Journey instance generation based on one or more pivot identifiers and one or more step identifiers

Patent metadata

Field	Value
Publication number	US-11550849-B2
Application number	US-202117160933-A
Country	US
Kind code	B2
Filing date	Jan 28, 2021
Priority date	Mar 26, 2018
Publication date	Jan 10, 2023
Grant date	Jan 10, 2023

Abstract

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
obtaining a plurality of events identified by a search query, wherein each event of the plurality of events records activity associated with a computing device and includes a timestamp, and wherein each event includes a respective set of field values;
receiving identification of a first field value, the first field value indicating related events;
receiving identification of a second field value, the second field value indicating a particular step of a process;
determining that a set of events from the plurality of events each include the first field value among sets of field values of the set of events;
determining that a particular event from the set of events includes the second field value among a particular set of field values of the particular event;
associating the particular event with the particular step of the process; and
generating a display for the set of events, wherein the display orders the set of events chronologically according to a timestamp included in each event of the set of events, wherein each event of the set of events is represented in the display as a step of the process, and wherein the display illustrates execution of the process by the set of events.

2. The computer-implemented method of claim 1 , wherein the plurality of events comprise raw machine data from heterogeneous data sources, and wherein the heterogeneous data sources generate the raw machine data in heterogeneous data formats.

3. The computer-implemented method of claim 1 , wherein a first event of the plurality of events records activity associated with a first computing device and a second event of the plurality of events records activity associated with a second computing device.

4. The computer-implemented method of claim 1 , wherein the particular step is a first particular step and the particular event is a first particular event, the computer-implemented method further comprising:
receiving identification of a third field value, the third field value indicating a second particular step of the process;
determining that a second particular event from the set of events includes the third field value among a second particular set of field values of the second particular event; and
associating the second particular event with the second particular step of the process, wherein an identifier for the second particular event is included in the display for the set of events.

5. The computer-implemented method of claim 1 , wherein the set of events is a first set of events, the particular event is a first particular event, the process is a first process, and the display is a first display, the computer-implemented method further comprising:
receiving identification of a third field value, the third field value indicating related events, wherein the third field value is different from the first field value;
determining that a second set of events from the plurality of events each include the third field value among a second set of field values of the second set of events;
determining that a second particular event from the second set of events includes a fourth field value among the second set of field values of the second particular event;
associating the second particular event with a particular step of a second process; and
generating a second display for the second set of events, wherein the second display orders the second set of events chronologically according to a timestamp included in each event of the second set of events, wherein each event of the second set of events is represented in the second display as a step of the second process, and wherein the second display illustrates execution of the second process by the second set of events.

6. The computer-implemented method of claim 1 , wherein the set of events is a first set of events, the particular event is a first particular event, the process is a first process, and the display is a first display, the computer-implemented method further comprising:
receiving identification of a third field value, the third field value indicating related events;
determining that a second set of events from the plurality of events each include the third field value among a second set of field values of the second set of events;
determining that a second particular event from the second set of events includes a fourth field value among a second particular set of field values of the second particular event;
associating the second particular event with a particular step of a second process; and
generating a second display for the second set of events, wherein the second display orders the second set of events chronologically according to a timestamp included in each event of the second set of events, wherein each event of the second set of events is represented in the second display as a step of the second process, wherein the second display illustrates execution of the second process by the second set of events, and wherein the second field value of the particular step of the first process matches the fourth field value of the particular step of the second process.

7. The computer-implemented method of claim 1 , wherein the set of events is a first set of events, the particular event is a first particular event, the process is a first process, and the display is a first display, the computer-implemented method further comprising:
receiving identification of a third field value, the third field value indicating related events;
determining that a second set of events from the plurality of events each include the third field value among a second set of field values of the second set of events; and
generating a second display based on the first set of events and the second set of events, wherein the first set of events and the second set of events are represented in the second display by a plurality of steps, and wherein the second display illustrates one or more traversals between one or more steps of the plurality of steps based on the first set of events and the second set of events.

8. The computer-implemented method of claim 1 , wherein the set of events is a first set of events, the particular event is a first particular event, the process is a first process, and the display is a first display, the computer-implemented method further comprising:
receiving identification of a third field value, the third field value indicating related events;
determining that a second set of events from the plurality of events each include the third field value among a second set of field values of the second set of events;
determining that a second particular event from the second set of events includes a fourth field value among a second particular set of field values of the second particular event;
associating the second particular event with a particular step of a second process; and
generating a second display based on the first set of events and the second set of events, wherein the first set of events and the second set of events are represented in the second display by a plurality of steps, wherein a first step of the plurality of steps represents the particular step of the first process and a second step of the plurality of steps represents the particular step of the second process, and wherein the second display illustrates one or more traversals between one or more steps of the plurality of steps based on the first set of events and the second set of events.

9. The computer-implemented method of claim 1 , wherein the set of events is a first set of events, the particular event is a first particular event, the process is a first process, and the display is a first display, the computer-implemented method further compri

Assignees

• Splunk Inc

Inventors

• Beringer Joerg
• Park Isabelle
• Walters Joshua
• Tschetter Eric
• Fishel Simon Foster

Classifications

• G06F16/9038

  Presentation of query results · CPC title

• G06F16/25

  Integrating or interfacing systems involving database management systems · CPC title

• G06F16/903 Primary

  Querying (for retrieval from the web G06F16/953) · CPC title

• G06F16/287

  Visualization; Browsing · CPC title

• G06F16/90335 Primary

  Query processing · CPC title