Granted Patent B1

US 12,197,442 · App. 17/937,902 · Granted Jan 14, 2025

Inventors: Kyle Champlin (Castro Valley, CA); Cory Chen (Oakland, CA); Patrick Schulz (Pulheim, DE); Jason Szeto (Belmont, CA)

Assignee: Cisco Technology, Inc

G06F16/2455G06F3/14G06F16/248

Abstract

Claims (70)

1. A computer-implemented method comprising:

accessing a first tag and a second tag stored in association with each other in a metadata storage, the first tag for associating ingested data of a particular class of data with a data model that contains semantic knowledge about the particular class of data, the second tag for designating ingested data as cloud data;

ingesting data by a data intake and query system, a portion of the ingested data being cloud data;

in response to determining that the portion of the ingested data satisfies one or more criteria associated with the first tag, determining that the portion of the ingested data should be tagged with the first tag;

determining that the portion of the ingested data should be tagged with the second tag based on the first tag being associated with the second tag in the metadata storage;

storing the portion of the ingested data in a data repository in association with the first tag and the second tag, the first tag associating the portion of the ingested data with the data model that contains semantic knowledge about the particular class of data, the second tag designating the portion of the ingested data as cloud data;

executing a search query against the data repository, to identify ingested cloud data that satisfies the search query, the search query including the first tag and the second tag; and

causing a display device to display a visualization based on a result of the search query, the result including the portion of the ingested data.

2. The computer-implemented method of claim 1 , wherein the ingesting is performed by a software module of the data intake and query system, and wherein the software module includes an event type definition that specifies a type of data to be ingested by the software module and further includes the first tag and the second tag.

3. The computer-implemented method of claim 1 , wherein the data model includes a search constraint, and wherein executing the search query comprises identifying ingested cloud data that satisfies the search query and the search constraint.

4. The computer-implemented method of claim 1 , wherein the data model includes a search constraint, wherein executing the search query comprises identifying ingested cloud data that satisfies the search query and the search constraint, and wherein the search constraint is not expressly set forth in the search query.

5. The computer-implemented method of claim 1 , wherein executing the search query comprises:

ascertaining that the search query is to apply a data model based on a presence of the first tag in the search query; and

ascertaining that the search query is to retrieve cloud data based on a presence of the second tag in the search query.

6. The computer-implemented method of claim 1 , wherein the ingesting is performed by a software module of the data intake and query system, and wherein the software module includes a first event type definition that specifies a type of data to be ingested by the software module, the method further comprising maintaining a configuration file that includes the event type definition and at least one additional event type definition.

7. The computer-implemented method of claim 1 , wherein the ingesting is performed by a software module of the data intake and query system, and wherein the software module includes a first event type definition that specifies a type of data to be ingested by the software module;

the method further comprising:

maintaining a first configuration file that includes the first event type definition and a second event type definition; and

maintaining a second configuration file that associates the first tag and the second tag with the first event type definition.

8. The computer-implemented method of claim 1 , wherein the ingesting is performed by a software module of the data intake and query system, and wherein the software module includes a first event type definition that specifies a type of data to be ingested by the software module:

the software module further includes a first configuration file that includes the first event type definition and a second event type definition;

the software module further includes a second configuration file that associates the first tag and the second tag with the first event type definition; and

the first configuration file further includes a second event type definition, and wherein the second configuration file further includes the second tag in association with the second event type definition.

9. The computer-implemented method of claim 1 , wherein the ingesting is performed by a software module of the data intake and query system, and wherein the software module includes an event type definition that specifies a type of data to be ingested by the software module and a set of parameters for identifying data to be ingested into the data intake and query system by the software module.

10. The computer-implemented method of claim 1 , wherein the data model specifies a dataset, including a search constraint and a set of fields associated with the dataset.

11. The computer-implemented method of claim 1 , wherein the ingested data comprises a plurality of different fields, and wherein said ingesting data comprises:

ingesting data from a plurality of different source types, wherein a field of the plurality of fields has different field names for at least two of the plurality of different source types; and

normalizing the different field names of the field across the plurality of different source types.

12. The computer-implemented method of claim 1 , wherein the ingested data comprises a plurality of different fields, and wherein said ingesting data comprises:

ingesting data from a plurality of different source types, wherein a field of the plurality of fields has different field names for at least two of the plurality of different source types; and

normalizing the different field names of the field across the plurality of different source types, by accessing a configuration file containing a list of field name aliases.

