Visually Distinct Display Format for Interleaved Event Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern data centers face challenges in processing and analyzing large volumes of heterogeneous, unstructured performance data due to difficulties in applying semantic meaning and indexing, leading to inefficiencies in data retrieval and interpretation.
Innovation Solution
The implementation of an event-based system, such as the SPLUNK® ENTERPRISE system, which stores and processes data as 'events' using a late-binding schema, allowing for flexible extraction of information and visualization in a visually distinct display format to aid in searching and analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If data is maintained in unstructured form to preserve more data for later use, then data completeness is improved, but indexing and searching operations become difficult
Solution Approach 1:
The patent segments unstructured data into discrete events with specific fields and attributes. Each event is parsed into structured components (timestamp, source, event type, parameters) while preserving the original unstructured content. This segmentation enables indexing of specific fields while maintaining data completeness.
Solution Approach 2:
The patent introduces an event schema as an intermediary layer between raw unstructured data and structured storage. The schema defines field extractions and transformations that convert unstructured data into a semi-structured event format, enabling both data preservation and efficient querying through the intermediary representation.
2Adaptability or versatility
If large volumes of machine-generated data are processed, then data analysis capability is improved, but processing efficiency deteriorates
Solution Approach 1:
The patent performs preliminary actions during data ingestion by automatically parsing, validating, and extracting fields from raw data according to predefined schemas. This preliminary processing organizes data into structured events with indexed fields, enabling efficient subsequent analysis without reprocessing raw data.
Solution Approach 2:
The patent changes parameters of data representation by transforming unstructured data into structured events with specific fields, data types, and validation rules. This parameter transformation enables efficient filtering, aggregation, and analysis operations while maintaining the ability to handle diverse data sources.
3Loss of information
If search results are presented in traditional format, then completeness of information is improved, but user interpretation difficulty increases
Solution Approach 1:
The patent applies local quality by presenting different portions of search results in different visual formats based on their relevance and type. Critical events are highlighted with distinct visual properties (color, icons, layout) while less critical information is presented in standard formats, enabling users to quickly identify important information without losing data completeness.
Solution Approach 2:
The patent uses color changes to differentiate event types, severity levels, and sources in search results. Visual distinctions through color coding enable users to rapidly interpret large volumes of data by category and priority while maintaining access to complete information through expandable details and raw data views.
Data Source
AI summary
A request is received to display at least a portion of a first events set and at least a portion of a second events set in an interleaved and visually distinct display format, where, in the interleaved and visually distinct display format, the at least a portion of the first events set is displayed in a visually distinct manner from the at least a portion of the second events set, and data from the at least a portion of the first events set is interleaved with data from the at least a portion of the second events set. In response to receiving the request, display is caused, on a user interface, of the at least a portion of the first events set and the at least a portion of the second events set in the interleaved and visually distinct display format.