Abstract: The present disclosure relates to identifying process flows from log sources (e.g., log files), and generating visual representations (e.g., flow diagrams, Sankey diagrams, etc.) of the identified process flows. In addition, the present disclosure relates to clustering of tree structures based on the shape of the tree structure using one or more hashing algorithms. The present disclosure also relates to a user interface that presents a query builder for efficiently querying a log analytics system for tree structures that satisfy a user-defined range.

Abstract: The present disclosure relates to identifying process flows from log sources (e.g., log files), and generating visual representations (e.g., flow diagrams, Sankey diagrams, etc.) of the identified process flows. In addition, the present disclosure relates to clustering of tree structures based on the shape of the tree structure using one or more hashing algorithms. The present disclosure also relates to a user interface that presents a query builder for efficiently querying a log analytics system for tree structures that satisfy a user-defined range.

Abstract: Some embodiments relate to assigning individual log messages to clusters. An initial cluster assignment may be performed by applying a hash function to one or more non-variable components of the message to generate an initial cluster identifier. Subsequently, clustering may be further refined (e.g., by determining whether to merge clusters based on similarity values). An interface can present a representative message of each cluster and indicate which portions of the message correspond to a variable component. Particular inputs detected at the input corresponding to one of these components can cause other values for the component to be presented. For a given cluster, timestamps of assigned messages can be used to generate a time series, which can facilitate grouping of clusters (with similar or complementary shapes) and/or triggering alerts (with a condition corresponding to a temporal aspect).

Abstract: Some embodiments relate to assigning individual log messages to clusters. An initial cluster assignment may be performed by applying a hash function to one or more non-variable components of the message to generate an initial cluster identifier. Subsequently, clustering may be further refined (e.g., by determining whether to merge clusters based on similarity values). An interface can present a representative message of each cluster and indicate which portions of the message correspond to a variable component. Particular inputs detected at the input corresponding to one of these components can cause other values for the component to be presented. For a given cluster, timestamps of assigned messages can be used to generate a time series, which can facilitate grouping of clusters (with similar or complementary shapes) and/or triggering alerts (with a condition corresponding to a temporal aspect).

Abstract: Some embodiments relate to assigning individual log messages to clusters. An initial cluster assignment may be performed by applying a hash function to one or more non-variable components of the message to generate an initial cluster identifier. Subsequently, clustering may be further refined (e.g., by determining whether to merge clusters based on similarity values). An interface can present a representative message of each cluster and indicate which portions of the message correspond to a variable component. Particular inputs detected at the input corresponding to one of these components can cause other values for the component to be presented. For a given cluster, timestamps of assigned messages can be used to generate a time series, which can facilitate grouping of clusters (with similar or complementary shapes) and/or triggering alerts (with a condition corresponding to a temporal aspect).