US 11,789,943 B1
Configuring alerts for tags associated with high-latency and error spans for instrumented software
Gergely Danyi, San Jose, CA (US); Steven Flanders, Nashua, NH (US); Joseph Ari Ross, Redwood City, CA (US); Justin Smith, San Francisco, CA (US); Eric Wohlstadter, Atherton, CA (US); and Chengyu Yang, Menlo Park, CA (US)
Assigned to SPLUNK Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on May 31, 2022, as Appl. No. 17/829,141.
Application 17/829,141 is a continuation of application No. 16/858,477, filed on Apr. 24, 2020, granted, now 11,379,475.
Application 16/858,477 is a continuation in part of application No. 16/757,354, previously published as PCT/US2019/058398, filed on Oct. 28, 2019.
Claims priority of provisional application 62/751,486, filed on Oct. 26, 2018.
Int. Cl. G06F 16/245 (2019.01); G06F 11/34 (2006.01); G06F 11/30 (2006.01)
CPC G06F 16/245 (2019.01) [G06F 11/302 (2013.01); G06F 11/3495 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method of analyzing spans and traces associated with a microservices-based application executing in a distributed computing environment, the method comprising:
receiving, from a plurality of instances of instrumented software, a plurality of spans;
aggregating the plurality of spans into a plurality of traces, wherein each of the plurality of traces includes all spans carried out in servicing a single request, and each of the plurality of traces includes a plurality of tags, each of the plurality of tags including a key-value pair indicating a characteristic of the trace;
determining, from the plurality of traces, a set of related traces, the set of related traces including traces associated with a same type of request;
determining, for each of the plurality of tags:
a first distribution for the tag, the first distribution including a distribution of durations for all traces within the set of related traces that have the tag,
a second distribution for the tag, the second distribution including a distribution of durations for all traces within the set of related traces that do not have the tag, and
a distribution difference for the tag, including a difference between the first distribution for the tag and the second distribution for the tag;
determining one or more tags of the plurality of tags that are associated with traces having a duration distribution greater than a predetermined threshold, based on a comparison of the distribution differences for each of the plurality of tags; and
displaying a notification associated with the determined one or more tags.