Patent ID: 11921693
Assignee: SPLUNK INC.
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 16:
17. Non-transitory computer-readable storage media comprising computer-executable instructions stored thereon, which when executed by one or more processors, cause the one or more processors to:
identify, by a computing device in an information technology environment, machine data for communication to a data intake and query system, wherein the machine data is produced by the computing device and reflects activity in the information technology environment, wherein the information technology environment comprises a plurality of computing devices;
identify, by the computing device, a value associated with the machine data;
generate, by the computing device, an HTTP message directed to a component of the data intake and query system,
wherein the HTTP message identifies the component of the data intake and query system as a destination for the HTTP message,
wherein the HTTP message includes a header portion, a payload portion, and a custom field portion, wherein the header portion, the payload portion, and custom field portion are each separate and distinct,
wherein the payload portion comprises an event field identifier and an event field value, wherein the event field value includes the machine data, wherein the event field identifier indicates the machine data forms at least part of an event,
wherein the custom field portion includes an event metadata field identifier and an event metadata field value, wherein the event metadata field value includes the value associated with the machine data; and

communicate, by the computing device, the HTTP message to the component of the data intake and query system,
wherein the component of the data intake and query system is configured to:
generate the event from the HTTP message by extracting machine data from the payload portion using the event field identifier and associating the value associated with the machine data with the event as metadata, and
store the event in a bucket of a plurality of buckets, wherein the plurality of buckets are searchable by a user.