IP Library Granted Patent US 11,797,542
Granted Patent B1
US 11,797,542 · App. 17/374,837 · Granted Oct 24, 2023

Combining data streams generated by instrumented software using metadata correlation

Inventors: Rajesh Raman (Palo Alto, CA); Maxime Petazzoni (San Mateo, CA); Arijit Mukherji (Fremont, CA); Phillip Liu (Palo Alto, CA)
Assignee: Splunk Inc.
G06F16/24568G06F16/244G06F16/24535G06F16/284G06F16/907G06F40/205G06F40/279
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,797,542
App. No.
17/374,837
Filed
Jul 13, 2021
Granted
Oct 24, 2023
Kind
B1
Examiner
TRAN, LOC
Art Unit
2165
USPC
707/705
Abstract

A system processes data stream language expressions that combine result data streams from multiple data stream language sub-expressions. The system determines a set of fixed dimensions based on static analysis of the data stream language sub-expression. The system determines a union set representing a union of the sets of fixed dimensions. The system determines at execution time of the data stream language expression, a plurality of sets of data streams. Each set of data stream corresponds to a data stream language sub-expression from the plurality of data stream language expressions. The system correlates data streams across the plurality of sets of data streams based on the union set. The system determines result data streams for the data stream language expression by combining data values of correlated data streams.

Claims (49)

1. A computer-implemented method for evaluating expressions and processing data streams, the method comprising:

determining a set of dimensions based at least in part on an analysis of a data stream language sub-expression, the set of dimensions comprising keys that identify data streams obtained by processing the data stream language sub-expression;

determining a union set comprising a union of sets of dimensions corresponding to a plurality of data stream language sub-expressions;

determining a plurality of sets of data streams, each set of the plurality of sets of data streams corresponding to at least one data stream language sub-expression of the plurality of data stream language sub-expressions;

correlating data streams across the plurality of sets of data streams based on the union set;

determining one or more result data streams for the data stream language sub-expression, wherein each data value of a result data stream comprises combined data values of correlated data streams from the plurality of sets of data streams; causing display of the one or more result data streams through a user interface;

identifying a data value from a designated set of data streams; identifying a matching data stream for each remaining set of data streams;

identifying a data value from the matching data stream; and combining all of the identified data values based on the data stream language sub-expression.

2. The computer-implemented method of claim 1 , wherein correlating the data streams across the plurality of sets of data streams comprises:

selecting a designated set of data streams from the plurality of sets of data streams; and

matching data streams from the designated set of data streams with data streams from each remaining set of data streams from the plurality of sets of data streams.

3. The computer-implemented method of claim 1 , wherein a designated set of data streams corresponds to the set of data streams from the plurality of data streams with a most specific grouping of correlating keys.

4. The computer-implemented method of claim 1 , wherein a key based on a first set of dimensions corresponding to a designated set of data streams matches a key based on a second set of dimensions if the second set of dimensions is a subset of the first set of dimensions.

5. The computer-implemented method of claim 1 , further comprising:

storing correlation keys of a designated set of data streams as metadata for a result set of data streams obtained by evaluation of the data stream language sub-expression.

6. The computer-implemented method of claim 1 , further comprising repeatedly evaluating the data stream language sub-expression at a predetermined rate.

7. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations for evaluating expressions and processing data streams, including:

determining a set of dimensions based at least in part on an analysis of a data stream language sub-expression, the set of dimensions comprising keys that identify data streams obtained by processing the data stream language sub-expression;

determining a union set comprising a union of sets of dimensions corresponding to a plurality of data stream language sub-expressions;

determining a plurality of sets of data streams, each set of the plurality of sets of data streams corresponding to at least one data stream language sub-expression of the plurality of data stream language sub-expressions;

correlating data streams across the plurality of sets of data streams based on the union set;

determining one or more result data streams for the data stream language sub-expression, wherein each data value of a result data stream comprises combined data values of correlated data streams from the plurality of sets of data streams; causing display of the one or more result data streams through a user interface;

identifying a data value from a designated set of data streams;

identifying a matching data stream for each remaining set of data streams;

identifying a data value from the matching data stream; and combining all of the identified data values based on the data stream language sub-expression.

