Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for performing a data sync operation are described. A described technique includes receiving an indication to start a data synchronization between a first version of a computer design model and a second version of the computer design model. In some implementations, first data is extracted from the first version and second data is extracted from the second version. The first data is compared with the second data. Based on the comparison, the first data is updated using the second data, the second data is updated using the first data, or the first data is updated using the second data and the second data is updated using the first data. A geospatial representation is generated using at least one of the updated second data or the updated first data.

Abstract: System and method for processing time-related geospatial data from one or more data sources. For example, a system includes an application server; and a storage. The application server is configured to: receive data including temporal information and geospatial information for each data object of one or more data objects, send the data to a client device to display the data on a map, and generate one or more first multi-dimensional tiles based at least in part on the temporal information and the geospatial information. The one or more first multi-dimensional tiles correspond to a temporal dimension associated with a first temporal width. The application server is further configured to send the one or more first multi-dimensional tiles to store in the storage for retrieval by the client device.

Abstract: One or more computer processors classify each log line in a plurality of unlabeled log lines as an erroneous log line or a non-erroneous log line. The one or more computer processors templatize each classified erroneous log line and non-erroneous log line in the plurality of unlabeled log lines. The one or more computer processors cluster erroneous log templates into erroneous log template clusters and the non-erroneous log templates into non-erroneous log template clusters. The one or more computer processors eliminate the erroneous log template clusters and the non-erroneous log template clusters that exceed a frequency threshold. The one or more computer processors train a log anomaly model utilizing=remaining erroneous log template clusters and remaining non-erroneous log template clusters. The one or more computer processors identify a subsequent log line as anomalous or non-anomalous utilizing the trained log anomaly model.

Abstract: A processing device receives a first query comprising a first field value and a first time period. The processing device performs a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value. The processing device generates a first search object comprising the first field value. The processing device generates a search event comprising the first field value and a reference to the first search object. An event entry for the first search event is then written to the data store. Future searches may return both the first search event and other events.

Abstract: Disclosed herein are applications and platforms for streamlined production of charts and reports from databases containing time series datasets and/or timestamped data. The applications described herein may employ dynamically retrieve data from data centers to quickly provide options to the user. The platform further allows configuration of the charts and/or reports by providing lists of metrics that may be available in the selected data, and lists of transforms that may be applied to the data. The application may employ dynamic user interfaces, which provide processing of the received time series datasets in a data agnostic manner. As a result, the systems and methods described herein may allow generating charts and reports using a streamlined workflow.

Abstract: A record processing and storage system is operable to receive a plurality of row data that each indicate a batch number. Each of the plurality of row data is added to a pending row data pool. A plurality of pages is generated from the plurality of row data via a plurality of processing core resources. Each processing core resource in the plurality of processing core resources processing a corresponding subset of the plurality of row data by retrieving, in each time slice of a plurality of time slices, one row data from the pending row data pool with a most favorably ordered batch number of row data in the pending row data pool. Each processing core resource further processes the one row data in the in each time slice to participate in generation of at least one of the plurality of pages.

Abstract: According to one embodiment, An apparatus for preprocessing a security log includes a field divider configured to divide a character string of a security log into a plurality of fields on the basis of a structure of the security log, an ASCII code converter configured to convert a character string included in each of the plurality of divided fields into ASCII codes, and a vector data generator configured to generate vector data for each of the plurality of divided fields using the converted ASCII codes.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: Embodiments collect, from an event stream having both client-side and server-side information from multiple tracking sources, user interaction records for a web application and supporting systems. The records are stored in a data store, and are retroactively correlated with conclusive user identifiers and, if applicable, with areas of interest. Attribution of interaction records to conclusive identifiers and areas of interest is based on links that have been established between identifiers. Established identifier links may be subject to one or more link removal criteria. If link removal criteria is satisfied for an established link, the link is broken. Once a link is broken, interaction records, found in the data store, that are associated with the inconclusive identifier of the broken link are no longer associated with the conclusive identifier of the broken link. Each interaction record that is associated with a conclusive identifier is assigned a confidence metric for the association.

Abstract: Cloning enterprise content management systems is described. A first remote procedure call is executed to a source database management system associated with a source enterprise content management system to retrieve a source object type from the source enterprise content management system. A second remote procedure call is executed to a target database management system associated with a target enterprise content management system to create a target object type in the target enterprise content management system, wherein the target object type is based on the source object type. Source metadata tables associated with the source object type are retrieved from the source enterprise content management system. The source metadata tables are stored as target metadata tables in the target enterprise content management system.

Abstract: Embodiments of the present invention relate to methods, systems, and computer program products for event management. In a method, a plurality of notes that are comprised in a plurality of event records are obtained in a computer system. A plurality of paragraphs that are comprised in the plurality of notes are classified into a plurality of content types based on a content analysis of the plurality of paragraphs. The plurality of notes are classified into a plurality of semantic types based on the plurality of content types and a syntactic parsing to the plurality of notes. A knowledge item is generated for managing an event in the computer system based on a group of notes in the plurality of notes that are classified into the plurality of semantic types. With these embodiments, knowledge items for managing events may be obtained in an easier and more effective way.

