US 11,726,990 B2
Efficient updating of journey instances detected within unstructured event data
Akash Dwivedi, San Francisco, CA (US); Himanshu Gupta, Vancouver (CA); and Eric Tschetter, Redwood City, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Oct. 18, 2021, as Appl. No. 17/451,300.
Application 17/451,300 is a continuation of application No. 16/735,520, filed on Jan. 6, 2020, granted, now 11,151,125.
Claims priority of provisional application 62/923,409, filed on Oct. 18, 2019.
Prior Publication US 2022/0043807 A1, Feb. 10, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 16/23 (2019.01); G06F 16/248 (2019.01); G06F 9/54 (2006.01); G06F 16/2458 (2019.01); G06F 16/25 (2019.01); G06F 16/22 (2019.01)
CPC G06F 16/2379 (2019.01) [G06F 9/54 (2013.01); G06F 16/221 (2019.01); G06F 16/248 (2019.01); G06F 16/2477 (2019.01); G06F 16/258 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
executing, on a data store of unstructured event data, a query for instances of a journey representing a series of steps;
obtaining, in response to the query, query results representing one or more complete journey instances, each of the one or more complete journey instances representing a series of events conforming to an entirety of the series of steps; and
updating a structured data store with the query results obtained from the unstructured event data, wherein the structured data store is configured to store each journey instance as a distinct data entry within the structured data store, and wherein updating the structured data store comprises replacing an existing data entry within the structured data store representing a partial journey instance, representing at least one event conforming to a beginning of the series of steps and less than the entirety of the series of steps, with a new data entry representing a complete journey instance corresponding to the partial journey instance.