8. The non-transitory computer-readable medium of claim 7 , wherein the operations for correlating the data streams across the plurality of sets of data streams further include:

selecting a designated set of data streams from the plurality of sets of data streams; and

matching data streams from the designated set of data streams with data streams from each remaining set of data streams from the plurality of sets of data streams.

9. The non-transitory computer-readable medium of claim 7 , wherein a designated set of data streams corresponds to the set of data streams from the plurality of data streams with a most specific grouping of correlating keys.

10. The non-transitory computer-readable medium of claim 7 , wherein a key based on a first set of dimensions corresponding to a designated set of data streams matches a key based on a second set of dimensions if the second set of dimensions is a subset of the first set of dimensions.

11. The non-transitory computer-readable medium of claim 7 , wherein the operations further include:

storing correlation keys of a designated set of data streams as metadata for a result set of data streams obtained by evaluation of the data stream language sub-expression.

12. The non-transitory computer-readable medium of claim 7 , wherein the operations further include repeatedly evaluating the data stream language sub-expression at a predetermined rate.

13. A computing device, comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations for evaluating expressions and processing data streams, including:

determining a set of dimensions based at least in part on an analysis of a data stream language sub-expression, the set of dimensions comprising keys that identify data streams obtained by processing the data stream language sub-expression;

determining a union set comprising a union of sets of dimensions corresponding to a plurality of data stream language sub-expressions;

determining a plurality of sets of data streams, each set of the plurality of sets of data streams corresponding to at least one data stream language sub-expression of the plurality of data stream language sub-expressions;

correlating data streams across the plurality of sets of data streams based on the union set;

determining one or more result data streams for the data stream language sub-expression, wherein each data value of a result data stream comprises combined data values of correlated data streams from the plurality of sets of data streams; causing display of the one or more result data streams through a user interface;

identifying a data value from a designated set of data streams;

identifying a matching data stream for each remaining set of data streams;

identifying a data value from the matching data stream; and combining all of the identified data values based on the data stream language sub-expression.

14. The computing device of claim 13 , wherein the operations for correlating the data streams across the plurality of sets of data streams further include:

selecting a designated set of data streams from the plurality of sets of data streams; and

matching data streams from the designated set of data streams with data streams from each remaining set of data streams from the plurality of sets of data streams.

15. The computing device of claim 13 , wherein a designated set of data streams corresponds to the set of data streams from the plurality of data streams with a most specific grouping of correlating keys.

16. The computing device of claim 13 , wherein a key based on a first set of dimensions corresponding to a designated set of data streams matches a key based on a second set of dimensions if the second set of dimensions is a subset of the first set of dimensions.

17. The computing device of claim 13 , wherein the operations further include:

storing correlation keys of a designated set of data streams as metadata for a result set of data streams obtained by evaluation of the data stream language sub-expression.

Assignments (5)
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 29, 2022
From: RAMAN, RAJESH; PETAZZONI, MAXIME; MUKHERJI, ARIJIT; LIU, PHILLIP
To: SIGNALFX, INC.
Reel/Frame 059541/0689 →
MERGER AND CHANGE OF NAME Recorded Jan 27, 2022
From: SOLIS MERGER SUB II, LLC; SIGNALFX, INC.; SIGNALFX LLC
To: SIGNALFX LLC
Reel/Frame 058796/0894 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 27, 2022
From: SIGNALFX LLC
To: SPLUNK INC.
Reel/Frame 058797/0033 →
Continuity (2)
Continuation 16427024 · May 30, 2019
Provisional Application 62679629 · Jun 1, 2018