Abstract: Embodiments of the present disclosure provide techniques for using an inverted index in a pipelined search query. A field searchable data store is provided that comprises a plurality of event records, each event record comprising a time-stamped portion of raw machine data. Responsive to the reciept of an incoming search query, the search engine accesses an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and value pair that identifies a location in the data store where an associated event record is stored. Once the inverted index is accessed, it can be used to identify and search a subset of the plurality of event records, wherein the subset comprises one or more event records with corresponding reference values in the inverted index.

Abstract: Embodiments of the present disclosure provide techniques for performing searches of event records by leveraging reference values in an inverted index. A method of searching comprises accessing a query associated with a first set of event records in a field searchable data store, each event record comprising a time-stamped portion of raw machine data. The method further comprises evaluating the query and generating results for the query by accessing an inverted index, wherein each entry in the inverted index comprises at least one field, a corresponding at least one field value and a reference value that identifies a location in the field searchable data store where an associated event record is stored. The method further comprises performing a search to filter out a second set of event records and retrieving the second set of event records from the field searchable data store using reference values in the inverted index.

Abstract: Provided are a computer program product, system, and method for determining available remote storages in a network to use to replicate a file based on a geographical requirement with respect the file. A determination is made as whether available remote storages satisfy constraints associated with a document class of the file. The constraints include a geographical location at which to replicate the file and a minimum number of replications to create for the file. At least one remote storage of the available remote storages is selected that satisfies the constraints to store at least one copy of the file. The file is replicated to the selected at least one remote storage.

Abstract: A method uses natural language for visual analysis of a dataset. A data visualization application displays a data visualization, at a computer, based on a dataset retrieved from a database using a set of one or more queries. A user specifies a natural language command related to the displayed data visualization, and the computer extracts an analytic phrase from the natural language command. The computer computes semantic relatedness between the analytic phrase and numeric data fields in the dataset. The computer identifies numeric data fields having highest semantic relatedness to the analytic phrase, and also selects a relevant numerical function. The numerical function compares data values in the numeric data fields to a threshold value. The computer retrieves an updated dataset that filters the identified numeric data fields according to the numeric function. The computer then displays an updated data visualization using the updated dataset.

Abstract: The technology described herein efficiently determines whether a real inode is shared among views, or owned. In-memory data structures include a view snapshot generation counter that is increased as a snapshot that generates a view is created, and an inode total weight. An in-memory virtual inode cache dataset for a filesystem object associated with the view is instantiated with the value of snapshot generation counter, sharing-related data based on the inode mapping file entry for the object, and an inode access weight. To determine whether the inode is shared (and needs to be split), such as on a write to the object, the in-memory data is evaluated. The real inode is shared if the generation counters are unequal, if the sharing-related data indicates sharing at an intermediate indirect block level, or indicates sharing at the inode level and the inode access weight is less than the inode total weight.

Abstract: Embodiments of the present disclosure are directed to an interactive development environment (IDE) interface that provides historical visualization of queries and query result information iteratively and intuitively. According to an embodiment of the present disclosure, a process is provided to generate visualizations of queries and processed query result information in a single, persistent, integrated display. Each query and resultant search data information is presented iteratively in chronological order, and maintain a persistent, viewable history of a search data exploration session.

Abstract: A search results user interface enables a user conducting a search of an electronic catalog to identify and access browse nodes (item categories) associated with the search query when the search query is determined to be broad. In one embodiment, if the catalog items that are responsive to the search query fall within more than a threshold number of browse nodes, a search results page is presented that provides functionality for the user to view the browse nodes associated with the search query and to navigate to associated browse node pages.

Abstract: Techniques for identifying relevant, natural language documents within a data repository. An electronic document specifying natural language text describing an issue with a complex system is received. One or more portions are removed from the electronic document. The portions are determined to satisfy predefined filtering rules. A first set of terms are determined using a data dictionary structure, and a second set of terms are determined, where at least one term in the second set of terms satisfies at least one predefined pattern matching rule. A third set of terms are determined by processing the electronic document as an input to a machine learning model trained to recognize relevant terms within the electronic document. A synthesized electronic document is generated from the first, second and third sets of terms, and the synthesized electronic document is used to identify a set of relevant documents within the data repository.

Abstract: The present disclosure provides new and innovative systems and methods for publishing standardized data in a variety of formats. In an example, a computer-implemented method includes obtaining source data, wherein the source data is in a standardized format, obtaining target platform data comprising a target platform address and a target format, generating a directory structure based on the source data and the target format, generating target data based on the source data and the target format, wherein the target data is in the target format, packaging the target data in the directory structure, generating instructions based on the target platform data and the packaged data, and transmitting the packaged data and the instructions to a third-party server system identified by the target platform address.

Abstract: Some implementations of the present disclosure provide a method that include: accessing a plurality of tables that describe a relational data model for a hierarch of exploration data assets, wherein the relational data model defines the hierarchy of exploration data assets and attributes at each level of the hierarchy, and wherein multiple databases encode the hierarchy of exploration data assets; querying the hierarch of exploration data assets according to one or more data quality rules capable of identifying defects in the hierarchy of exploration data assets; identifying instances of data records that fail to meet the one or more data quality rules; based on the identified instances, calculating one or more data quality metrics for the hierarchy of exploration data assets; and generating an alert that includes: the identified instances of data records, or the calculated one or more data quality metrics.

