Abstract: Forecasting resource allocation is disclosed. An example method includes receiving operating data from a resource; applying periodicity tests to the received operating data using a plurality of sketches of time series of prior operating data, the periodicity tests generating periodic components; applying regression models to the received operating data, the regression models collectively generating a trend component, each regression model being applied over a different time scale of a plurality of time scales; computing a trend model using the periodic components and a trend component; determining a random process describing the historical evolution of the trend model; and calculating and providing a mean prediction, an upper bound, and a lower bound for resource utilization at a future time using the trend model and a predicted distribution.

Abstract: Provided are systems and methods for multi-layer caching of data. An example method commences with creating a data structure on top of an information retrieval library. The data structure is designed to access data associated with the information retrieval library through a local index. The method includes creating a plurality of ordered cache layers for the data accessed via the local index. The plurality of ordered cache layers are ordered based on frequency of access and a last layer is used to access the data over a network. The method then continues with receiving a search query. The method further includes determining that the search query is for the data associated with the last layer. The method further continues with executing, using the local index, the search query locally to retrieve a matching document from the data associated with the last layer remotely.

Abstract: Provided are methods and systems for searching event sequences. An example method includes receiving a request including a sequence of queries, the sequence of queries including a first query and a second query, the second query succeeding the first query in the sequence; executing the first query over a first dataset to determine a first event; executing the second query over a second dataset to determine a second event, the second event occurring after the first event; and generating, in response to the request, a further sequence including the first event and the second event. The method may include executing the first query over the first dataset to determine a third event and verifying that the third event has occurred after the second event.

Abstract: Methods and systems for shard optimized database queries using parameter-based indexes are provided. Exemplary methods include: receiving a database query that includes an index parameter and an index parameter range. A parameter table is accessed that contains an association between the parameter and parameter range and a shard identifier. Based on the parameter type and the range identified in the query, the relevant shards are identified, and the database query is limited to processing these shards.

Abstract: An automated system for allocation of resources in a cluster configured to run a search engine is disclosed. At least one master node includes a processing system. The processing system is configured to analyze the cluster based on measurements of different parameters. The results of the analysis can be used to allocate or reallocate the shards, allocate or reconfigure the workload portions assigned to the shards, and allocate or reconfigure the shards selectively to maintain high performance. Periodic analyses can predict future behavior, and reconciliations toward a target allocation can occur regularly to maximize system efficiency and performance.

Abstract: Node clustering configuration is disclosed herein. An example method includes determining nodes of a cluster, each of the nodes having a unique identifier and a cluster identifier for the cluster, determining a voting configuration for the cluster, the voting configuration defining a quorum of master-eligible nodes of the nodes, the voting configuration being adaptable so as to maintain an optimal level of fault tolerance for the cluster, adding and removing nodes that can change the voting configuration, configuring a cluster configuration through an API, and electing one of the master-eligible nodes as a master node.

Abstract: Methods and systems for enabling organization and control of dashboards, visualizations, and other saved data objects into spaces. An exemplary method includes, based on at least one role of a user, controlling the user's access to a default space and to other spaces of a plurality of spaces, such that the only spaces that the user can access are the default space and the one or more other spaces. Each space can contain a number of saved objects such as dashboards, visualizations, or other objects. The method can provide a graphical user interface for enabling the user to select, as a current space, the default space or one of the other spaces; and in response to the selection, automatically saving new objects generated by the user into the current space; wherein each of the spaces is configured to provide access to certain data objects only or access to certain applications only.

Abstract: Management services for distributed computing architectures using rolling changes are provided herein. An example system includes clusters of nodes providing services and a plurality of management servers, each of the plurality of management servers including: at least a distributed coordination service for the clusters of nodes, the distributed coordination service being a datastore; and a constructor that manages allocation and life cycle deployments of the nodes of the clusters, the constructor further configured to manage topological changes to nodes of the clusters by implementing rolling attribute changes for the nodes.

Abstract: Systems and methods for application performance management across one or more networks are disclosed. A system includes a plurality of geographically distributed computing devices executing one or more applications. A plurality of collectors are distributed across the one or more networks, each collector being positioned proximate a respective computing device. The collectors may sample, by each of the plurality of collectors, a plurality of trace events received from the applications executing on the computing devices proximate the collector. The collectors may retain in memory sampled trace events that meet a configurable attribute. The collectors may use probabilistic sets and tail-based sampling to determine root events and policies for identifying relevant traces. Benefits can be achieved in bandwidth savings, network cost and cyber security.

Abstract: Provided are methods and systems for preventing malicious behavior of an end point. An example method commences with monitoring a stream of events associated with the end point. The method further includes processing the stream to record a set of events to a memory. Processing an event of the stream includes determining that the event satisfies at least one rule in a sequence of rules and, in response to the determination, adding the event to the set of events in the memory. The method further includes determining that the set of events includes a sequence of events. Each state in the sequence of events corresponds to at least one rule in the sequence of rules. The method continues with executing at least one action on the end point in response to the determination that the set of events includes the sequence of events.

