Abstract: Various implementations of the present application set forth a method comprising generating, three-dimensional data and two-dimensional data representing a physical space that includes a real-world asset, generating an adaptable three-dimensional (3D) representation of the physical space based on the two-dimensional and three-dimensional data, where the adaptable 3D representation includes a plurality of coordinates representing different positions in 3D coordinate space corresponding to the physical space, transforming the adaptable 3D representation into geometry data comprising a set of vertices, faces comprising edges between pairs of vertices, and texture data, transmitting the geometry data to a remote device, wherein the remote device, constructs, based on the geometry data, the adaptable 3D representation of the physical space for display at a location of the remote device in a remote environment, and modifies, based on an input, at least one of a dimension or a position of the adaptable 3D representa

Abstract: One or more embodiments are directed multistage device clustering. A log including network traffic of multiple devices in a network is received. From the log, features of the devices are extracted and an aggregated feature matrix generated. A traffic behavior subset of the features in the aggregated feature matrix is selected, and a topic modeling algorithm applied thereto to obtain traffic behavior device groups. An application behavior subset of the features in the aggregated feature matrix is selected. On a per traffic behavior device group basis, the topic modeling algorithm is applied to the application behavior subset to obtain application behavior device subgroups. One or more devices are assigned to at least one of the plurality of application behavior device subgroups to obtain an assignment.

Abstract: Disclosed is a data fabric service system that can be implemented in a distributed computer network, such as a data intake and query system. The data index and query system can receive a search query and define a search scheme for applying the search query on distributed data storage systems including internal data storage and external data storage. The data index and query system may provide a portion of the search scheme to a search service of the data fabric service system, which can cause worker nodes of the data fabric service system to perform various functions—including applying the search query to the external data storage based on the portion of the search scheme in order to obtain search results.

Abstract: Systems and methods provide a platform of at least partially pre-defined panel templates that a user can select and manipulate to customize the visualization of data of interest within an interactive dashboard. Each panel template may be defined by a developer in advance to include a set of inputs, a query, and a visualization. Users may select pre-defined panel templates for inclusion in the dashboard, and then when the dashboard is actually displayed, use the set of inputs of a particular panel to specify criteria that may further define the corresponding query and/or the visualization of data produced by executing the query. An electronic dashboard is provided having a combination of available panel templates that may be selected and arranged according to a desired page layout or design. One or more reusable panel templates may be provided to a user of an enterprise application for data analysis and visualization.

Abstract: Provided are systems and methods for determining and displaying automatically binned information via a graphical user interface. A graphical user interface (GUI) may include a first graphical element representing a first metric value for a first time window and a second graphical element representing a second metric value for a second time window. An indication of a selection of the first time window may be received via the GUI. An updated GUI comprising a third graphical element representing a third metric value for the third time window and a fourth graphical element representing the fourth metric value for the fourth time window may be displayed, wherein the third time window and the fourth time window may be sub-ranges of the first time window.

Abstract: A mobile device is fitted with an extended reality (XR) software application program executing on a processor within an XR system, and optionally a camera. Via the XR software application program, various techniques are performed for interacting with a physical object via the XR environment. In particular, the XR software application program generates and displays visual representations of real-time metric data received from a data intake and query system along with auxiliary data received from an asset management system. In addition, the XR software application program detects user interactions with the XR environment. In response, the XR software application generates messages directed to the asset management system. The messages include commands to update the auxiliary data associated with the physical object.

Abstract: An event limited field picker for a search user interface is described. In one or more implementations, a service may operate to collect and store data as events each of which includes a portion of the data correlated with a point in time. Clients may use a search user interface perform searches by input of search criteria. Responsive to receiving search criteria, the service may operate to apply a late binding schema to extract events that match the search criteria and provide search results for display via the search user interface. The search user interface exposes an event limited field picker operable to make selections of fields with respect to individual events in a view of the search results. In response to receiving an indication of a fields selected via the picker, visibility of selected fields may be updated to control which field and values are included in different views.

Abstract: A mobile device is fitted with a camera and an extended reality (XR) software application program executing on a processor within an XR system. Via the XR software application program, techniques are performed for manipulating virtual objects in an XR environment. In one technique, the XR software application program facilitates the movement of a virtual object from a first location to a second location, within a plane parallel to a touchscreen of a mobile device, responsive to a displacement determined based on user input detected via the touchscreen.

