US 11,733,982 B1
Dynamically changing input data streams processed by data stream language programs
Rajesh Raman, Palo Alto, CA (US); Arijit Mukherji, Fremont, CA (US); Kris Grandy, San Carlos, CA (US); and Phillip Liu, Palo Alto, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Feb. 12, 2021, as Appl. No. 17/175,330.
Application 17/175,330 is a continuation of application No. 15/697,451, filed on Sep. 7, 2017, granted, now 10,949,180.
Application 15/697,451 is a continuation of application No. 14/970,451, filed on Dec. 15, 2015, granted, now 9,760,353, issued on Sep. 12, 2017.
Claims priority of provisional application 62/094,935, filed on Dec. 19, 2014.
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 16/2455 (2019.01); G06F 11/34 (2006.01); G06F 11/30 (2006.01); G06F 9/54 (2006.01); G06F 8/41 (2018.01); G06F 16/16 (2019.01); G06F 11/07 (2006.01); G06F 9/46 (2006.01); G06F 11/36 (2006.01)
CPC G06F 8/443 (2013.01) [G06F 9/466 (2013.01); G06F 9/542 (2013.01); G06F 11/07 (2013.01); G06F 11/3086 (2013.01); G06F 11/34 (2013.01); G06F 11/3452 (2013.01); G06F 11/3466 (2013.01); G06F 11/3604 (2013.01); G06F 16/164 (2019.01); G06F 16/24568 (2019.01); G06F 11/3006 (2013.01); G06F 11/3072 (2013.01); G06F 11/3409 (2013.01); G06F 2201/81 (2013.01); G06F 2201/835 (2013.01); G06F 2201/86 (2013.01); G06F 2201/88 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for processing a dynamically changing set of data streams, the method comprising:
receiving a set of instructions comprising at least a find block associated with a search expression, the search expression based at least in part on an attribute that describes multiple data streams and evaluate the search expression to identify the data streams conforming to the search expression, the data streams providing data generated by instrumented software;
executing the find block, during a time interval determined based on a periodicity associated with the find block, to determine a set of data streams from the data streams that satisfies the search expression;
selecting, from the data streams, a data stream that has a largest periodic time interval that is smaller than the time interval based on the periodicity associated with the find block;
generating one or more result data values based on the executing, the result data values corresponding to the data stream;
causing display of the data streams through a user interface, wherein the data streams are associated with a publish block, the publish block associated with a metric name; and
for each data stream:
utilizing the metric name of the publish block as an attribute describing the data stream, and
storing the attribute based on the metric name with metadata describing the data stream.