Source: https://patents.google.com/patent/US9922066B2/en
Timestamp: 2019-08-23 11:42:27
Document Index: 641286898

Matched Legal Cases: ['§ 119', 'Application No. 60', '§ 120', 'Application No. 201210293010', 'Application No. 201210293010', 'Application No. 201210293010', 'Application No. 201210293010', 'Application No. 07853813', 'Application No. 07853813', 'Application No. 12159074', 'Application No. 12159074']

US9922066B2 - Aggregation and display of search results from multi-criteria search queries on event data - Google Patents
Aggregation and display of search results from multi-criteria search queries on event data Download PDF
US9922066B2
US9922066B2 US15/008,428 US201615008428A US9922066B2 US 9922066 B2 US9922066 B2 US 9922066B2 US 201615008428 A US201615008428 A US 201615008428A US 9922066 B2 US9922066 B2 US 9922066B2
US15/008,428
US20160140128A1 (en
2006-10-05 Priority to US82828306P priority Critical
2007-10-05 Priority to US11/868,370 priority patent/US8112425B2/en
2012-01-18 Priority to US13/353,135 priority patent/US9002854B2/en
2015-01-30 Priority to US14/611,170 priority patent/US9594789B2/en
2015-10-30 Priority to US14/929,248 priority patent/US9922065B2/en
2016-01-27 Priority to US15/008,428 priority patent/US9922066B2/en
2016-01-27 Application filed by Splunk Inc filed Critical Splunk Inc
2016-05-19 Publication of US20160140128A1 publication Critical patent/US20160140128A1/en
2017-12-19 Assigned to SPLUNK INC. reassignment SPLUNK INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: STECHERT, ANDRE, HALL, BRAD, BAUM, MICHAEL J., CARASSO, DAVID, DAS, ROBIN K., GREENE, RORY, MEALY, NICK, MURPHY, BRIAN, SORKIN, STEPHEN, SWAN, ERIC M.
2018-03-20 Publication of US9922066B2 publication Critical patent/US9922066B2/en
G06F17/30342—
The present application is a continuation of U.S. patent application Ser. No. 14/929,248, filed on Oct. 30, 2015; which is a continuation of Ser. No. 14/611,170, filed on Jan. 30, 2015; which is a continuation of U.S. patent application Ser. No. 13/353,135, filed on Jan. 18, 2012, issued as U.S. Pat. No. 9,002,854 on Apr. 7, 2015; which is a continuation of U.S. patent application Ser. No. 11/868,370, filed Oct. 5, 2007, issued as U.S. Pat. No. 8,112,425 on Feb. 7, 2012; which claims priority under 35 U.S.C. § 119(e) to U.S. Provisional Patent Application No. 60/828,283, filed Oct. 5, 2006, the entire contents of the aforementioned are hereby incorporated by reference as if fully set forth herein, under 35 U.S.C. § 120. The applicant(s) hereby rescind any disclaimer of claim scope in the parent application(s) or the prosecution history thereof and advise the USPTO that the claims in this application may be broader than any claim in the parent application(s).
Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity made up of discrete events. Examples include information processing logs, market transactions, and sensor data from real-time monitors (supply chains, military operation networks, or security systems). The ability to index, search, and present relevant search results is important to understanding and working with systems emitting large quantities of time series data.
Step 310 in the time stamp process 210 of FIG. 3 aggregates the streaming time series data 205 into individual events 3 I 5. In our information-processing example, web server time series data streams may have a single line per event and be easy to identify. However, an application server time series data stream may contain single events with a large number of lines making identification of individual events within the stream difficult.
In one embodiment, clustering is used to classify 415 collected MD 205 into domains according to their source signatures 412. As collections of MD 205 are encountered, each collection's signature is matched to the set of known source signatures 412 by performing a nearest-neighbor search. If the distance of the closest matching signature 412 is within a threshold, the closest matching signature 420's domain is assumed to be the domain of the source. If no best match can be found, a new source signature 412 can be created from the sample signature and a new source domain created. Alternatively, a default source domain can be used. In one implementation, the distance between two signatures is calculated by iterating over the union of attributes of the two signatures, with the total signature distance being the average of distances for each attribute. For each attribute A, the value of A on Signature I and Signature2, VI and V2, are compared and a distance is calculated. The distance for attribute A is the square of (VI−V2)*IDF, where IDF is the log(N I IAI), where N is the number of signatures, and IAI is the number of signatures with attribute A.
