Journey instance generation based on one or more pivot identifiers and one or more step identifiers

Patent metadata

Field	Value
Publication number	US-10909182-B2
Application number	US-201815936362-A
Country	US
Kind code	B2
Filing date	Mar 26, 2018
Priority date	Mar 26, 2018
Publication date	Feb 2, 2021
Grant date	Feb 2, 2021

Abstract

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

First claim

What is claimed is:

1. A method, comprising:
identifying a plurality of events in response to a search query, wherein each event of the plurality of events comprises raw machine data associated with a time stamp;
receiving an identification of a pivot identifier field;
grouping the plurality of events into a plurality of sets of events based on field values in the plurality of events for the pivot identifier field, wherein a particular set of events of the plurality of sets of events includes at least two events of the plurality of events, wherein the at least two events include a same field value for the pivot identifier field;
receiving an indication of a step identifier field;
categorizing the at least two events of the particular set of events as one or more step instances of a step based on field values in the at least two events for the step identifier field;
ordering the at least two events chronologically based on a respective time stamp of each of the at least two events; and
causing display of a visualization of the particular set of events in chronological order.

2. The method of claim 1 , the method further comprising receiving the raw machine data from one or more heterogeneous data sources.

3. The method of claim 1 , the method further comprising receiving the raw machine data from one or more heterogeneous data sources comprising heterogeneous data formats.

4. The method of claim 1 , wherein the one or more step instances of the step constitute a journey instance that is a representation of an ordered group of step instances associated with the step identifier field.

5. The method of claim 4 , wherein the one or more step instances of the step is a first one or more step instances of a first step, the method further comprising generating a journey model from the first one or more step instances of the first step and a second one or more step instances of a second step, wherein the journey model corresponds to the ordered group of step instances associated with the step identifier field.

6. The method of claim 1 , wherein said grouping the plurality of events into a plurality of sets of events is based on a common field value for the pivot identifier field.

7. The method of claim 1 , further comprising:
identifying a plurality of field values for the pivot identifier field,
wherein each set of events of the plurality of sets of events is associated with a unique field value of the plurality of field values.

8. The method of claim 1 , wherein each event of the at least two events comprises the same field value for the step identifier field.

9. The method of claim 1 , further comprising:
identifying a plurality of field values for the step identifier field; and
generating a plurality of steps based on the plurality of field values, wherein each step of the plurality of steps is associated with a unique field value of the plurality of field values, and wherein the plurality of steps includes the step.

10. The method of claim 1 , wherein said ordering the at least two events chronologically is further based on a time stamp associated with each step instance of the one or more steps stances of the step.

11. The method of claim 1 , wherein said grouping the plurality of events into a plurality of sets of events is further based on the step identifier field.

12. The method of claim 1 , wherein the visualization indicates a progression through the one or more step instances of the step.

13. The method of claim 1 , further comprising:
building a journey model based on at least one of the plurality of sets of events and the step identifier field.

14. The method of claim 1 , further comprising:
causing display of a visualization of the plurality of sets of events, wherein the visualization indicates a progression through one or more sets of events of at least a subset of the plurality of sets of events.

15. The method of claim 1 , further comprising:
receiving the raw machine data from one or more heterogeneous data sources, wherein the pivot identifier field comprises a first pivot identifier field associated with a first data source of the one or more heterogeneous data sources and a second pivot identifier field associated with a second data source of the one or more heterogeneous data sources,
wherein the at least two events include a field value that matches at least one of a first field value for the first pivot identifier field or a second field value for the second pivot identifier field.

16. The method of claim 1 , further comprising:
receiving the raw machine data from one or more heterogeneous data sources, wherein the pivot identifier field comprises a first pivot identifier field associated with a first data source of the one or more heterogeneous data sources and a second pivot identifier field associated with a second data source of the one or more heterogeneous data sources,
wherein the particular set of events comprises a first group of events that includes a first field value for the first pivot identifier field and a second group of events that includes a second field value for the second pivot identifier.

17. The method of claim 1 , further comprising:
receiving the raw machine data from one or more heterogeneous data sources, wherein the pivot identifier field comprises a first pivot identifier field associated with a first data source of the one or more heterogeneous data sources and a second pivot identifier field associated with a second data source of the one or more heterogeneous data sources;
identifying an event of the plurality of events that includes a first field value and a second field value;
identifying a first group of events that include the first field value for the first pivot identifier field; and
identifying a second group of events that include the second field value for the second pivot identifier field,
wherein the particular set of events includes the first group of events and the second group of events.

18. The method of claim 1 , further comprising:
receiving the raw machine data from one or more heterogeneous data sources, wherein the pivot identifier field comprises a first pivot identifier field associated with a first data source of the one or more heterogeneous data sources and a second pivot identifier field associated with a second data source of the one or more heterogeneous data sources;
identifying an event of the plurality of events that is associated with the first data source and includes a first field value and a second field value;
identifying a first group of events that include the first field value for the first pivot identifier field; and
identifying a second group of events that include the second field value for the second pivot identifier field,
wherein the particular set of events includes the first group of events and the second group of events.

19. The method of claim 1 , further comprising:
receiving the raw machine data from one or more heterogeneous data sources, wherein the pivot identifier field comprises a first pivot identifier field associated with a first data source of the one or more heterogeneous data sources and a second pivot identifier field associated with a second data source of the one or more heterogeneous data sources;
identifying an event of the plurality of events that is associated with the first data source and includes a first field value for the first pivot identifier field and a second field value;
identifying a first group of events that include the first field value for the first pivot identifier

Assignees

• Splunk Inc

Inventors

• Beringer Joerg
• Park Isabelle
• Walters Joshua
• Tschetter Eric
• Fishel Simon

Classifications

• G06F16/9038

  Presentation of query results · CPC title

• G06F16/287

  Visualization; Browsing · CPC title

• G06F16/903 Primary

  Querying (for retrieval from the web G06F16/953) · CPC title

• G06F16/904

  Browsing; Visualisation therefor (for navigating the web G06F16/954; browsing optimisation for the web G06F16/957) · CPC title

• G06F16/25

  Integrating or interfacing systems involving database management systems · CPC title