Interactive Parallel Coordinates for Machine Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing and searching massive quantities of machine-generated data poses challenges due to its vast volume and varied formats, with existing tools often discarding non-preprocessed data and limiting analysis flexibility.
Innovation Solution
The implementation of an event-based data intake and query system, such as the SPLUNK® ENTERPRISE system, which stores minimally processed machine data for later retrieval, using a late-binding schema to facilitate flexible analysis and visualization through interactive visualizations like parallel coordinates charts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If pre-specified data items are extracted and stored in a database during pre-processing, then retrieval and analysis efficiency is improved, but data flexibility and analysis scope are reduced
Solution Approach 1:
The system performs preliminary indexing and metadata extraction on machine data during ingestion, organizing data into a searchable structure without discarding the original minimally processed data. This allows efficient retrieval through indexes while maintaining access to the complete data set for flexible analysis.
Solution Approach 2:
The patent introduces an intermediary layer between data storage and analysis that includes indexes, metadata, and a query processing engine. This intermediary enables efficient data retrieval and flexible analysis simultaneously by translating user queries into optimized search operations without requiring pre-aggregation or pre-processing of the actual data.
2Adaptability or versatility
If massive quantities of minimally processed machine data are stored for later retrieval, then data flexibility and analysis scope are improved, but data processing complexity and resource requirements increase
Solution Approach 1:
The system segments machine data into discrete events with structured metadata, organizing the massive data volume into manageable units. Each event is indexed separately, allowing the system to handle large quantities of data through modular processing while maintaining simplicity in query operations.
Solution Approach 2:
The patent replaces complex mechanical data processing approaches with an event-driven architecture that uses software-based indexing and query processing. This substitution enables the system to manage massive data volumes through efficient algorithms and data structures rather than relying on complex hardware processing systems.
3Ease of operation
If interactive visualizations are implemented for machine data analysis, then user understanding and insight generation are improved, but system complexity and development effort increase
Solution Approach 1:
The system implements a universal visualization framework that can render multiple types of interactive visualizations (timelines, histograms, scatter plots, parallel coordinates) using a common architecture. This multi-functional approach enables diverse data analysis needs to be met through a single system rather than requiring separate visualization tools for each analysis type.
Solution Approach 2:
The visualizations implemented in the system are dynamic and interactive, allowing users to filter, zoom, and explore data relationships in real-time. The parallel coordinates visualization specifically enables dynamic exploration of multi-dimensional data relationships, where users can interactively adjust parameters and immediately see updated visualizations without system reconfiguration.
Data Source
AI summary
Disclosed are a system and a method for providing user-interactive parallel coordinates charts. In an embodiment, a machine data search and analysis system retrieves search results including a plurality of events, each of the events containing time-stamped data in response to a search query. The system identifies a plurality of characteristics from the data corresponding to the events. The system causes display of a multiple-dimensional chart (e.g., a parallel coordinates chart) depicting the data corresponding to the events. The multiple-dimensional chart includes a plurality of axes. Each of the axes corresponds to one of the identified characteristics. The multiple-dimensional chart further includes a plurality of poly lines representing the events. Each of the poly lines includes a plurality of vertices on the axes.