Some MD 205 sources are non-textual or binary and cannot be easily processed unless a known process is available to convert the binary MD into textual form. To classify a source as textual or binary, a sample MD collection is analyzed. Textual MD can also have embedded binary MD, such as a memory dump, and the classification preferably identifies it as such. In one implementation, the textual/binary classification works as follows. The sample is a set of lines of data, where a line is defined as the data between new lines (i.e., ‘\n’), carriage returns (i.e., ‘\r’), or their combination (i.e., ‘\r\n’). For each line, if the line's length is larger than some large threshold, such as 2k characters, or if the line contains a character with an ASCII value of zero (0), a count of Binary-looking lines is incremented. Otherwise, if the line's length is shorter than a length that one would expect most text lines to be below, such as 256 characters, a count of Text-looking lines is incremented. If the number of Text-looking lines is twice as numerous as the Binary-looking lines (other ratios can be used depending on the context), the source is classified as text. Otherwise, the source is classified as binary.
The MD collection may be known a priori, or may be classified, as single-line type (i.e., containing only single-line events) or multi-line type (i.e., possibly containing multi-line events) prior to performing aggregation. For those MD collections that are classified as single line type, aggregation 425 is simple—single-line type MD collections are broken on each line as a separate event. Multi-line type MD collections are processed 425 for aggregation. In one implementation, a MD collection is classified as a multi-line type if 1) there is a large percentage of lines that start with spaces or are blank (e.g., if more than 5% of the lines start with spaces or are blank), or 2) there are too many varieties of punctuation characters in the first N punctuation characters. For example, if the set of the first three punctuation characters found on each line has more than five patterns (e.g., ‘:::’, ‘!:!’, ‘,,,’, ‘:..’, ‘( )*’), the collection might be classified as multi-line.
Another aspect of aggregation methods 425 is the ability to learn, and codify into rules, what constitutes a break between lines and therefore the boundary between events, by analyzing a sample of MD. For example, in one implementation, an aggregation method 425 compares every two-line pair looking for statistically similar structures (e.g., use of white space, indentation, and time-stamps) to quickly learn which two belong together and which two are independent. In one implementation, aggregation 425 works as follows. For each line, first check if the line starts with a time-stamp. If so, then break. Typically, lines starting with a time-stamp are the start of a new event. For lines that do not start with a time-stamp, combine the current line with the prior line to see how often the pair of lines occurs, one before the other, as a percentage of total pairs in the MD sample. Line signatures are used in place of lines, where a line signature is a more stable version of a line, immune to simple numeric and textual changes. In this implementation, signatures can be created by converting a line into a string that is the concatenation of leading white space, any punctuation on the line, and the first word on the line. The line “10:29:03 Host 191.168.0.1 rebooting:normally” is converted to “::..:Host.”
hoursago::value—search for events within the last value hours. eventtype::value—search for events with an event type or tag that matches the specified value.
host::value—search for events whose hostname was set to the specified value. This is the host that logged the event, not necessarily the host that generated the event.
maxresults::value—the maximum number ofresults to return. minutesago::value—search for events within the last value minutes.
similar::value—search for events with a similar event type to the current event. sourcetype::value—search for events with a given sourcetype of value.
unexpected::value—search for events that lie outside observed patterns in the index by the specified value of 0 (expected) to 9 (most unexpected).
Modifiers can be combined with keywords, wildcard characters, literal strings, quoted phrases and Boolean operators, such as AND, OR, NOT. Parentheses can be used to nest search and sub-search phrases together. An example search phrase might be “sourcetype::mysql* sock* NOT (started OR (host::foo OR host::BAR)) maxresults:: IO (eventtype::baddb OR eventtype::?8512-3) daysago::30”.
For example, the example TSSL can specify to see results for only a particular time frame and/or to see results presented by seconds, minutes, hours, days, weeks or months. In this way the search window can be limited to a timeframe and the results can be constructed for optimal viewing based on the density of the expected result set returned from a search. The search “192.168.169.100 hoursago::24 page::seconds”, will return time series events including the keyword “192.168.169.100” that occurred within the last 24 hours and will summarize the display results by seconds. In an exemplary implementation of a TSSE, summarization can include both aggregated display lines summarizing the events for the summary window and/or paging the results by the summary window. In the example above, each page of the search results presentation may include one second in time. Examples include but are not limited to:
Ability to zoom in to second resolution around 12:I SAM Jun. 3, 2005, for a specific data source type and physical machine location.
