Supporting graph data structure transformations in graphs generated from a query to event data

Patent metadata

Field	Value
Publication number	US-11269876-B1
Application number	US-202016864029-A
Country	US
Kind code	B1
Filing date	Apr 30, 2020
Priority date	Apr 30, 2020
Publication date	Mar 8, 2022
Grant date	Mar 8, 2022

Abstract

Systems and methods are disclosed for supporting transformations of a graph generated from a query to event data. The event data may be unstructured event data, from which instances of a journey can be identified that represent sequences of related events describing actions performed in a computing environment. When evaluating journey instances, it can be helpful to visualize the instances as a graph. Depending on the instances viewed, a user may desire different modifications to the graph. While such modifications can be made when initially building instances from the unstructured event data, this can limit reuse of the resulting instances (since the modification would also be present when evaluating other subsets). To address this, embodiments of the present disclosure enable graph modifications to be applied to subsets of journey instances after building those instances from unstructured event data, increasing reuse of instances built from a query against the unstructured data.

First claim

What is claimed is:

1. A computer-implemented method comprising:
executing a query for a set of journey instances, wherein the query is executed against a data store storing event data obtained from a computing environment, each journey instance comprising a sequence of related events describing actions performed in the computing environment, and wherein the journey instances are represented in query results as a graph data structure arranging the related events of the journey instances into a graph;
identifying, from the set of journey instances, a subset of the journey instances that match filter criteria;
modifying the subset of the journey instances that match the filter criteria according to a graph transformation to result in a modified subset of the journey instances, wherein modifying the subset of journey instances comprises modifying the graph of events making up the individual journey instances according to the graph transformation; and
outputting a representation of the modified subset of the journey instances.

2. The computer-implemented method of claim 1 , wherein nodes within the graph represent the actions, and wherein edges of the graph are weighted according to a number of instances that indicate consecutive performance of actions represented by nodes connected by an edge.

3. The computer-implemented method of claim 1 , wherein the graph transformation includes modifying a node within the graph, and wherein modifying a node comprises at least one of renaming the node, dividing the node, combining the node with a second node to result in a single node, modifying an attribute value associated with the node, or anonymizing data associated with the node.

4. The computer-implemented method of claim 1 , wherein the graph transformation includes removing a node from the graph.

5. The computer-implemented method of claim 1 , wherein the graph transformation includes removing a node from the graph and recomputing edges of the graph according to the removed node and the sequences of related events of the individual journey instances.

6. The computer-implemented method of claim 1 , wherein the graph transformation includes adding a node to the graph.

7. The computer-implemented method of claim 1 , wherein the graph transformation includes adding a node to the graph that is associated with a particular field value of a type of event, and recomputing edges of the graph according to whether the sequences of related events of the individual journey instances include an event of the type and the particular field value.

8. The computer-implemented method of claim 1 , wherein the graph transformation includes updating metrics associated with the graph.

9. The computer-implemented method of claim 1 , wherein the graph transformation includes removing a loop within the graph, the loop corresponding a set of nodes within the graph that represent one or more actions taken repeatedly in at least one instance of the journey.

10. The computer-implemented method of claim 1 further comprising:
identifying, from the set of journey instances, a subset of the journey instances that match second filter criteria;
modifying the subset of the journey instances that match the second filter criteria according to a second graph transformation to result in a second modified subset of journey instances; and
outputting a representation of the second modified subset of instances.

11. The computer-implemented method of claim 1 , wherein the query results are represented as a set of structured data, and wherein identifying the subset of the journey instances that match the filter criteria comprises executing a second query against the set of structured data.

12. The computer-implemented method of claim 1 , wherein modifying the subset of the journey instances that match the filter criteria according to the graph transformation is responsive to a transformation command included within the query.

13. The computer-implemented method of claim 1 , wherein the actions are represented within the journey instances as steps, and wherein the filter criteria specify at least one of: a step, a series of steps, an attribute value, a duration of instances meeting the criteria, a duration between at least two steps, a repetition of at least one step, a start time, an stop time, a starting step, an ending step, or an ordering of at least two steps.

14. The computer-implemented method of claim 1 , wherein the filter criteria comprise a plurality of sets of filter criteria each associated with a periodicity, wherein the method is repeated at each of a set of periods, and wherein the periods are determined based on a minimum periodicity among the plurality of sets of filter criteria.

15. The computer-implemented method of claim 1 , wherein modifying the subset of the journey instances that match the filter criteria according to the graph transformation to result in a modified subset of the journey instances comprises modifying all journey instances within the query results according to the graph transformation to result in a modified set of journey instances, and wherein identifying, from the set of journey instances, the subset of the journey instances that match filter criteria comprises identifying the modified subset of journey instances from within the modified set of journey instances.

16. A system comprising:
a data store including computer-executable instructions; and
a processor in communication with the data store and configured to execute the computer-executable instructions to:
execute a query for a set of journey instances, wherein the query is executed against a data store storing event data obtained from a computing environment, each journey instance comprising a sequence of related events describing actions performed in the computing environment, and wherein the journey instances are represented in query results as a graph data structure arranging the related events of individual journey instances into a graph;
identify, from the set of journey instances, a subset of the journey instances that match filter criteria;
modify the subset of the journey instances that match the filter according to a graph transformation to result in a modified subset of journey instances, wherein modifying the subset of journey instances comprises modifying the graph of events making up the individual journey instances according to the graph transformation; and

output a representation of the modified subset of instances.

17. The system of claim 16 , wherein the graph transformation includes removing a loop within the graph, the loop corresponding a set of nodes within the graph that represent one or more actions taken repeatedly in at least one instance of the journey.

18. The system of claim 16 , wherein the processor is further configured to execute the computer-executable instructions to:
identify, from the set of journey instances, a subset of the journey instances that match second filter criteria;
modify the subset of the journey instances that match the second filter criteria according to a second graph transformation to result in a second modified subset of journey instances; and
output a representation of the second modified subset of instances.

19. Non-transitory computer-readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:
execute a query for a set of journey instances, wherein the query is executed against a data store storing event data obtained from a computing environment, each journ

Assignees

• Splunk Inc

Inventors

• Basavaiah Chandrashekar
• Li Elizabeth
• Tschetter Eric
• Walters Joshua

Classifications

• G06F16/248 Primary

  Presentation of query results · CPC title

• G06F16/2465

  Query processing support for facilitating data mining operations in structured databases · CPC title

• G06F16/24526 Primary

  Internal representations for queries · CPC title

• G06F8/77

  Software metrics · CPC title

• G06F16/212

  with details for data modelling support · CPC title