US 11,669,551 B2
Rule-based data stream processing
Alexander Douglas James, Sammamish, WA (US); Shyam Mundhra, Pleasanton, CA (US); Manikandan Vellore Muneeswaran, San Jose, CA (US); Arun Ramani, Bellevue, WA (US); Thor Taylor, Stockton, CA (US); and Steve Zhang, San Francisco, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Oct. 16, 2020, as Appl. No. 17/72,833.
Prior Publication US 2022/0121689 A1, Apr. 21, 2022
Int. Cl. G06F 16/28 (2019.01); G06F 16/2455 (2019.01); G06F 16/2453 (2019.01); G06F 9/30 (2018.01)
CPC G06F 16/287 (2019.01) [G06F 9/30079 (2013.01); G06F 16/24534 (2019.01); G06F 16/24564 (2019.01); G06F 16/24568 (2019.01)] 19 Claims
OG exemplary drawing
 
1. A method implemented by one or more processing devices of a computer system, the method comprising:
receiving, by the computer system, an input data stream comprising raw machine data;
processing the raw machine data by a data processing pipeline that produces transformed machine data, wherein the data processing pipeline comprises an ordered plurality of pipeline stages, wherein a pipeline stage of the ordered plurality of pipeline stages applies a rule of a set of rules to an input of the pipeline stage, wherein the rule specifies an action to be performed on the input of the pipeline stage responsive to evaluating a conditional expression applied to the input of the pipeline stage, wherein the action generates an output of the pipeline stage, and wherein,—responsive to determining that two or more conditional expressions match one or more data points of the input of the pipeline stage, the pipeline stage creates two or more copies of the one or more data points;
performing, by the computer system, one or more subsequent pipeline stages of the plurality of pipeline stages on each copy of the two or more copies of the one or more data points, by invoking rules having the conditional expressions matching respective copies of the one or more data points; and
supplying, by the computer system, the transformed machine data to a data collection, indexing, and visualization system.