US 11,947,556 B1
Computerized monitoring of a metric through execution of a search query, determining a root cause of the behavior, and providing a notification thereof
Ricky Gene Burnett, Davis, CA (US); Dipock Das, San Carlos, CA (US); Steven Shaun McIntyre, Queen Creek, AZ (US); and Darrell Sano, Oakland, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by SPLUNK Inc., San Francisco, CA (US)
Filed on Aug. 18, 2022, as Appl. No. 17/891,005.
Application 17/891,005 is a continuation of application No. 16/147,375, filed on Sep. 28, 2018, granted, now 11,429,627, issued on Aug. 30, 2022.
Int. Cl. G06F 16/248 (2019.01); G06F 16/242 (2019.01); G06F 16/2455 (2019.01); G06F 16/2458 (2019.01); G06F 16/25 (2019.01); G06F 16/28 (2019.01)
CPC G06F 16/248 (2019.01) [G06F 16/243 (2019.01); G06F 16/24568 (2019.01); G06F 16/2477 (2019.01); G06F 16/252 (2019.01); G06F 16/288 (2019.01)] 17 Claims
OG exemplary drawing
 
1. A computerized method comprising:
receiving user input corresponding to generation of a nodal graph through placement of a plurality of nodes on a display panel and placement of relationship data indicating relationships between the plurality of nodes, wherein each node is associated with a search query and a data source;
monitoring a metric associated with a first node of the plurality of nodes through execution of a first search query associated with the first node;
identifying a trend of the first metric based on an analysis of the first metric over a specified time period;
identifying an anomalous event associated with the trend of the first metric during the specified time period based on a threshold comparison of results of the execution of the first search query and a predetermined threshold; and
determining a root cause of the anomalous event through a root cause analysis of the nodal graph, wherein the root cause analysis includes (i) determining a set of candidate nodes, wherein a candidate node represents a possible root cause and is a descendant node of the first node, (ii) applying a separate trained machine learning model to search query results associated with each candidate node resulting in an indication of a likelihood that each candidate node is the root cause, and (iii) ranking the set of candidate nodes based on results of applying the trained machine learning model to the to search query results.