Abstract: A computer-implemented method for analyzing spans and traces associated with a microservices-based application executing in a distributed computing environment comprises aggregating a plurality of ingested spans associated with one or more applications executing in the distributed computing environment into a plurality of traces, wherein each of the plurality of ingested spans is associated with a plurality of tags. The method further comprises comparing durations of a set of related traces of the plurality of traces to determine patterns for the plurality of tags and generating a histogram that represents a distribution of the durations of the set of related traces. The method also comprises providing alerts for one or more tags from the plurality of tags associated with traces having a duration above a threshold based on the distribution of the durations.

Abstract: In various embodiments, a gateway application generates an outgoing Hypertext Transmission Protocol (HTTP) request based on an incoming HTTP request. In operation, the gateway application receives the incoming HTTP request and identifies an upstream service based on at least one of an HTTP method and a header included in the incoming HTTP request. Subsequently, the gateway application generates an outgoing HTTP request based on the upstream service and the incoming HTTP request. Finally, the gateway application issues the outgoing HTTP request. The outgoing HTTP request causes the upstream service to perform an action requested in the incoming HTTP request. Advantageously, the gateway application enables underlying upstream services to perform actions specified via incoming HTTP requests without directly exposing the upstream services to users.

Abstract: A method of identifying a root cause of a failure for a trace within a microservices-based application includes determining if a root span of the trace is an error span resulting in an error experienced by a user at a front end of the microservices-based application. If the root span of the trace is an error span, the method analyzes a plurality of spans comprising the trace to determine if the trace comprises at least one leaf error span. If the trace comprises a single leaf error span, the method attributes the root cause of the failure in the trace to a service associated with the single leaf error span. If the trace comprises multiple leaf error spans the method attributes the root cause of the failure in the trace to a service associated with a leaf error span of the multiple leaf error spans comprising a latest starting timestamp.

Abstract: Described herein are technologies that facilitate effective use (e.g., indexing and searching) of non-text machine data (e.g., audio/visual data) in an event-based machine-data intake and query system.

Abstract: A data intake and query system provides interfaces that enable users to configure source type definitions used by the system. A data intake and query system generally refers to a system for collecting and analyzing data including machine-generated data. Such a system may be configured to consume many different types of machine data generated by any number of different data sources including various servers, network devices, applications, etc. At a high level, a source type definition comprises one or more properties that define how various components of a data intake and query system collect, index, store, search and otherwise interact with particular types of data consumed by the system. The interfaces provided by the system generally comprise one or more interface components for configuring various attributes of a source type definition.

Abstract: Systems and methods are described for a streaming data processing system that defers processing of some data based on a determined importance of the data. A streaming data processing system can ingest a data stream that contains multiple events, and can extract data field values from individual events and process the data field values to determine event importance. The streaming data processing system can then do further processing and indexing of high importance events, and can generate a storage prefix for each low importance event that determines where to store the low importance event in a data storage system. The streaming data processing system can then process queries by retrieving the indexed high importance events, and can extract the data field values from a high importance event to determine the storage prefix for retrieving corresponding low importance events from the data storage system.

Abstract: The disclosure provides implementations for determining whether domain name server (DNS) beaconing is present within a communication session. Some implementations provide a method that includes multiple analyses directed to analyzing each of a time-to-live (TTL) run length distribution for a plurality of DNS records within the communication session and analyzing whether the communication is comprised of at least a threshold number of transmissions. As used in the analyses, the communication session may be comprised of transmissions between a first source device and a first DNS. When DNS beaconing is detected within the communication session, some implementations of the disclosure provide for generating an alert to an administrator or other user.

Abstract: Described herein are systems, methods, and software to enhance incident response in an information technology (IT) environment. In one example, an incident service identifies a course of action to respond to an incident in the IT environment. The incident service further identifies a particular step in the course of action associated with a credential requirement based on traits associated with the particular step, and generates a credential request to obtain credentials to support the credential requirement.

Abstract: A data intake and query system executes a search query at a first execution time for querying events having associated time stamps within a first time period characterized by a first start time and a first end time. The first start time is computed based upon a time indicated by reference time information stored prior to execution of the search query. The system determines whether execution of the search query completed successfully based upon a first search result obtained from executing the search query. If the first execution of the search query was not successful, the system computes for a second execution of the search query after the first execution, a second time period using the reference time information. The second execution is configured to query events with associated timestamps that fall within a second time period that includes the first time period and an additional time period.

Abstract: Embodiments of the present invention are directed to managing process analytics across process components. In some embodiments, an indication of a state of a process instance associated with a process is determined by querying a process engine. In accordance with the indication of the state of the process instance, an augmented process model is used to search machine data for data corresponding with at least one component of the process. The data corresponding with the at least one component of the process is associated with a process instance identifier that uniquely identifies the process instance. Thereafter, the data along with the process instance identifier is provided to the process engine to update the state of the process instance.

Abstract: Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.