creating, in real-time, a plurality of searchable events from machine data as the machine data is collected in real-time from one or more data sources, each event in the plurality of searchable events is segmented from the machine data and includes an associated portion of the machine data and an associated timestamp derived from the machine data;
dividing the plurality of events into sets of events that are organized by time;
indexing the timestamped events;
hashing each event in the sets of events, wherein each event is tested for duplication using its associated hash value, wherein an event having a hash value that is a duplicate of an existing hash value is removed;
as the plurality of events are being created in real-time, receiving a search query that includes at least a time criterion, a second criterion for selection of events, and a page value;
generating a result set for an event search query by executing the event search query across the plurality of events, the event search query includes the time criterion and the second criterion for selection of events, the result set includes events that match the time criterion and have an associated portion of the machine data that fulfills the second criterion for selection of events;
sorting the result set according to time;
causing display of a plurality of aggregated display lines, wherein each aggregated display line among the plurality of aggregated display lines is a summary of one or more search results among the set of search results that have features that satisfy a particular interval among a plurality of intervals and the page value, each interval among the plurality of intervals fitting within a display page.
2. The method of claim 1, wherein the second criterion for selection of events is a keyword.
3. The method of claim 1, wherein one or more events in the set of search results is assigned a keyword relevance ranking.
receiving a duration of the time for the sets of events from a user.
displaying an interactive paging of the set of search results.
6. The method of claim 1, wherein the machine data includes raw log data.
7. The method of claim 1, wherein the machine data includes unstructured data.
a machine data transformation device, implemented at least partially in hardware, that creates, in real-time, a plurality of searchable events from machine data as the machine data is collected in real-time from one or more data sources, each event in the plurality of searchable events is segmented from the machine data and includes an associated portion of the machine data and an associated timestamp derived from the machine data;
wherein the machine data transformation device divides the plurality of events into sets of events that are organized by time;
wherein the machine data transformation device indexes the timestamped events;
wherein the machine data transformation device hashes each event in the sets of events, wherein each event is tested for duplication using its associated hash value, wherein an event having a hash value that is a duplicate of an existing hash value is removed;
a search receiver, implemented at least partially in hardware, that, as the plurality of events are being created in real-time, receives a search query that includes at least a time criterion, a second criterion for selection of events, and a] page value;
a search result generator, implemented at least partially in hardware, that generates a result set for an event search query by executing the event search query across the plurality of events, the event search query includes the time criterion and the second criterion for selection of events, the result set includes events that match the time criterion and have an associated portion of the machine data that fulfills the second criterion for selection of events;
a search result sorter, implemented at least partially in hardware, that sorts the result set according to time;
a display formatter, implemented at least partially in hardware, that causes display of a plurality of aggregated display lines, wherein each aggregated display line among the plurality of aggregated display lines is a summary of one or more search results among the set of search results that have features that satisfy a particular interval among a plurality of intervals and the page value, each interval among the plurality of intervals fitting within a display page.
9. The apparatus of claim 8, wherein the second criterion is a keyword.
10. The apparatus of claim 8, wherein one or more events in the set of search results is assigned a keyword relevance ranking.
a user input receiver, implemented at least partially in hardware, that receives a duration of the time for the sets of events from a user.
12. The apparatus of claim 8, wherein the machine data includes raw log data.
13. The apparatus of claim 8, wherein the display formatter displays an interactive paging of the set of search results.
14. The apparatus of claim 8, wherein the machine data includes unstructured data.
15. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
as the plurality of events are being created in real-time, receiving a search that includes at least a time criterion, a second criterion for selection of events, and a] page value;
16. The one or more non-transitory computer-readable storage media of claim 15, wherein the second criterion is a keyword.
17. The one or more non-transitory computer-readable storage media of claim 15, further comprising:
18. The one or more non-transitory computer-readable storage media of claim 15, wherein the one or more sequences of instructions, which when executed by the one or more processors cause further performance of:
19. The one or more non-transitory computer-readable storage media of claim 15, wherein the machine data includes raw log data.
20. The one or more non-transitory computer-readable storage media of claim 15, wherein the machine data includes unstructured data.
