IP Library Granted Patent US 11,782,987
Granted Patent B1
US 11,782,987 · App. 17/586,012 · Granted Oct 10, 2023

Using an augmented process model to track process instances

Inventors: Alexander Lynn Raitz (San Francisco, CA); Ashwin Mohan Iyer (Sunnyvale, CA); Pohsin Wang (South San Francisco, CA); Ian Matthew Link (Berkeley, CA)
Assignee: Splunk Inc.
G06F16/90335
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,782,987
App. No.
17/586,012
Granted
Oct 10, 2023
Kind
B1
Abstract

Embodiments of the present invention are directed to managing process analytics across process components. In some embodiments, an indication of a state of a process instance associated with a process is determined by querying a process engine. In accordance with the indication of the state of the process instance, an augmented process model is used to search machine data for data corresponding with at least one component of the process. The data corresponding with the at least one component of the process is associated with a process instance identifier that uniquely identifies the process instance. Thereafter, the data along with the process instance identifier is provided to the process engine to update the state of the process instance.

Claims (48)

1. A computer-implemented method, comprising:

initiating a search of machine data, wherein the search of the machine data is initiated based on a current state of a first process instance, the current state indicating that a processing engine has received first machine data associated with a first component of a process, wherein the process is distributed across multiple disparate systems, wherein the search of the machine data uses an augmented process model, and wherein the augmented process model includes a search indicator and a component attribute indicating a type of data or a field for which monitoring is desired;

obtaining results from the search of the machine data, the results including second machine data associated with a second component of the process, wherein the second component performs operations of the process subsequent to operations of the process performed by the first component;

in accordance with searching the machine data for the second data associated with the second component, associating the second machine data with a unique process instance identifier associated with the first process instance; and

outputting the second machine data, associated with the second component and obtained using the augmented process model, and the unique process instance identifier for receipt by the processing engine to update the current state of the first process instance to an updated state.

2. The computer-implemented method of claim 1 , further comprising receiving the unique process instance identifier from the processing engine.

3. The computer-implemented method of claim 1 , further comprising:

performing an initial search of the machine data to obtain a first search result;

providing the first search result to the processing engine; and

receiving the unique process instance identifier from the processing engine in response to providing the first search result to the processing engine.

4. The computer-implemented method of claim 1 , further comprising:

performing an initial search of the machine data using the augmented process model to obtain a first search result;

providing the first search result to the processing engine; and

receiving the unique process instance identifier from the processing engine based on the first search result including the first machine data.

5. The computer-implemented method of claim 1 , further comprising:

requesting an indication of whether the processing engine has data associated with a specific component of the process.

6. The computer-implemented method of claim 1 , wherein the first machine data corresponding to the first component of the process and the unique process instance identifier are recorded by the processing engine.

7. The computer-implemented method of claim 1 , further comprising using a relationship indicator associated with the first component that relates the first component to a previous component of the process, the previous component of the process being associated with the unique process instance identifier.

8. The computer-implemented method of claim 1 , wherein the first process instance comprises a unique instance associated with the process.

9. The computer-implemented method of claim 1 , wherein the process employs a set of components to achieve a particular end result, the set of components including the first component and the second component.

10. A non-transitory computer-readable storage medium having computer-executable instructions embodied thereon, wherein, when executed by one or more processors, the computer-executable instructions cause the one or more processors to perform operations comprising:

initiating a search of machine data, wherein the search of the machine data is initiated based on a current state of a first process instance, the current state indicating that a processing engine has received first machine data associated with a first component of a process, wherein the process is distributed across multiple disparate systems, wherein the search of the machine data uses an augmented process model, and wherein the augmented process model includes a search indicator and a component attribute indicating a type of data or a field for which monitoring is desired;

obtaining results from the search of the machine data, the results including second machine data associated with a second component of the process, wherein the second component performs operations of the process subsequent to operations of the process performed by the first component;

in accordance with searching the machine data for the second data associated with the second component, associating the second machine data with a unique process instance identifier associated with the first process instance; and

outputting the second machine data, associated with the second component and obtained using the augmented process model, and the unique process instance identifier for receipt by the processing engine to update the current state of the first process instance to an updated state.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the operations further comprise receiving the unique process instance identifier from the processing engine.

12. The non-transitory computer-readable storage medium of claim 10 , wherein the operations further comprise:

performing an initial search of the machine data in association with the first component of the process to obtain a first search result;

providing the first search result to the processing engine; and

receiving the unique process instance identifier from the processing engine in response to providing the first search result to the processing engine.

13. The non-transitory computer-readable storage medium of claim 10 , wherein the operations further comprise:

performing an initial search of the machine data using the augmented process model to obtain a first search result;

providing the first search result to the processing engine; and

receiving the unique process instance identifier from the processing engine based on the first search result including the first machine data.

14. The non-transitory computer-readable storage medium of claim 10 , wherein the operations further comprise:

requesting an indication of whether the processing engine has data associated with a specific component of the process.

15. The non-transitory computer-readable storage medium of claim 10 , further comprising using a relationship indicator associated with the first component that relates the first component to a previous component of the process, the previous component of the process being associated with the unique process instance identifier.

16. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

initiating a search of machine data, wherein the search of the machine data is initiated based on a current state of a first process instance, the current state indicating that a processing engine has received first machine data associated with a first component of a process, wherein the process is distributed across multiple disparate systems, wherein the search of the machine data uses an augmented process model, and wherein the augmented process model includes a search indicator and a component attribute indicating a type of data or a field for which monitoring is desired;

obtaining results from the search of the machine data, the results including second machine data associated with a second component of the process, wherein the second component performs operations of the process subsequent to operations of the process performed by the first component;

in accordance with searching the machine data for the second data associated with the second component, associating the second machine data with a unique process instance identifier associated with the first process instance; and

outputting the second machine data, associated with the second component and obtained using the augmented process model, and the unique process instance identifier for receipt by the processing engine to update the current state of the first process instance to an updated state.

17. The computing device of claim 16 , wherein the first machine data corresponding to the first component of the process and the unique process instance identifier are recorded by the processing engine.

18. The computing device of claim 16 , wherein the operations further comprise using a relationship indicator associated with the first component that relates the first component to a previous component of the process, the previous component of the process being associated with the unique process instance identifier.

19. The computing device of claim 16 , wherein the first process instance comprises a unique instance associated with the process.

20. The computing device of claim 16 , wherein the process employs a set of components to achieve a particular end result, the set of components including the first component and the second component.

Assignments (4)
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
CHANGE OF NAME Recorded Jan 6, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 069825/0782 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 27, 2022
From: RAITZ, ALEXANDER LYNN; IYER, ASHWIN MOHAN; WANG, POHSIN; LINK, IAN MATTHEW
To: SPLUNK INC.
Reel/Frame 058884/0655 →
Continuity (2)
Continuation 15339804 · Oct 31, 2016
Provisional Application 62400025 · Sep 26, 2016
Cited By (3)
US 12,229,294 US 12,231,511 US 12,475,143