Abstract: In various embodiments, the system and method described herein provide functionality for selecting an appropriate compression algorithm and settings given a cost model. Specifically, in selecting a compression method and configuration, the described system and method use a cost model to take into account the financial cost of a number of aspects of a particular compression scenario, including, but not limited to, the cost of performing the compression/decompression and the cost of storing the data. In this manner, intelligent trade-offs can be made between CPU/computing cost and data storage/transmission cost in an environment where a dollar amount can be associated with CPU processing time and storage/transmission volume. The described system and method can make such decisions dynamically, so that compression and/or decompression operations can respond to changing conditions on the fly, thus leading to better and more cost-effective management of resources.

Abstract: Methods and systems for a document-level attribute-based access control service are provided. The document-level attribute-based access control service may be positioned between a directory service and a search engine service. The directory service can manage information and permissions for users. The document-level attribute-based access control service can map security attributes to the user based on the information and permissions. Based on the mapping, it can be determined whether to permit the user making a query to the search engine service to access documents based on the query. Information and permissions attributes can be injected into queries dynamically via a template. Attributes may be combined with role query templates to create document-level attribute-based access control on top of role-based access control. The present technology can enable enforcement of security policies requiring all of a combination of attributes to be satisfied before permitting certain access.

Abstract: Systems and methods that are adapted for automatic curation of query responses are disclosed herein. An example method includes obtaining user action metrics corresponding to responses provided in reply to a query for a target resource, the query having a search term, determining a portion of the responses having user action metrics with statistical significance, generating a list of curated responses based on the portion of the responses, and providing the curated responses in reply queries having the search term.

Abstract: Systems and methods for application performance management across one or more networks are disclosed. A system includes a plurality of geographically distributed computing devices executing one or more applications. A plurality of collectors are distributed across the one or more networks, each collector being positioned proximate a respective computing device. The collectors may sample, by each of the plurality of collectors, a plurality of trace events received from the applications executing on the computing devices proximate the collector. The collectors may retain in memory sampled trace events that meet a configurable attribute. The collectors may use probabilistic sets and tail-based sampling to determine root events and policies for identifying relevant traces. Benefits can be achieved in bandwidth savings, network cost and cyber security.

Abstract: Systems and methods for providing for visualization and analysis of geospatial data are described. An example method includes automatically generating a first map comprising a plurality of layers that each comprise part of the input data, providing a graphical user interface for receiving at least one selection from the user of one or more of the plurality of layers of the first map for display and an indication that the user has zoomed in on the first map to a first area featuring a symbol corresponding to an item of interest, and automatically generating, based on bounds of the dataset, a second map showing a second area of a bounding shape selected to fit the data related to the item of interest.

Abstract: Provided are methods and systems for configuring and managing data shipper agents. A method may commence with receiving a list of one or more data shipper agents installed on one or more edge nodes associated with a user. A data shipper agent of the one or more data shipper agents may be installed on one of the one or more edge nodes. The method may continue with providing a graphical user interface that may enable the user to configure the one or more data shipper agents. The method may further include receiving selections of configuration parameters associated with at least one of the one or more data shipper agents. The method may then continue with receiving a configuration of the at least one of the one or more data shipper agents and automatically reconfiguring the configuration of the at least one of the one or more data shipper agents.

Abstract: Systems and methods for processing structured queries over clusters are provided herein. An example system includes a plurality of clusters, wherein a local cluster is configured to receive, from a client, a structured query language (SQL) structured query, determine, based on the SQL structured query, a list of remote clusters of the plurality of clusters, process the SQL structured query to generate a local query executable by a local search engine of the local cluster and remote queries executable by remote search engines of the remote clusters, send the remote queries to the remote clusters to obtain remote results, execute the local query to obtain local results, combine the remote results and the local results to obtain an aggregated result, and return the aggregated result to the client.

Abstract: Systems and methods that are adapted for automatic curation of query responses are disclosed herein. An example method includes obtaining user action metrics corresponding to responses provided in reply to a query for a target resource, the query having a search term, determining a portion of the responses having user action metrics with statistical significance, generating a list of curated responses based on the portion of the responses, and providing the curated responses in reply queries having the search term.

Abstract: Service-to-service role mapping systems and methods are disclosed herein. An example role mapping service is positioned between a directory service and a search engine service, the directory service managing user information and permissions for users, the role mapping service mapping one or more search engine service roles to a user based on the user information and permissions received from the directory service.

Abstract: Methods and systems for a document-level attribute-based access control service are provided. The document-level attribute-based access control service may be positioned between a directory service and a search engine service. The directory service can manage information and permissions for users. The document-level attribute-based access control service can map security attributes to the user based on the information and permissions. Based on the mapping, it can be determined whether to permit the user making a query to the search engine service to access documents based on the query. Information and permissions attributes can be injected into queries dynamically via a template. Attributes may be combined with role query templates to create document-level attribute-based access control on top of role-based access control. The present technology can enable enforcement of security policies requiring all of a combination of attributes to be satisfied before permitting certain access.