US15/008,428 2006-10-05 2016-01-27 Aggregation and display of search results from multi-criteria search queries on event data Active US9922066B2 (en)
US82828306P true 2006-10-05 2006-10-05
US11/868,370 US8112425B2 (en) 2006-10-05 2007-10-05 Time series search engine
US13/353,135 US9002854B2 (en) 2006-10-05 2012-01-18 Time series search with interpolated time stamp
US14/611,170 US9594789B2 (en) 2006-10-05 2015-01-30 Time series search in primary and secondary memory
US14/929,248 US9922065B2 (en) 2006-10-05 2015-10-30 Determining timestamps to be associated with events in machine data
US15/008,428 US9922066B2 (en) 2006-10-05 2016-01-27 Aggregation and display of search results from multi-criteria search queries on event data
US15/885,806 US20180157693A1 (en) 2006-10-05 2018-01-31 Aggregating Search Results from a Plurality of Searches Executed Across Time Series Data
US14/929,248 Continuation US9922065B2 (en) 2006-10-05 2015-10-30 Determining timestamps to be associated with events in machine data
US15/885,806 Continuation US20180157693A1 (en) 2006-10-05 2018-01-31 Aggregating Search Results from a Plurality of Searches Executed Across Time Series Data
US20160140128A1 US20160140128A1 (en) 2016-05-19
US9922066B2 true US9922066B2 (en) 2018-03-20
US11/868,370 Active 2029-06-11 US8112425B2 (en) 2006-10-05 2007-10-05 Time series search engine
US13/353,135 Active US9002854B2 (en) 2006-10-05 2012-01-18 Time series search with interpolated time stamp
US13/664,186 Active US8990184B2 (en) 2006-10-05 2012-10-30 Time series search engine
US14/611,170 Active US9594789B2 (en) 2006-10-05 2015-01-30 Time series search in primary and secondary memory
US14/815,980 Pending US20150339351A1 (en) 2006-10-05 2015-08-01 Search Query Processing Using Operational Parameters
US14/929,248 Active 2027-11-02 US9922065B2 (en) 2006-10-05 2015-10-30 Determining timestamps to be associated with events in machine data
US15/007,176 Active US9514175B2 (en) 2006-10-05 2016-01-26 Normalization of time stamps for event data
US15/008,428 Active US9922066B2 (en) 2006-10-05 2016-01-27 Aggregation and display of search results from multi-criteria search queries on event data
US15/008,425 Active US10216779B2 (en) 2006-10-05 2016-01-27 Expiration of persistent data structures that satisfy search queries
US15/339,887 Active US10255312B2 (en) 2006-10-05 2016-10-31 Time stamp creation for event data
US15/339,953 Active 2027-10-27 US10262018B2 (en) 2006-10-05 2016-11-01 Application of search policies to searches on event data stored in persistent data structures
US15/421,068 Abandoned US20170139963A1 (en) 2006-10-05 2017-01-31 Query-initiated search across separate stores for log data and data from a real-time monitoring environment
US15/420,985 Abandoned US20170139962A1 (en) 2006-10-05 2017-01-31 Unified time series search across both log data and data from a real-time monitoring environment
US15/421,416 Active US10242039B2 (en) 2006-10-05 2017-01-31 Source differentiation of machine data
US15/420,938 Active US9747316B2 (en) 2006-10-05 2017-01-31 Search based on a relationship between log data and data from a real-time monitoring environment
US15/661,260 Active US9996571B2 (en) 2006-10-05 2017-07-27 Storing and executing a search on log data and data obtained from a real-time monitoring environment
US15/661,268 Active US9928262B2 (en) 2006-10-05 2017-07-27 Log data time stamp extraction and search on log data real-time monitoring environment
US15/661,286 Active US9922067B2 (en) 2006-10-05 2017-07-27 Storing log data as events and performing a search on the log data and data obtained from a real-time monitoring environment
US15/883,588 Pending US20180173739A1 (en) 2006-10-05 2018-01-30 Storing events associated with a time stamp extracted from log data and performing a search on the events and data that is not log data
US15/883,552 Pending US20180225319A1 (en) 2006-10-05 2018-01-30 Storing log data and performing a search on the log data and data that is not log data
US15/885,806 Pending US20180157693A1 (en) 2006-10-05 2018-01-31 Aggregating Search Results from a Plurality of Searches Executed Across Time Series Data
US15/963,740 Pending US20180246919A1 (en) 2006-10-05 2018-04-26 Storing events derived from log data and performing a search on the events and data that is not log data
US16/264,618 Pending US20190171630A1 (en) 2006-10-05 2019-01-31 Determining Time Stamps in Machine Data Derived Events
