Patent ID: 11936764
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A computer-implemented method comprising:
receiving, by a configuration server coupled to a remote capture agent via one or more networks, input requesting creation of an event stream to be generated by the remote capture agent, wherein the input identifies:
an application-layer protocol for the event stream, wherein the application-layer protocol is found within network traffic monitored by the remote capture agent, and
an application-layer event attribute, wherein the application-layer event attribute is associated with the application-layer protocol and is to be used by the remote capture agent as an aggregation attribute, and wherein the application-layer event attribute indicates data to be extracted from application-layer events constructed by the remote capture agent from the network traffic based on the application-layer protocol;

generating configuration data based on the input; and
sending the configuration data to the remote capture agent, wherein the configuration data causes the remote capture agent to generate the event stream based on the network traffic monitored by the remote capture agent and according to the configuration data.