Associating data from different nodes of a distributed ledger system

Patent metadata

Field	Value
Publication number	US-11507562-B1
Application number	US-201916419941-A
Country	US
Kind code	B1
Filing date	May 22, 2019
Priority date	May 22, 2019
Publication date	Nov 22, 2022
Grant date	Nov 22, 2022

Abstract

Systems and methods are described to associate data from different nodes of a distributed ledger system. The nodes can generate transaction notifications, log data, and/or metrics data. At least some of the data generated by the nodes can be obtained by a data intake and query system via a distributed ledger system monitor. The data from the distributed ledger system can be stored in the data intake and query system and correlated. Based on an association between at least some of the data of the first node and at least some of the data of the second node, the data intake and query system can determine at least a partial history of a transaction in the distributed ledger system, relationships between components of the distributed ledger system, and/or an architecture of the distributed ledger system.

First claim

What is claimed:

1. A computer-implemented method, comprising:
receiving a query at a computing device of a data intake and query system, the query identifying a set of data associated with a distributed ledger system, wherein the distributed ledger system is different from the data intake and query system; identifying as a portion of the set of data, a set of events stored by the data intake and query system, wherein the set of events correspond to log data generated by a plurality of nodes of the distributed ledger system; identifying a first event of the set of events, wherein the first event corresponds to first log data generated by a first node of the distributed ledger system, wherein the first event identifies a first task performed by the first node as part of the distributed ledger system storing a transaction to a particular distributed ledger of the distributed ledger system; identifying a second event of the set of events associated with the transaction, wherein the second event corresponds to second log data generated by a second node of the distributed ledger system, the second log data being generated at a different time than the first log data, wherein the second event identifies a second task performed by the second node as part of the distributed ledger system storing the transaction to the particular distributed ledger; ordering, in response to the query, the first event and the second event to determine a partial history of the transaction as it is processed for storage by the distributed ledger system; determining, based on the ordering, that the transaction is an invalidated transaction; and outputting a result as a response to the query, wherein the result includes the partial history of the transaction and an indication of the invalidated transaction.

2. The computer-implemented method of claim 1 , wherein the first event includes the first log data associated with a timestamp.

3. The computer-implemented method of claim 1 , wherein the second event includes the second log data associated with a timestamp.

4. The computer-implemented method of claim 1 , wherein the first node is a first isolated execution environment and the second node is a second isolated execution environment.

5. The computer-implemented method of claim 1 , wherein the first node is a peer node configured to endorse and validate the transaction and the second node is an ordering node configured to order the transaction relative to other transactions.

6. The computer-implemented method of claim 1 , wherein the first node and the second node are peer nodes configured to endorse and validate the transaction and store the transaction as part of a block of a blockchain.

7. The computer-implemented method of claim 1 , wherein the first node and the second node are ordering nodes configured to order the transaction and generate blocks that include the transaction for validation and storage on a blockchain.

8. The computer-implemented method of claim 1 , wherein the ordering the first event with the second event is based on a transaction identifier associated with the first event and the second event.

9. The computer-implemented method of claim 1 , further comprising:
extracting a transaction identifier from at least one of the first log data or the second log data using a regular expression rule.

10. The computer-implemented method of claim 1 , further comprising:
reading a transaction identifier from an inverted index, wherein the transaction identifier is associated with the first event and the second event.

11. The computer-implemented method of claim 1 , further comprising correlating the first log data and the second log data with metrics data.

12. The computer-implemented method of claim 1 , further comprising correlating the first log data and the second log data with metrics data based on a first timestamp associated with at least one of the first log data or the second log data and a second timestamp associated with the metrics data.

13. The computer-implemented method of claim 1 , further comprising correlating the first log data and the second log data with one or more transaction notifications.

14. The computer-implemented method of claim 1 , further comprising correlating the first log data and the second log data with one or more transaction notifications based on a transaction identifier associated with the first log data, the second log data, and the one or more transaction notifications.

15. The computer-implemented method of claim 1 , further comprising correlating the first log data and the second log data with metrics data and one or more transaction notifications.

16. The computer-implemented method of claim 1 , wherein at least one of the first log data or the second log data is obtained via a data adapter.

17. The computer-implemented method of claim 1 , further comprising generating a visualization of the result.

18. The computer-implemented method of claim 1 , further comprising identifying one or more relationships between components of the distributed ledger system based on the ordering.

19. The computer-implemented method of claim 1 , further comprising identifying a node type of at least one of the first node or the second node.

20. The computer-implemented method of claim 1 , wherein the partial history includes one or more stages of the transaction in the distributed ledger system.

21. A computing system of a data intake and query system, the computing system comprising:
memory; and
one or more processing devices coupled to the memory and configured to:
receive a query, the query identifying a set of data associated with a distributed ledger system, wherein the distributed ledger system is different from the data intake and query system;
identify as at least a portion of the set of data, a set of events stored by the data intake and query system, wherein the set of events correspond to log data generated by a plurality of nodes of the distributed ledger system;
identify a first event of the set of events, wherein the first event corresponds to first log data generated by a first node of the distributed ledger system, wherein the first event identifies a first task performed by the first node as part of the distributed ledger system storing a transaction to a particular distributed ledger of the distributed ledger system;
identify a second event of the set of events associated with the transaction, wherein the second event corresponds to second log data generated by a second node of the distributed ledger system, the second log data being generated at a different time than the first log data, wherein the second event identifies a second task performed by the second node as part of the distributed ledger system storing the transaction to the particular distributed ledger;
order, in response to the query, the first event and the second event to determine a partial history of the transaction as it is processed for storage by the distributed ledger system;
determine, based on the order, that the transaction is an invalidated transaction; and
output a result in response to the query, wherein the result includes the partial history of the transaction and an indication of the invalidated transaction.

22. The computing system of claim 21 , wherein to order the first event and the second event, the one or more processing devices are configured to order the first event and the second event based on a transaction identifier stored in an inverted index, wherein the tran

Assignees

• Splunk Inc

Inventors

• Luedtke Stephen Robert
• Mckervey Nathaniel Gerard
• Moore Ryan Russell
• Wu Jeffrey Yung

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G16Y40/20 Primary

  Analytics; Diagnosis · CPC title

• G06F16/254

  Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses · CPC title

• G06F16/2477

  Temporal data queries · CPC title

• G06F16/2465

  Query processing support for facilitating data mining operations in structured databases · CPC title