13. The computer-implemented method of claim 1 , wherein the data model specifies a dataset, including a set of fields associated with the dataset;

the method further comprising:

receiving user input defining a plurality of aliases for a field name of a field of the set of fields; and

in response to the user input defining the plurality of aliases, storing the plurality of aliases in a configuration file, for use in normalizing the field name across different data source types.

14. A computing device comprising:

a processor; and

a non-transitory computer-readable medium, accessible to the processor, having stored thereon instructions, execution of which by the processor causes the computing device to perform operations including:

accessing a first tag and a second tag stored in association with each other in a metadata storage, the first tag for associating ingested data of a particular class of data with a data model that contains semantic knowledge about the particular class of data, the second tag for designating ingested data as cloud data;

ingesting data into a data intake and query system, at least a portion of the ingested data being cloud data;

in response to determining that the portion of the ingested data satisfies one or more criteria associated with the first tag, determining that the portion of the ingested data should be tagged with the first tag;

determining that the portion of the ingested data should be tagged with the second tag based on the first tag being associated with the second tag in the metadata storage;

storing the portion of the ingested data in a data repository in association with the first tag and the second tag, the first tag associating the portion of the ingested data with the data model that contains semantic knowledge about the particular class of data, the second tag designating the portion of the ingested data as cloud data;

executing a search query that includes the first tag and the second tag against the data repository, to identify ingested cloud data that satisfies the search query; and

causing a display device to display a visualization based on a result of the search query, the result including the portion of the ingested data.

15. The computing device of claim 14 , wherein executing the search query comprises:

ascertaining that the search query is to apply the data model based on a presence of the first tag in the search query; and

ascertaining that the search query is to retrieve cloud data based on a presence of the second tag in the search query.

16. The computing device of claim 14 , wherein computing device comprises a software module configured to perform the ingesting;

wherein the software module includes a first configuration file that includes a first event type definition and a second event type definition;

the software module further includes a second configuration file that associates the first tag and the second tag with the first event type definition; and

the first configuration file further includes the second event type definition, and wherein the second configuration file further includes the second tag in association with the second event type definition.

17. The computing device of claim 14 , wherein the data comprises first data representing a first plurality of events from a first data source, the first data source being of a first source type, and wherein the ingesting is performed by a software module customized to ingest only data from sources of the first source type into the data intake and query system;

said operations further including:

ingesting second data, by a second software module, into the data intake and query system, at least a portion of the second data being cloud data, the second software module including an event type definition that specifies a type of data to be ingested by the second software module, the second software module further including the second tag to designate ingested data from a source of a second source type as cloud data and a third tag to associate ingested data from the source of the second source type with a second data model.

18. A non-transitory computer-readable medium having stored thereon instructions, execution of which by one or more processors in a data intake and query system causes the data intake and query system to perform operations including:

accessing a first tag and a second tag stored in association with each other in a metadata storage, the first tag for associating ingested data of a particular class of data with a data model that contains semantic knowledge about the particular class of data, the second tag for designating ingested data as cloud data;

ingesting data, at least a portion of which is cloud data;

in response to determining that the portion of the ingested data satisfies one or more criteria associated with the first tag, determining that the portion of the ingested data should be tagged with the first tag;

determining that the portion of the ingested data should be tagged with the second tag based on the first tag being associated with the second tag in the metadata storage;

storing the portion of the ingested data in a data repository in association with the first tag and the second tag, the first tag associating the portion of the ingested data with the data model that contains semantic knowledge about the particular class of data, the second tag designating the portion of the ingested data as cloud data;

executing a search query that includes the first tag and the second tag against the data repository, to identify ingested cloud data that satisfies the search query; and

causing a display device to display a visualization based on a result of the search query, the result including the portion of the ingested data.

19. The non-transitory computer-readable medium of claim 18 , wherein executing the search query comprises:

ascertaining that the search query is to apply the data model based on a presence of the first tag in the search query; and

ascertaining that the search query is to retrieve cloud data based on a presence of the second tag in the search query.

20. The non-transitory computer-readable medium of claim 18 , such that:

the ingesting is performed by a software module that includes a first configuration file that includes a first event type definition and at least one additional event type definition;

the software module further includes a second configuration file that associates the first tag and the second tag with the first event type definition; and

the first configuration file further includes a second event type definition, and wherein the second configuration file further includes the second tag in association with the second event type definition.

Assignments (3)

Continuity (1)

References Cited (29)