Abstract: An exemplary query parsing system accesses user input text representative of a search query. The system generates a plurality of candidate parses of the user input text. Each of the plurality of candidate parses includes a candidate what portion and a candidate where portion determined from the user input text. The system generates a score for each candidate parse in the plurality of candidate parses based on whether one or more of a plurality of predefined parsing features are found in the respective candidate parse and on a machine learning mode. The system selects, from the plurality of candidate parses based on the scores for the plurality of candidate parses, the candidate what portion and the candidate where portion of a particular candidate parse included in the plurality of candidate parses as search parameters for the search query. Corresponding methods and systems are also disclosed.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include receiving a data object at an assigned node, determining whether the data object includes a sub-data object, and processing the sub-data object. The assigned node is a node of a plurality of nodes of a cluster, where the data object includes a data segment, and a signature. The signature is generated based, at least in part, on data of the data segment. The processing includes sending the sub-data object to a remote node. The remote node is another node of the plurality of nodes of the cluster.

Abstract: A record processing and storage system is operable to receive a plurality of labeled row data from a data source. Each labeled row data of the plurality of labeled row data includes at least one record and a corresponding row number of a plurality of row numbers. A plurality of pages are generated from records included in the labeled row data. The plurality of pages are stored via a page storage system. A plurality of page metadata corresponding to the plurality of pages is generated, where each of the plurality of page metadata is generated based on at least corresponding one row number of at least one labeled row data with records included in a corresponding one of the plurality of pages. Deduplication of duplicated records included the plurality of pages is facilitated based on the plurality of page metadata.

Abstract: Systems and methods are disclosed to implement a contextual comparison of machine registry hive files. In embodiments, the comparison process is implemented by a data collection agent that periodically uploads changes in a client machine registry to a machine assessment service. During a data collection, the agent compares a binary hive file generated from the current state of the registry with another binary hive file generated in the last period. The differences are captured in a text-encoded patch file, which is used to update a snapshot of the registry maintained by the machine assessment service. The comparison is performed directly on the two binary hive files without converting them into text files, so that the process can be performed more quickly and using less compute bandwidth. Moreover, the comparison process can be extended to implement a variety of custom behaviors based on the contents of the hive files.

Abstract: A method includes logging first user interactions associated with a playlist of content items and generating first metrics based on the logged first user interactions with the playlist. The first metrics include a first metric indicating a first duration of playback of a first content item of the playlist during playback of the playlist. The first duration of playback of the first content item during the playback of the playlist is greater than a first default duration of playback. The method further includes reporting at least the first metric to a creator or curator of the playlist, logging second user interactions associated with the playlist, and generating second metrics based on the logged second user interactions with the playlist. The logged first user interactions correspond to more deviations from a default playback sequence of the playlist than the logged second user interactions.

Abstract: Methods, systems and computer program products are provided for transaction log validation in a database transaction log service. A transaction log service may perform egress validation to confirm transaction logs match previously served transaction logs and are free of corruption. A transaction log service may determine whether a transaction log (e.g., in the form of a log block) was previously served based on transaction log (e.g., log block) identity indicating a position in a logical stream of transaction logs (e.g., log blocks). Egress validation may improve log service reliability by providing an added layer of defense against corruption of a transaction log payload.

Abstract: Systems and methods are provided for improved web searching. In one implementation, suggested search queries am provided based on previous search queries and click data. A weighted bi-partite graph or index may be used to identify related search queries based on overlapping clicked URLs. According to a method, query-click log data of a search engine is processed to generate sets of suggested search queries, data corresponding to each suggested search query, and a set of clicked URLs related to each suggested search query. Additionally, or independently, methods may be provided for contextually correcting spelling errors within sets of suggested search queries using a contextual algorithm, and/or identifying and discarding sets of suggested search queries and URLs that lead to restricted material, such as restricted content and related URLs.

Abstract: Some examples relate generally to managing and storing data, and more specifically to the real-time detection of ransomware, system (or insider) threats, or the misappropriation of credentials by using file system audit events.

Abstract: An aircraft computer file distribution system comprises a store (36) of aircraft computer files for loading into at least one aircraft device (12) that is onboard, mobile or replicated on the ground. The system includes a file manager (44), configured for identifying an aircraft configuration of the aircraft with which the aircraft device (12) is associated and a computer configuration of the aircraft device (12); defining, among the computer files in the computer file store (36), at least one computer file loadable into the aircraft device (12) according to the identified aircraft configuration and computer configuration; and activating a synchronization for remote distribution of at least one computer file to be loaded into the aircraft device (12) selected from the one or more computer files loadable into the aircraft device (12) based on the identified aircraft configuration and computer configuration.