US16/264,571 Pending US20190213180A1 (en) 2006-10-05 2019-01-31 Searching Packed Raw Data in Events Using Segment Lookup Data Structures
US16/264,587 Pending US20190163673A1 (en) 2006-10-05 2019-01-31 Applying time-based search phrases across event data
US16/264,610 Pending US20190171629A1 (en) 2006-10-05 2019-01-31 Segmenting machine data using token-based signatures
US (26) US8112425B2 (en)
EP (3) EP3493074A1 (en)
CN (2) CN102831214B (en)
WO (1) WO2008043082A2 (en)
US10216779B2 (en) 2006-10-05 2019-02-26 Splunk Inc. Expiration of persistent data structures that satisfy search queries
BR112012026750A2 (en) * 2010-04-30 2016-07-12 Thomson Licensing automatic image discovery and recommendation for television content displayed
CN102347851B (en) * 2010-07-29 2014-04-09 阿里巴巴集团控股有限公司 Event processing method and server thereof
US10311513B2 (en) * 2012-03-14 2019-06-04 Nasdaq Technology Ab Method and system for facilitating access to recorded data
SG11201508013YA (en) * 2013-03-29 2015-10-29 Cumulus Systems Inc Organizing and fast searching of data
US10324942B2 (en) * 2013-07-26 2019-06-18 Snap Inc. Segment data visibility and management in a distributed database of time stamped records
WO2016004594A2 (en) * 2014-07-09 2016-01-14 Splunk Inc. Managing datasets produced by alert-triggering search queries
US10019510B2 (en) * 2014-07-29 2018-07-10 Ca, Inc. Indexing and searching log records using templates index and attributes index
CN105808621B (en) * 2014-12-31 2019-06-04 北京奇虎科技有限公司 A kind of method and apparatus calculating response time search time
EP3249549A4 (en) * 2015-01-22 2018-10-24 Mitsubishi Electric Corporation Chronological data search device and chronological data search program
CN105989048A (en) * 2015-02-05 2016-10-05 浙江大华技术股份有限公司 Data record processing method, equipment and system
GB2536655B (en) * 2015-03-24 2017-09-20 Imagination Tech Ltd Logging events with timestamps
US10339467B2 (en) 2015-06-02 2019-07-02 International Business Machines Corporation Quantitative discovery of name changes
CN105005617B (en) * 2015-07-21 2018-10-12 领航动力信息系统有限公司 Method for storing time series data and means
US10049140B2 (en) * 2015-08-28 2018-08-14 International Business Machines Corporation Encoding system, method, and recording medium for time grams
US10248621B2 (en) 2016-02-09 2019-04-02 Moonshadow Mobile, Inc. Systems and methods for storing, updating, searching, and filtering time-series datasets
CN106294792B (en) * 2016-08-15 2019-05-31 上海携程商务有限公司 The method for building up of correlation inquiry system and establish system
US10169486B2 (en) * 2017-02-10 2019-01-01 Johnson Controls Technology Company Building management system with timeseries processing
WO2018236732A1 (en) * 2017-06-19 2018-12-27 Equifax, Inc. Machine-learning system for servicing queries for digital content
WO2018233823A1 (en) * 2017-06-21 2018-12-27 Huawei Technologies Co., Ltd. Systems and methods for data aging based management of data entries
WO2019099558A1 (en) * 2017-11-15 2019-05-23 Sumo Logic Cardinality of time series
US5745693A (en) 1992-07-01 1998-04-28 Mci Corporation System for gathering and reporting real time data from an IDNX communications network
US6490553B2 (en) 2000-05-22 2002-12-03 Compaq Information Technologies Group, L.P. Apparatus and method for controlling rate of playback of audio data
US20030018435A1 (en) 2001-05-15 2003-01-23 Jenner Edward Louis System for estimating azimuthal variations in seismic data
US20030141879A1 (en) 2002-01-30 2003-07-31 Wilsher Kenneth R. PICA system timing measurement & calibration
US20030204698A1 (en) 2002-04-29 2003-10-30 Aamer Sachedina Resizable cache sensitive hash table
US6658367B2 (en) 2001-03-28 2003-12-02 Hewlett-Packard Development Company, L.P. System for time-bucketing of baselined data collector data
EP1480100A1 (en) 2003-05-22 2004-11-24 Copyright Clearance Center, Inc. Method and apparatus for secure delivery and rights management of digital content
US20040243618A1 (en) 2003-05-30 2004-12-02 Oracle International Corp. Methods and systems for auto-partitioning of schema objects
US20050010564A1 (en) 2003-05-19 2005-01-13 Netezza Corporation Limiting scans of loosely ordered and/or grouped relations using nearly ordered maps
US20050080806A1 (en) 2003-10-08 2005-04-14 Doganata Yurdaer N. Method and system for associating events
US20050235356A1 (en) 2004-04-09 2005-10-20 Changzhou Wang System and method for analyzing a pattern in a time-stamped event sequence