Abstract: A method includes partitioning a database table into a first plurality of partitions. A plurality of changes are executed on the database table in response to a transaction. The changes occur at a corresponding plurality of timestamps and result in a second plurality of partitions. The database table is updated to include a log with the plurality of changes. For each change of the plurality of changes, the log includes and an identification of a portion of the database table the change is applied to. A selection of a first timestamp and a second timestamp of the plurality of timestamps is detected. A delta is generated in response to the selection. The delta indicates a total change occurring to the database table between a first change of the plurality of changes corresponding to the first timestamp and a second change of the plurality of changes corresponding to the second timestamp.

Abstract: Techniques are provided for comparing multi-level data structures using commutative digesting for unordered data collections. One method comprises obtaining two multi-level data structures, wherein at least one multi-level data structure comprises an unordered data collection; determining a data structure digest value for each the two multi-level data structures by accumulating a data element digest value for each data element of the respective multi-level data structure, wherein a data element digest value for a given data element comprising an unordered data collection is determined using a commutative accumulator function; and evaluating a similarity of the two multi-level data structures by comparing the respective data structure digest values. A data element digest value for a given data element comprising an ordered data collection can be determined using a noncommutative accumulator function that aggregates a digest value for each data element using a noncommutative operation.

Abstract: Embodiments are directed to managing file systems. Update information associated with a change of a metric associated with a target object may be provided. A journal that includes a base bin that includes base records that associate the metric with each object in the file system. Records that include the change of the metric associated with the ancestors of target object may be generated. Another record that includes the change of the metric associated with the target object may be generated. A level bin associated with the base bin of the journal may be provided based on the update information. The records may be stored in the level bin using a sort order based on the ordering of the base bin records. In response a query, the journal may be employed to reduce latency in generating query results.

Abstract: Systems and methods for multi-object reporting in a content management system. A report type definition may define which objects are involved and how they are related. A report execution engine may generate a multi-object query language statement to translate the report type definition into query language. A query language execution engine may break the query language statement down into separate single pieces. A cost optimization engine may determine if it is cost efficient to join the objects. An indexed access execution engine may extract unique IDs of the objects and join the unique IDs to generate an index. A Lucene based search engine may be accessed according to the index, and the response is post processed to generate a multi-object report. A case management controller may receive a case narrative for an adverse event in the storage device, and store the case narrative to the storage device.

Abstract: Techniques for contextual search on multimedia content are provided. An example method includes extracting entities associated with multimedia content, wherein the entities include values characterizing one or more objects represented in the multimedia content, generating one or more query rewrite candidates based on the extracted entities and one or more terms in a query related to the multimedia content, providing the one or more query rewrite candidates to a search engine, scoring the one or more query rewrite candidates, ranking the scored one or more query rewrite candidates based on their respective scores, rewriting the query related to the multimedia content based on a particular ranked query rewrite candidate and providing for display, responsive to the query related to the multimedia content, a result set from the search engine based on the rewritten query.

Abstract: Disclosed are some implementations of systems, apparatus, methods and computer program products for generating a layout representing a process flow. Responsive to a first request from a client device to add an instance of a loop element type to a layout represented in a graphical user interface (GUI), the layout is updated such that the layout includes a first loop element defined by a loop element symbol and a loop connector path connected to the loop symbol. Responsive to a second request to add an instance of a second element type to the first loop element, calculating a set of rendering parameters for at least a portion of the layout including the first loop element based, at least in part, on a set of spacing rules and a set of dimensions associated with the second element type.

Abstract: Some implementations of the present disclosure provide a method that include: accessing a plurality of tables that store (i) metadata that characterize a hierarch of exploration data assets, (ii) metadata that characterize a set of data quality rules, (iii) metadata that characterize defects identifiable as data records in the hierarchy of exploration data assets that fail to comply with the set of data quality rules; querying the hierarch of exploration data assets according to one or more data quality rules from the set of data quality rules; identifying instances of data records that fail to meet the one or more data quality rules; based on analyzing the instances of data records, calculating one or more data quality metrics for the hierarchy of exploration data assets; and monitoring the hierarchy of exploration data assets based on the calculated one or more data quality metrics.

Abstract: Systems, methods, and non-transitory computer-readable media (systems) are disclosed for generating meaningful and insightful user segment reports based on a high dimensional data space. In particular, in one or more embodiments, the disclosed systems utilize a relaxed bi-clustering model to automatically identify user segments in a data space including datasets of features specific to individual users. In at least one embodiment, the disclosed systems identify and include users in automatically generated user segments even though those users are associated with some, but perhaps not all, of the features as other members in the automatically generated user segments.

Abstract: A modified configuration management database (CMDB) system is disclosed in which detected configuration item (CI) vulnerabilities are stored as less-resource-intensive detection objects, rather than as more-resource-intensive vulnerable item (VI) objects. The system includes a vulnerability response (VR) server that enables promotion rules to be created and periodically applied to the stored detections. When the conditions of a detection promotion rule are satisfied by information relating to a stored detection, a new VI may be created and related to the stored detection within the CMDB. The disclosed promotion rules can be configured to ensure that VIs are only automatically created for high-risk or relevant detections, substantially reducing the number of VIs to be created, stored, and managed. As such, the disclosed system substantially reduces resource consumption and improves the efficiency and operation of the CMDB.

Abstract: Methods and systems described herein are directed to aggregating and querying log messages. Methods and systems determine event types of log message generated by event sources of the distributed computing system. The event types are aggregated into aggregated records for a shortest time unit and event types are aggregated into aggregated records for longer time units based on the aggregated records associated with the shortest time unit. In response to a query regarding occurrences of an event type in a query time interval, the query time interval is split into subintervals with time lengths that range from the shortest time unit to a longest time unit that lie within the query time interval. The method determines a total event count of occurrences of the event type in the query time interval based on the aggregated records with time stamps in the subintervals. The event count in the query time interval may be used to detect abnormal behavior of the event sources.