein generating the invocation message is responsive to the time-based criterion being satisfied.

19. The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:

receiving source data comprising a plurality of nonactionable event instances and the actionable event instance; and

filtering the actionable event instance from the plurality of nonactionable event instances.

Assignments (4)
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
CHANGE OF NAME Recorded Jan 6, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 069825/0558 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 6, 2021
From: GOYAL, SHALABH; SHRIGONDEKAR, ANISH; THAKER, BHAVIN; XIE, ZHENGHUI; ZHANG, RUOCHEN
To: SPLUNK INC.
Reel/Frame 057718/0921 →
Continuity (1)
Continuation 16657684 · Oct 18, 2019