US20050273281A1 (en) 2003-02-07 2005-12-08 Wall Daniel J System and method for power quality analytics
US20060085163A1 (en) 2004-10-06 2006-04-20 Nader M Ali G High-resolution, timer-efficient sliding window
US7084742B2 (en) 2003-11-26 2006-08-01 Ads Enterprises Nz Ltd. System and method for transmitting control information over an AC power network
US20060224254A1 (en) 2005-03-29 2006-10-05 Zarpac, Inc. Industrial process data acquisition and analysis
US20060265406A1 (en) 2005-05-20 2006-11-23 Microsoft Corporation Recognizing event patterns from event streams
US20070033632A1 (en) 2005-07-19 2007-02-08 March Networks Corporation Temporal data previewing system
US20070100873A1 (en) 2005-10-27 2007-05-03 Hitachi, Ltd. Information retrieving system
US7962489B1 (en) 2004-07-08 2011-06-14 Sage-N Research, Inc. Indexing using contiguous, non-overlapping ranges
US20130060783A1 (en) 2006-10-05 2013-03-07 Splunk Inc. Time series search engine
FR2751448B1 (en) 1996-07-17 1999-01-15 Bull Sa real-time monitoring Method for a computer system for its administration and aid maintenance during operation
US20050114331A1 (en) 2003-11-26 2005-05-26 International Business Machines Corporation Near-neighbor search in pattern distance spaces
JP4767165B2 (en) 2004-04-15 2011-09-07 パナソニック株式会社 Content generating device and method
US7673340B1 (en) 2004-06-02 2010-03-02 Clickfox Llc System and method for analyzing system user behavior
US20060008516A1 (en) * 2004-07-07 2006-01-12 Sebastiano Scarampi Gilsonite derived pharmaceutical delivery compositions and methods: cosmetic applications
US7369954B2 (en) 2005-03-17 2008-05-06 International Business Machines Corporation Event tracing with time stamp compression and history buffer based compression
US8266117B2 (en) * 2005-07-11 2012-09-11 Fujitsu Limited Method and apparatus for tracing data in audit trail, and computer product
EP2450763B1 (en) * 2005-07-26 2017-03-01 MacDonald, Dettwiler and Associates Inc. Global position and orientation estimation system for a vehicle in a passageway environment
WO2007022560A1 (en) 2005-08-23 2007-03-01 Position Networks Pty Ltd A stream-oriented database machine and method
US7925678B2 (en) 2007-01-12 2011-04-12 Loglogic, Inc. Customized reporting and mining of event data
US10133806B2 (en) 2014-07-31 2018-11-20 Splunk Inc. Search result replication in a search head cluster
EP3186477A4 (en) 2014-08-28 2018-03-28 Landmark Graphics Corporation Optimizing multistage hydraulic fracturing design based on three-dimensional (3d) continuum damage mechanics
2007-10-05 EP EP18203898.4A patent/EP3493074A1/en active Pending
2007-10-05 JP JP2009531632A patent/JP5264740B2/en active Active
2007-10-05 WO PCT/US2007/080616 patent/WO2008043082A2/en active Application Filing
2007-10-05 EP EP12159074A patent/EP2482209A1/en not_active Ceased
2007-10-05 CN CN201210293010A patent/CN102831214B/en active IP Right Grant
2007-10-05 KR KR1020127009888A patent/KR101380936B1/en active IP Right Grant
2007-10-05 US US11/868,370 patent/US8112425B2/en active Active
2007-10-05 EP EP20070853813 patent/EP2074505A4/en active Pending
2007-10-05 KR KR1020097009378A patent/KR101266267B1/en active IP Right Grant
2007-10-05 CN CN2007800448995A patent/CN101641674B/en active IP Right Grant
2012-01-18 US US13/353,135 patent/US9002854B2/en active Active
2012-10-30 US US13/664,186 patent/US8990184B2/en active Active
2015-01-30 US US14/611,170 patent/US9594789B2/en active Active
2015-08-01 US US14/815,980 patent/US20150339351A1/en active Pending
2015-10-30 US US14/929,248 patent/US9922065B2/en active Active
2016-01-26 US US15/007,176 patent/US9514175B2/en active Active
2016-01-27 US US15/008,428 patent/US9922066B2/en active Active
2016-01-27 US US15/008,425 patent/US10216779B2/en active Active
2016-10-31 US US15/339,887 patent/US10255312B2/en active Active
2016-11-01 US US15/339,953 patent/US10262018B2/en active Active
2017-01-31 US US15/421,068 patent/US20170139963A1/en not_active Abandoned
2017-01-31 US US15/420,985 patent/US20170139962A1/en not_active Abandoned
2017-01-31 US US15/421,416 patent/US10242039B2/en active Active
2017-01-31 US US15/420,938 patent/US9747316B2/en active Active
2017-07-27 US US15/661,260 patent/US9996571B2/en active Active
2017-07-27 US US15/661,268 patent/US9928262B2/en active Active
2017-07-27 US US15/661,286 patent/US9922067B2/en active Active
