Analyzing journey instances that include an ordering of step instances including a subset of a set of events

Patent metadata

Field	Value
Publication number	US-10909128-B2
Application number	US-201815936372-A
Country	US
Kind code	B2
Filing date	Mar 26, 2018
Priority date	Mar 26, 2018
Publication date	Feb 2, 2021
Grant date	Feb 2, 2021

Abstract

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events the system can build a journey instance.

First claim

What is claimed is:

1. A method, comprising:
accessing a plurality of journey instances, wherein each journey instance includes a set of events organized as a set of step instances, wherein each event of each set of events is associated with a timestamp and includes a portion of raw machine data,
wherein a particular journey instance of the plurality of journey instances includes a particular set of events of the plurality of sets of events, wherein the particular set of events includes a plurality of events organized as a plurality of step instances,
wherein each event of the plurality of events includes a same field value for a pivot identifier field,
wherein each step instance of the plurality of step instances includes an event of the plurality of events, and
wherein the particular journey instance includes a time ordering of the plurality of step instances based on a respective timestamp associated with each event of the plurality of events; and
combining the plurality of journey instances to form a journey model, wherein the journey model includes a plurality of steps, and wherein each step instance of each set of step instances, including each step instance of the plurality of step instances, is associated with one step of the plurality of steps; and
causing display of a visualization of the journey model, the visualization including a plurality of time-ordered step display objects, wherein the time-ordered step display objects are representative of the plurality of steps.

2. The method of claim 1 , wherein combining the plurality of journey instances comprises clustering the plurality of journey instances into a plurality of groups based on similarities of a particular time ordering of the plurality of step instances of individual journey instances of the plurality of journey instances.

3. The method of claim 1 wherein combining the plurality of journey instances comprises generating statistics of the plurality of journey instances.

4. The method of claim 1 , wherein combining the plurality of journey instances comprises determining a frequency of a particular step instance in the plurality of journey instances.

5. The method of claim 1 , wherein the journey model indicates a particular order of the steps and the time ordering of the plurality of step instances corresponds to the particular order of the steps.

6. The method of claim 1 , wherein the visualization includes at least one of an indication of the time ordering of the plurality of step instances, a duration of the plurality of journey instances, or a number of step instances in the plurality of journey instances.

7. The method of claim 1 , further comprising causing display of an identifier for each journey model of a plurality of journey models in association with a numerical indication of a number of journey instances that include a particular time ordering of the plurality of step instances that correspond to an ordering of steps of each journey model, the plurality of journey models including the journey model.

8. The method of claim 1 , further comprising causing display of an identifier for each journey model of a plurality of journey models in association with a non-numerical indication of a number of journey instances that include a particular time ordering of the plurality of step instances that correspond to an ordering of steps of each journey model, the plurality of journey models including the journey model.

9. The method of claim 1 , further comprising causing display of an identifier for the journey model in association with a numerical indication of a number of journey instances that include the time ordering of the plurality of step instances.

10. The method of claim 1 , further comprising causing display of an identifier for the journey model in association with a non-numerical indication of a number of journey instances that include the time ordering of the plurality of step instances.

11. The method of claim 1 , further comprising:
wherein the visualization includes an indication of the time orderings of the plurality of step instances.

12. The method of claim 1 :
wherein the visualization includes a non-numerical indication of a frequency of a transition between two steps of the plurality of steps of the journey model based on the plurality of journey instances.

13. The method of claim 1 ,
wherein the visualization includes an indication of a most common time ordering of the plurality of sets of step instances, an average duration of the plurality of journey instances, an average number of step instances corresponding to the plurality of journey instances.

14. The method of claim 1 , further comprising:
wherein the visualization includes an indication of the time ordering of the plurality of step instances.

15. The method of claim 1 ,
wherein the visualization includes an indication of a duration of each of the plurality of journey instances.

16. The method of claim 1 , wherein the time-ordered step objects are based on the time ordering of each plurality of step instances for each set of step instances.

17. The method of claim 1 , wherein the plurality of time-ordered step display objects are along an arc.

18. The method of claim 1 , wherein the plurality of time-ordered step display objects are equally spaced along an arc.

19. The method of claim 1 , wherein the plurality of time-ordered step display objects are along one of a plurality of arcs, wherein a first group of the plurality of steps of the journey model is located along a first arc of the plurality of arcs and a second group of the plurality of steps of the journey model is located along a second arc of the plurality of arcs.

20. The method of claim 1 , wherein the plurality of sets of events comprise events from heterogeneous data sources.

21. The method of claim 1 , wherein the set of events of at least one journey instance of the plurality of journey instances comprises events from heterogeneous data sources.

22. The method of claim 1 , wherein the set of events of at least one journey instance of the plurality of journey instances comprises events from heterogeneous data sources with heterogeneous data formats.

23. A computing system, comprising:
one or more processing devices configured to:
access a plurality of journey instances, wherein each journey instance includes a set of events organized as a set of step instances, wherein each event of each set of events is associated with a timestamp and includes a portion of raw machine data,
wherein a particular journey instance of the plurality of journey instances includes a particular set of events of the plurality of sets of events, wherein the particular set of events includes a plurality of events organized as a plurality of step instances,
wherein each event of the plurality of events includes a same field value for a pivot identifier field,
wherein each step instance of the plurality of step instances includes an event of the plurality of events, and
wherein the particular journey instance includes a time ordering of the plurality of step instances based on a respective timestamp associated with each event of the plurality of events;
combine the plurality of journey instances to form a journey model, wherein the journey model includes a plurality of steps, and wherein each step instance of each set of step instances, including each step instance of the plurality of step instances, is associated with one step of the plurality of steps

Assignees

• Splunk Inc

Inventors

• Beringer Joerg
• Park Isabelle
• Walters Joshua
• Tschetter Eric
• Fishel Simon
• Werner Horst

Classifications

• G06F16/2465 Primary

  Query processing support for facilitating data mining operations in structured databases · CPC title

• G06F16/2477 Primary

  Temporal data queries · CPC title

• G06F16/248

  Presentation of query results · CPC title