Identity resolution of network entities

1. A computer-implemented method comprising:

accessing machine data including a plurality of event data objects, each event data object of the plurality of event data objects including machine-generated data associated with one or more entities in a computer network environment;

executing a set-up process that includes

identifying a subset of the plurality of event data objects as containing identification association data,

determining, from values in the machine data, an association between a dynamic identifier in the machine data and a static identifier in the machine data, wherein a dynamic identifier is an identifier with a device association that can vary across sessions and a static identifier is an identifier with a device association that is fixed across sessions,

storing data indicative of the association in a data structure; and

populating a data store with the identification association data from the identified subset of the plurality of event data objects; and

executing an identity resolution process asynchronously with respect to the set-up process, to ascertain an identity of a particular entity of the one or more entities, based on identification association data stored in the data store.

2. The method of claim 1 , wherein the identify resolution process comprises:

receiving a dynamic identifier and a timestamp associated with the event data object of the plurality of event data objects, wherein a dynamic identifier is an identifier with a device association that can vary across sessions;

determining a session associated with the event data object, based on the timestamp and the dynamic identifier;

determining, in a first association table, a set of entries associated with the session;

determining, from the set of entries associated with the session, a static device identifier based on an association with the dynamic identifier, the static device identifier uniquely identifying a component whose activity is reflected by the machine data, wherein a static device identifier is an identifier with a device association that is fixed across sessions;

determining, based on an association table, a user identifier, based on the static device identifier, wherein the user identifier uniquely identifies a user associated with the activity that is reflected by the machine data; and

outputting identity data that associates the event data object with the static device identifier and the user identifier.

3. The method of claim 1 ,

wherein the identify resolution process comprises:

receiving a second dynamic identifier and a timestamp associated with an event data object of the plurality of event data objects;

determining a session associated with the event data object, based on the timestamp and the second dynamic identifier;

determining, in a first association table, a set of entries associated with the session;

determining, from the set of entries associated with the session, the static device identifier from an association with the second dynamic identifier, wherein the static device identifier uniquely identifies a component whose activity is reflected by the machine data;

determining, based on a second association table, a user identifier, based on the static device identifier, wherein the user identifier uniquely identifies a user associated with the activity that is reflected by the machine data; and

outputting identity data that associates the event data object with the static device identifier and the user identifier.

4. The method of claim 1 , wherein the identity resolution process ascertains a session associated with the identity of the entity, and wherein the session is not expressly identified in the event data objects or in the identification association data in the data store.

5. The method of claim 1 , wherein:

the set-up process stores data indicative of session creation in a session table in the data store and stores data indicative of session termination in a termination table in the data store; and

the identity resolution process includes

using the session table and the termination table to identify a session, and

ascertaining the entity identification based on the identified session.

6. The method of claim 1 , further comprising:

enforcing a delay between a writing of the identification association data to the data store by the set-up process and a reading of the identification association data from the data store by the identity resolution process.

7. The method of claim 1 , further comprising:

enforcing a delay between a writing of the identification association data to the data store by the set-up process and a reading of the identification association data from the data store by the identity resolution process, wherein enforcing the delay includes:

using a first channel of a publish-subscribe messaging system for writes to the data store by the set-up process, and

using a second channel of the publish-subscribe messaging system for reads from the data store by the resolution process, wherein the second channel is different from the first channel.

8. The method of claim 1 , further comprising:

enforcing a delay between a writing of the identification association data to the data store by the set-up process and a reading of the identification association data from the data store by the identity resolution process; and

adjusting the delay to achieve a specified accuracy by the identity resolution process.

9. The method of claim 1 , further comprising:

enforcing a delay between a writing of the identification association data to the data store by the set-up process and a reading of the identification association data from the data store by the identity resolution process; and

adjusting the delay to achieve a specified balance between latency and accuracy by the resolution process.

10. The method of claim 1 , further comprising:

enforcing a delay between a writing of the identification association data to the data store by the set-up process and a reading of the identification association data from the data store by the identity resolution process;

at a first point in time, decreasing the delay to reduce a latency of the resolution process; and

at a second point in time, increasing the delay to increase a level of accuracy of the resolution process.