2018-01-30 US US15/883,588 patent/US20180173739A1/en active Pending
2018-01-30 US US15/883,552 patent/US20180225319A1/en active Pending
2018-01-31 US US15/885,806 patent/US20180157693A1/en active Pending
2018-04-26 US US15/963,740 patent/US20180246919A1/en active Pending
2019-01-31 US US16/264,618 patent/US20190171630A1/en active Pending
2019-01-31 US US16/264,571 patent/US20190213180A1/en active Pending
2019-01-31 US US16/264,587 patent/US20190163673A1/en active Pending
2019-01-31 US US16/264,610 patent/US20190171629A1/en active Pending
US7895167B2 (en) 2005-02-16 2011-02-22 Xpolog Ltd. System and method for analysis and management of logs and events
US8990184B2 (en) 2006-10-05 2015-03-24 Splunk Inc. Time series search engine
US9002854B2 (en) 2006-10-05 2015-04-07 Splunk Inc. Time series search with interpolated time stamp
US20170139968A1 (en) 2006-10-05 2017-05-18 Splunk Inc. Source differentiation of machine data
US20150339351A1 (en) 2006-10-05 2015-11-26 Splunk Inc. Search Query Processing Using Operational Parameters
US20160070736A1 (en) 2006-10-05 2016-03-10 Splunk Inc. Determining Timestamps To Be Associated With Events In Machine Data
US20160140238A1 (en) 2006-10-05 2016-05-19 Splunk Inc. Normalization of Time Stamps for Event Data
US20160154836A1 (en) 2006-10-05 2016-06-02 Splunk Inc. Expiration of Persistent Data Structures That Satisfy Search Queries
US20170046403A1 (en) 2006-10-05 2017-02-16 Splunk Inc. Application of search policies to searches on event data stored in persistent data structures
US20170046402A1 (en) 2006-10-05 2017-02-16 Splunk Inc. Time stamp creation for event data
US20150149480A1 (en) 2006-10-05 2015-05-28 Splunk Inc. Time series search in primary and secondary memory
"A Data Model and Data Structures for Moving Objects Databases," Sigmod Record, ACM, New York, NY, US, vol. 29, No. 2.
"Indexing Techniques for Historical Database".
"Query Processing for Temporal Databases", Proceedings of the International Conference on Data Engineering. Los Angeles Feb. 5-9, 1990.
Chinese Patent Office, Application No. 201210293010.X, Foreign Office Action dated May 4, 2016.
Chinese Patent Office, Application No. 201210293010.X, Foreign Office Action dated Oct. 27, 2015.
Chinese Patent Office, Application No. 201210293010.X, Pending Claims as of May 4, 2016.
Chinese Patent Office, Application No. 201210293010.X, Pending Claims as of Oct. 27, 2015.
European Patent Office, Application No. 07853813.9, Foreign Office Action dated Nov. 24, 2015.
European Patent Office, Application No. 07853813.9, Pending Claims as of Nov. 24, 2015.
European Patent Office, Application No. 12159074.9, Foreign Office Action dated Jun. 23, 2015.
European Patent Office, Application No. 12159074.9, Pending Claims as of Jun. 23, 2015.
United States Patent and Trademark Office, U.S. Appl. No. 13/353,135, Advisory Action dated Aug. 25, 2014, dated Aug. 25, 2014.
United States Patent and Trademark Office, U.S. Appl. No. 13/353,135, Final Office Action dated Jul. 25, 2014, dated Jul. 25, 2014.
United States Patent and Trademark Office, U.S. Appl. No. 13/353,135, Non-Final Office Action dated Feb. 26, 2014, dated Feb. 26, 2014.
United States Patent and Trademark Office, U.S. Appl. No. 13/664,186, Final Office Action dated Jul. 9, 2014, dated Jul. 9, 2014.
United States Patent and Trademark Office, U.S. Appl. No. 14/611,170, Non-Final Office Action dated Jun. 2, 2016, dated Jun. 2, 2016.
United States Patent and Trademark Office, U.S. Appl. No. 14/611,170, Notice of Allowance dated Nov. 16, 2016, dated Nov. 16, 2016.
United States Patent and Trademark Office, U.S. Appl. No. 14/815,980, Advisory Action dated Apr. 3, 2017, dated Apr. 3, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 14/815,980, Final Office Action dated Jan. 18, 2017, dated Jan. 18, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 14/815,980, Non-Final Office Action dated Jul. 15, 2016, dated Jul. 15, 2016.
United States Patent and Trademark Office, U.S. Appl. No. 14/815,980, Non-Final Office Action dated Jul. 26, 2017, dated Jul. 26, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 14/929,248, Final Office Action dated Jul. 18, 2017, dated Jul. 18, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 14/929,248, Non-Final Office Action dated Mar. 22, 2017, dated Mar. 22, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 15/007,176, Non-Final Office Action dated Apr. 22, 2016, dated Apr. 22, 2016.
