Abstract: Management services for distributed computing architectures using rolling changes are provided herein. An example system includes clusters of nodes providing services and a plurality of management servers, each of the plurality of management servers including: at least a distributed coordination service for the clusters of nodes, the distributed coordination service being a datastore; and a constructor that manages allocation and life cycle deployments of the nodes of the clusters, the constructor further configured to manage topological changes to nodes of the clusters by implement rolling attribute changes for the nodes.

Abstract: A method and system for analysing data is disclosed. One or more data records are passed to a data analysis system. The data records comprised a plurality of data items and a first one of the data items is selected from the data items in the data record. A statistical model can be retrieved from a store in a computer system and the statistical model used to detect abnormal results from the selected data item and produce a data model. This statistical model is stored with the data record in the data base.

Abstract: Methods and systems for cross cluster replication are provided. Exemplary methods include: periodically requesting by a follower cluster history from a leader cluster, the history including at least one operation and sequence number pair, the operation having changed data in a primary shard of the leader cluster; receiving history and a first global checkpoint from the leader cluster; when a difference between the first global checkpoint and a second global checkpoint exceeds a user-defined value, concurrently making multiple additional requests for history from the leader cluster; and when a difference between the first global checkpoint and the second global checkpoint is less than a user-defined value, executing the at least one operation, the at least one operation changing data in a primary shard of the follower cluster, such that an index of the follower cluster replicates an index of the leader cluster.

Abstract: Systems and methods for reducing data storage overhead are disclosed herein. In some embodiments, a system includes a rollup service that converts a raw data set into a rolled up index that takes up less storage than the raw data but is created in such a way that the rolled up index can be queried so as to generate responses that will substantially correspond to responses that would be generated using the raw data.

Abstract: Anomaly and causation detection in computing environments are disclosed. An example method includes receiving an input stream of data instances for a time series, each of the data instances being time stamped and including at least one principle value and a set of categorical attributes; generating anomaly scores for each of the data instances over continuous time intervals; detecting a change in the anomaly scores over the continuous time intervals for the data instances; and identifying which of the set of categorical attributes of the data instances caused the change in the anomaly scores using a counterfactual analysis. The counterfactual analysis may comprise removing a portion of the data instances; regenerating the anomaly scores for each of the remaining data instances over the continuous time intervals; and if the anomaly scores are improved, identifying the portion as a cause of anomalous activity. Recommendations to remediate the cause may be generated.

Abstract: Provided are systems and methods for generating alerts in a computing environment. An example method may commence with receiving parameters associated with an alert. The parameters may include at least an alert condition and an action to be performed based on the alert condition. The method may further include monitoring at least a portion of a network data according to a predetermined schedule based on the parameters. The method may continue with monitoring at least a portion of a network data according to a predetermined schedule based on the parameters. The method may further include generating the alert upon detection of the alert condition.

Abstract: Methods and systems for searching a frozen index are provided. Exemplary methods include: a method may comprise: receiving an initial search and a subsequent search; loading the initial search and the subsequent search into a throttled thread pool, the throttled thread pool including; getting the initial search from the throttled thread pool; storing a first shard from a mass storage in a memory in response to the initial search; performing the initial search on the first shard; providing first top search result scores from the initial search; and removing the first shard from the memory when the initial search is completed.

Abstract: Methods and corresponding systems for integration of different data for a distributed search, visualization and analysis platform, the method comprising automatically correlating data sources associated with execution of an application, the data from the data sources adhering to a common schema. The method further comprises providing a separate UI for each of the data sources for visualization and analysis; for each UI, providing a menu for selecting other correlated data sources; and in response to a menu selection, causing display of the other correlated data source and its corresponding UI. The data sources may include application performance monitoring (APM) data, log data, and infrastructure data. The common schema provides a core set of fields to be used in event messages stored for APM data, log data, and infrastructure data, and is configured to enable adding new data sources while enabling reuse of existing analysis content for the new data sources.

Abstract: Systems and methods for dynamic scaling in graphical user interfaces are described herein. According to some embodiments, an example method includes receiving input data to be graphically displayed on a graphical user interface, generating an interface that includes a control icon that can be translated within a grid so as to define an easing curve and to select at least two easing function parameters for a parameterizable easing function, and generating, in real-time as the least two easing function parameters are received, the graphical user interface which includes output representations of the input data which have one or more styling parameters that are selected based on the parameterizable easing function such that monotonicity is maintained between the input data and the output representations.

Abstract: Methods and systems for providing integration of log, infrastructure, and application performance monitoring (APM) data sources for visualization and analysis. An example method includes automatically correlating data sources associated with execution of an application, the data sources associated with the execution including log data from services invoked, infrastructure data, along with application performance monitoring (APM) trace information that indicates in real time at least execution time information for the services; providing a separate user interface (UI) for the each correlated data source for visualization and data analysis; and in response to a selection by a user at one of the separate UIs, causing display of one of the other correlated data sources at another of the separate UIs. The method streamlines debugging. One of the UIs provides for selection of infrastructure metrics for display where example infrastructure includes a plurality of container and hosts.

Abstract: Systems and methods for iterating between a graphical user interface and an expression for data visualization. Exemplary methods include: evaluating an expression at a client, the expression associated with a component, the evaluating determining data is to be retrieved from a server; running at least part of the expression at the server, the server determining input from the client is to be used to process the at least part of the expression; processing the modified expression at the client, the processing including getting the input at the client and providing the input to the server; and resuming the running of the at least part of the expression at the server, the resuming including running the at least part of the expression using the input to produce retrieved data and giving the retrieved data to the client.

Abstract: Automatically creating and modifying a search engine for a website. User input may be received specifying an address of a website. A search engine may be automatically created for the website based on the user input. Webpages of the website may specify a plurality of tags specifying custom attributes of the webpages. During creation of the search engine, these custom attributes may be incorporated into the search engine index. Additional user input may be received customizing the search engine for various search engine contexts, e.g., based on the custom attributes of the webpages. Search engine results for the website may be based on various ranking functions, potentially including social impact of webpages of the website.

Abstract: A system and method for the detection of irregularities, such as fraud or malware, running on a device, is disclosed. The system comprises a monitoring program for reviewing data relating to operation of the device, a device profile including data items relating to typical operation of the device generated from messages relating to the device; and an alert module for generating an alert on detection of unusual activity relating to the device.

Abstract: Methods and systems for automatically creating and modifying a search engine for a website are provided. User input may be received specifying an address of a website. A search engine may be automatically created for the website based on the user input. Webpages of the website may specify a plurality of tags specifying custom attributes of the webpages. During creation of the search engine, these custom attributes may be incorporated into the search engine index. Additional user input may be received customizing the search engine for various search engine contexts, e.g., based on the custom attributes of the webpages. Search engine results for the website may be based on various ranking functions, potentially including social impact of webpages of the website.

Abstract: The field of the disclosure relates generally to a method and system for analyzing behavior of a computer infrastructure and the displaying the behavior of the computer infrastructure in a graphical manner. The system comprises an analytical engine connected to agents running on devices in the computer infrastructure and analyzing continuous data and asynchronous data.

Abstract: A system and method for the detection of irregularities, such as fraud or malware, running on a device, is disclosed. The system comprises a monitoring program for reviewing data relating to operation of the device, a device profile including data items relating to typical operation of the device generated from messages relating to the device; and an alert module for generating an alert on detection of unusual activity relating to the device.