11. The method of claim 1 , further comprising

determining an accuracy of an identity resolution previously generated by the identity resolution process, by:

regenerating the identity of the entity using a current state of the data store;

comparing a result of regenerating the identity of the entity to an identity of the entity previously generated by the identity resolution process; and

determining whether the identity of the entity previously generated by the identity resolution process is correct based on a result of the comparing.

12. The method of claim 1 , wherein the set-up process further comprises maintaining a plurality of association tables in the data store, each containing a different type of identifier-to-identifier association, and wherein the plurality of association tables are prioritized according to a degree of persistence associated with identifiers contained in the association tables.

13. The method of claim 2 , further comprising:

enriching an event data object of the plurality of event data objects with information indicative of the association between the static device identifier and a user identifier.

14. The method of claim 1 , further comprising:

using the identity of the entity, output by the identity resolution process, to normalize two or more of the plurality of event data objects with respect to user identity or device identity.

15. The method of claim 1 , wherein the set-up process further comprises maintaining a session table and a termination table for each of a plurality of types of associations, and wherein populating the data store with the identification association data from the subset of the plurality of event data objects that contain identification association data comprises adding session start and end times to a session table.

16. A computing device comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions, execution of which by the processor causes the computing device to perform operations including:

accessing machine data including a plurality of event data objects, each event data object of the plurality of event data objects including raw machine-generated data indicative of performance or operation of one or more entities in a computer network environment;

executing a set-up process that includes

identifying a subset of the plurality of event data objects as containing identification association data,

determining, from values in the machine data, an association between a dynamic identifier in the machine data and a static identifier in the machine data, wherein a dynamic identifier is an identifier with a device association that can vary across sessions and a static identifier is an identifier with a device association that is fixed across sessions,

storing data indicative of the association in a data structure; and

populating a data store with the identification association data from the identified subset of the plurality of event data objects; and

executing an identity resolution process asynchronously with respect to the set-up process, to ascertain an identity of a particular entity of the one or more entities, based on the identification association data stored in the data store.

17. The computing device of claim 16 ,

wherein the identify resolution process comprises:

receiving a second dynamic identifier and a timestamp associated with an event data object of the plurality of event data objects;

determining a session associated with the event data object, based on the timestamp and the second dynamic identifier;

determining, in a first association table, a set of entries associated with the session;

determining, from the set of entries associated with the session, the static device identifier from an association with the second dynamic identifier, wherein the static device identifier uniquely identifies a component whose activity is reflected by the machine data;

determining, based on a second association table, a user identifier, based on the static device identifier, wherein the user identifier uniquely identifies a user associated with the activity that is reflected by the machine data; and

outputting identity data that associates the event data object with the static device identifier and the user identifier.

18. A non-transitory computer-readable medium having stored thereon instructions, execution of which by one or more processors in a computing system causes the one or more processor to perform operations including:

accessing machine data including a plurality of event data objects, each event data object of the plurality of event data objects including raw machine-generated data indicative of performance or operation of one or more entities in a computer network environment;

executing a set-up process that includes

identifying a subset of the plurality of event data objects as containing identification association data,

determining, from values in the machine data, an association between a dynamic identifier in the machine data and a static identifier in the machine data, wherein a dynamic identifier is an identifier with a device association that can vary across sessions and a static identifier is an identifier with a device association that is fixed across sessions,

storing data indicative of the association in a data structure; and

populating a data store with the identification association data from the identified subset of the plurality of event data objects; and

executing an identity resolution process asynchronously with respect to the set-up process, to ascertain an identity of a particular entity of the one or more entities, based on the identification association data stored in the data store.

19. The non-transitory computer-readable medium of claim 18 ,

wherein the identify resolution process comprises:

receiving a second dynamic identifier and a timestamp associated with an event data object of the plurality of event data objects;

determining a session associated with the event data object, based on the timestamp and the second dynamic identifier;

determining, in a first association table, a set of entries associated with the session;

determining, from the set of entries associated with the session, the static device identifier from an association with the second dynamic identifier, wherein the static device identifier uniquely identifies a component whose activity is reflected by the machine data;

determining, based on a second association table, a user identifier, based on the static device identifier, wherein the user identifier uniquely identifies a user associated with the activity that is reflected by the machine data; and

outputting identity data that associates the event data object with the static device identifier and the user identifier.