United States Patent and Trademark Office, U.S. Appl. No. 15/007,176, Notice of Allowance dated Oct. 3, 2016, dated Oct. 3, 2016.
United States Patent and Trademark Office, U.S. Appl. No. 15/008,425, Advisory Action dated Mar. 29, 2017, dated Mar. 29, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 15/008,425, Final Office Action dated Jan. 31, 2017, dated Jan. 31, 2017.
United States Patent and Trademark Office, U.S. Appl. No. 15/008,425, Non-Final Office Action dated Aug. 9, 2016, dated Aug. 9, 2016.
United States Patent and Trademark Office, U.S. Appl. No. 15/008,425, Non-Final Office Action dated Aug. 9, 2017, dated Aug. 9, 2017.
US10242039B2 (en) 2006-10-05 2019-03-26 Splunk Inc. Source differentiation of machine data
US10255312B2 (en) 2006-10-05 2019-04-09 Splunk Inc. Time stamp creation for event data
US10262018B2 (en) 2006-10-05 2019-04-16 Splunk Inc. Application of search policies to searches on event data stored in persistent data structures
EP2074505A4 (en) 2010-01-13
US20190163673A1 (en) 2019-05-30
CN102831214A (en) 2012-12-19
US9747316B2 (en) 2017-08-29
US20150339351A1 (en) 2015-11-26
US8990184B2 (en) 2015-03-24
US9002854B2 (en) 2015-04-07
US9922067B2 (en) 2018-03-20
KR20120059625A (en) 2012-06-08
US9928262B2 (en) 2018-03-27
KR20090080065A (en) 2009-07-23
US20170139962A1 (en) 2017-05-18
KR101266267B1 (en) 2013-05-23
EP2482209A1 (en) 2012-08-01
CN102831214B (en) 2017-05-10
EP2074505A2 (en) 2009-07-01
US20160070736A1 (en) 2016-03-10
US20150149480A1 (en) 2015-05-28
US20170046403A1 (en) 2017-02-16
US20180173739A1 (en) 2018-06-21
JP5264740B2 (en) 2013-08-14
CN101641674B (en) 2012-10-10
US9514175B2 (en) 2016-12-06
KR101380936B1 (en) 2014-04-10
US20160140238A1 (en) 2016-05-19
US20160154836A1 (en) 2016-06-02
US20170046402A1 (en) 2017-02-16
CN101641674A (en) 2010-02-03
US10216779B2 (en) 2019-02-26
US20080215546A1 (en) 2008-09-04
US20190213180A1 (en) 2019-07-11
US10262018B2 (en) 2019-04-16
WO2008043082A2 (en) 2008-04-10
US20170344591A1 (en) 2017-11-30
EP3493074A1 (en) 2019-06-05
US10255312B2 (en) 2019-04-09
JP2010506311A (en) 2010-02-25
US20170139968A1 (en) 2017-05-18
US20170139963A1 (en) 2017-05-18
US20170337231A1 (en) 2017-11-23
US20180225319A1 (en) 2018-08-09
US20160140128A1 (en) 2016-05-19
US20170139961A1 (en) 2017-05-18
US20190171629A1 (en) 2019-06-06
WO2008043082A3 (en) 2009-04-09
US9922065B2 (en) 2018-03-20
US20130060783A1 (en) 2013-03-07
US20120117079A1 (en) 2012-05-10
US20170337230A1 (en) 2017-11-23
US9996571B2 (en) 2018-06-12
US10242039B2 (en) 2019-03-26
US8112425B2 (en) 2012-02-07
US20180157693A1 (en) 2018-06-07
US20190171630A1 (en) 2019-06-06
US9594789B2 (en) 2017-03-14
US20180246919A1 (en) 2018-08-30
US7065523B2 (en) 2006-06-20 Scoping queries in a search engine
US8176069B2 (en) 2012-05-08 Systems and methods for improved web searching
JP4881322B2 (en) 2012-02-22 Information retrieval system based on multiple index
US9128985B2 (en) 2015-09-08 Supplementing a high performance analytics store with evaluation of individual events to respond to an event query
US9607085B2 (en) 2017-03-28 Hierarchical diff files
US8260785B2 (en) 2012-09-04 Automatic object reference identification and linking in a browseable fact repository
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BAUM, MICHAEL J.;CARASSO, DAVID;DAS, ROBIN K.;AND OTHERS;SIGNING DATES FROM 20080403 TO 20080417;REEL/FRAME:044440/0457