IP Library Granted Patent US 11,915,156
Granted Patent B1
US 11,915,156 · App. 17/384,519 · Granted Feb 27, 2024

Identifying leading indicators for target event prediction

Inventors: Adam Jamison Oliner (San Francisco, CA); Aungon Nag Radon (Vancouver, CA); Manwah Wong (Vancouver, CA); Manish Sainani (Kirkland, WA); Harsh Keswani (Seattle, WA)
Assignee: Splunk Inc.
G06N5/04G06F16/2465G06F16/26G06N20/00
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,915,156
App. No.
17/384,519
Granted
Feb 27, 2024
Kind
B1
Abstract

Embodiments of the present invention are directed to facilitating event forecasting. In accordance with aspects of the present disclosure, a set of events determined from raw machine data is obtained. The events are analyzed to identify leading indicators that indicate a future occurrence of a target event, wherein the leading indicators occur during a search period of time the precedes a warning period of time, thereby providing time for an action to be performed prior to an occurrence of a predicted target event. At least one of the leading indicators is used to predict a target event. An event notification is provided indicating the prediction of the target event.

Claims (53)

1. A computer-implemented method comprising:

receiving an indication to initiate identification of leading indicators;

identifying a warning period of time that precedes a target event in a set of training events, the warning period of time comprising a period of time desired for reacting to a predicted target event;

identifying a search period of time that precedes the warning period of time, the search period of time comprising a period of time during which leading indicators associated with the predicted target event are identified via a leading indicator algorithm executed on a computing device;

searching a set of events, of the set of training events, that correspond with the search period of time, which precedes the warning period of time, to identify, via the leading indicator algorithm, a leading indicator associated with the target event;

using the leading indicator to predict a future occurrence of the target event; and

based on the predicted future occurrence of the target event, automatically initiating a computer action to minimize or avoid the target event.

2. The computer-implemented method of claim 1 further comprising obtaining one or more parameters that indicate a manner in which to analyze the set of training events, wherein the one or more parameters comprise one or more of an indication of the target event, an indication of the search period of time, an indication of the warning period of time, an indication of the leading indicator algorithm, or a combination thereof.

3. The computer-implemented method of claim 1 , wherein searching the set of events to identify the leading indicator comprises searching the set of events that occur during the search period of time to identify the leading indicator that indicates the subsequent occurrence of the target event within the set of training events.

4. The computer-implemented method of claim 1 , wherein

identifying the leading indicator further comprises:

searching training events, of the set of training events, that occur during a control period of time that precedes or follows the target event; and

comparing data associated with the set of events that correspond with the search period of time to data associated with the training events that occur during the control period of time to identify the leading indicator based on differenced in the compared data.

5. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of the leading indicator algorithm that analyzes event frequency, event heartbeats, event patterns, or a combination thereof.

6. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of an event frequency algorithm that evaluates frequencies of events or event frequency variations.

7. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of an event frequency algorithm that compares event frequencies associated with the search period of time and event frequencies associated with a control period of time that precedes the search period of time.

8. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of a heartbeat algorithm that detects missing or irregular heartbeats, wherein a heartbeat comprises a periodic signal generated by a computing component.

9. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of a heartbeat algorithm configured to:

detect a baseline heartbeat based on analysis of training events associated with a control period of time that precedes the search period of time; and

utilize the baseline heartbeat to analyze the search period of time to identify a missing or irregular heartbeat.

10. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of a rare event algorithm that detects infrequently occurring events.

11. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of a rare event algorithm configured to:

detect a baseline for designating a rare event based on analysis of events associated with a control period of time that precedes the search period of time; and

utilize the baseline for designating the rare event to analyze the search period of time to identify rare events.

12. The computer-implemented method of claim 1 , wherein identifying the leading indicator comprises utilization of a pattern algorithm that detects event patterns.

13. The computer-implemented method of claim 1 further comprising providing the leading indicator as a candidate leading indicator.

14. The computer-implemented method of claim 1 further comprising:

providing the leading indicator as a candidate leading indicator; and

receiving a user selection of the candidate leading indicator for use in predicting the future occurrence of the target event.

15. The computer-implemented method of claim 1 further comprising validating the identified leading indicator by simulating the leading indicator in association with a unique set of events that were not used to identify the leading indicator.

16. The computer-implemented method of claim 1 further comprising validating the identified leading indicators by:

searching events associated with a validation period of time for the leading indicator;

detecting whether an event notification indicating a predicted target event is initiated;

detecting whether an actual occurrence of the target event exists; and

using the initiation of the event notification and the existence of the actual occurrence to validate the leading indicator.

17. The computer-implemented method of claim 1 , wherein using the leading indicator to predict the target event comprises searching for the leading indicator in a second set of events.

18. The computer-implemented method of claim 1 , further comprising providing an event notification before or during a corresponding warning window when the future occurrence of the target event is predicted.

19. One or more non-transitory computer-readable storage media having instructions stored thereon, wherein the instructions, when executed by a computing device, cause the computing device to:

receive an indication to initiate identification of leading indicators;

identify a warning period of time that precedes a target event in a set of training events, the warning period of time comprising a period of time desired for reacting to a predicted target event;

identify a search period of time that precedes the warning period of time, the search period of time comprising a period of time during which leading indicators associated with the predicted target event are identified via a leading indicator algorithm executed on a computing device;

search a set of events, of the set of training events, that correspond with the search period of time, which precedes the warning period of time, to identify, via the leading indicator algorithm, a leading indicator associated with the target event;

use the leading indicator to predict a future occurrence of the target event; and

based on the predicted future occurrence of the target event, automatically initiating a computer action to minimize or avoid the target event.

20. A computing device comprising:

one or more processors; and

a memory coupled with the one or more processors, the memory having instructions stored thereon, wherein the instructions, when executed by the one or more processors, cause the computing device to:

receive an indication to initiate identification of leading indicators;

identify a warning period of time that precedes a target event in a set of training events, the warning period of time comprising a period of time desired for reacting to a predicted target event;

identify a search period of time that precedes the warning period of time, the search period of time comprising a period of time during which leading indicators associated with the predicted target event are identified via a leading indicator algorithm executed on a computing device;

search a set of events, of the set of training events, that correspond with the search period of time, which precedes the warning period of time, to identify, via the leading indicator algorithm, a leading indicator associated with the target event;

use the leading indicator to predict a future occurrence of the target event; and

based on the predicted future occurrence of the target event, automatically initiating a computer action to minimize or avoid the target event.

Assignments (4)
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
CHANGE OF NAME Recorded Jan 6, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 069825/0782 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 23, 2021
From: OLINER, ADAM JAMISON; RADON, AUNGON NAG; WONG, MANWAH; SAINANI, MANISH; KESWANI, HARSH
To: SPLUNK INC.
Reel/Frame 056967/0754 →
Continuity (1)
Continuation 15419918 · Jan 30, 2017
Cited By (1)
US 12,650,999