Abstract: A method executes at a computer system to retrieve data from a database. Upon receiving a database query, the computer system translates the query into an intermediate representation, and estimates a compilation time to compile the intermediate representation into machine executable code. The query execution time to retrieve a result set is also estimated. In accordance with a determination that the query execution time and compilation time satisfy an interpretation criterion, the computer system invokes a byte code interpreter to interpret the intermediate representation and retrieve the result set from the database. In accordance with a determination that the query execution and compilation times satisfy one of a plurality of compilation criteria, the computer system compiles the intermediate representation to form machine code and executes the machine code to retrieve the result set from the database. In some cases, the query intermediate representation is optimized prior to compilation.

Abstract: Not all facts in a data warehouse are described by the same set of dimensions. However, there can be associations between the data dimensions and other dimensions. By maintaining a set of relationships that are capable of linking the dimensional keys used in existing data to the keys of an associated dimension, a data transformation can be constructed that summarizes by the original and by the associated dimensions in feeds in an analytical data mart (cube) that includes all the dimensions. This cube can then be consolidated and analyzed in a slice-and-dice fashion as though all the dimensions were independent. Data transformed in this manner can be analyzed alongside data from a source that is keyed by all of the dimensions.

Abstract: Embodiments are disclosed for a data analysis tool for facilitating iterative and exploratory analysis of large sets of data. In some embodiments a data analysis tool includes a graphical user interface through which an interactive set of field identifiers is displayed. Each of the listed field identifiers may reference fields associated with a set of events returned in response to a search query, the set of events including machine data produced by components within an information technology (IT) environment that reflects activity in the IT environment. In response to user selections of field identifiers included in the displayed set, a data analysis tool may cause display of manipulable visualizations based on values included in fields referenced by the selected field identifiers.

Abstract: A method of rendering a service graph illustrating dependencies between a frontend and a backend of an application comprises generating a plurality of frontend traces from a plurality of frontend spans and generating a plurality of backend traces from a plurality of backend spans ingested from the application. The method also comprises aggregating frontend metrics data using the plurality of frontend traces and backend metrics data using the plurality of backend traces. The method further comprises determining connection information between one or more frontend traces of the plurality of frontend traces and corresponding backend traces of the plurality of backend traces. The method also comprises rendering the service graph using the connection information and the aggregated frontend and backend metrics data.

Abstract: Techniques are disclosed relating to servicing search requests based on index information stored in a storage shared between multiple search servers. In some embodiments, a first search server maintains a local cache including index information usable to service received search requests and synchronizes the local cache with the shared storage. The synchronizing includes retrieving, from the shared storage, metadata indicative of the index information in the shared storage and determining, based on the metadata, whether the index information in the local cache differs from the shared storage. In response to determining that the index information in the local cache differs from the index information in the shared storage, the first search server updates the index information in the local cache with the index information in the shared storage. The first search server may then provide one or more search results determined using the updated index information.

Abstract: A data store system may include a storage device configured to store a plurality of data store tables. The data store may further include a plurality of processing units. At least one processing unit from the plurality of processing units may receive an analytic function call. The at least one processing unit may further identify, in the analytic function call, at least one column of a data store table on which to execute an analytic function in the analytic function call and may further identify, in the analytic function call, an identifier column of the data store table. Each row of the at least one column may be associated with a common row value of the identifier column. The at least one processing unit may further identify, in the analytic function call, at least one index column of the data store table. Each value in each at the least one index column may identify an index value on which to index each value of the at least one column with respect to each value of the identifier column.

Abstract: A content management system may support a card engine to dynamically perform operations such as configuring content for display via a user interface and generating reports based on user behavior, account status, and business logic. In cooperation with a facts controller to provide facts that the card engine may access substantively in real time, a rules engine to provide constructs in the form of card definitions, and a development engine, the content management system may enable a content manager to effect changes to card and container definitions by providing or modifying rules and rulesets in the rules engine dynamically. Cards evaluated dynamically by the card engine may be transmitted to user equipment. In this way, the content manager may make content decisions in accordance with business logic and events occurring proximate to the user, thereby impacting the user experience and generating reports in a substantive and real-time fashion.

Abstract: A method, an electronic device, and a computer program product for managing a file system are provided. For example, the method comprises causing multiple data blocks to be written to a storage space of the file system, the size of each of the multiple data blocks being not lower than a threshold size, and creating at least one space fragment in the storage space, the size of each of the at least one space fragment not exceeding the threshold size. Therefore, this solution can quickly and efficiently age a file system.

Abstract: According to certain aspects, a method of assessing users of a data storage system can include receiving configuration information relating to a deployed configuration of a first data storage cell and including number of installed data storage hardware and/or software components, the first data storage cell comprising a plurality of client computing devices and being configured to create and store one or more secondary copies of primary data generated by the plurality of client computing devices. The method may also include receiving information relating to an incident opened by a user of the first data storage cell. The method may further include updating a performance metric associated with the user to a new value to reflect a negative impact on the performance metric resulting from the opening of the incident by the user, wherein the degree of the negative impact is based at least in part on the configuration information.

Abstract: Systems and methods include causing presentation of a first cluster in association with an event of the first cluster, the first cluster from a first set of clusters of events. Each event includes a time stamp and event data. Based on the presentation of the first cluster, an extraction rule corresponding to the event of the first cluster is received from a user. Similarities in the event data between the events are determined based on the received extraction rule. The events are grouped into a second set of clusters based on the determined similarities. Presentation is caused of a second cluster in association with an event of the second cluster, where the second cluster is from the second set of clusters.

Abstract: Implementations relate to providing, in response to a query, machine learning model output that is based on output from a trained machine learning model. The machine learning model output can include a predicted answer to the query, that is predicted based on the trained machine learning model. The machine learning model output can additionally or alternatively include an interactive interface for the trained machine learning model. Some implementations relate to generating a trained machine learning model “on the fly” based on a search query. Some implementations additionally or alternatively relate to storing, in a search index, an association of a machine learning model with a plurality of content items from resource(s) on which the machine learning model was trained.

Abstract: An entity search method, a related device, and a computer storage medium are provided. The method includes: determining a first classifier and a second classifier that are included in query information; determining, based on a first entity library and the first classifier and the second classifier that are included in the query information, s correlations corresponding to each of w candidate entities, wherein information about the candidate entity includes a third classifier and a fourth classifier, and the correlation indicates a correlation between the classifiers in the query information and the classifiers in the candidate entity; and determining, based on the s correlations corresponding to each of the w candidate entities, information about a target entity corresponding to the query information, wherein the target entity is an entity in the w candidate entities.

Abstract: Methods, systems, and apparatus for generating data describing context clusters and context cluster probabilities, wherein each context cluster includes query inputs based on the input context for each of the query inputs and the content described by each query input, and each context cluster probability indicates a probability that at a query input that belongs to the context cluster will be selected by the user, receiving, from a user device, an indication of a user event that includes data indicating a context of the user device, selecting as a selected context cluster, based on the context cluster probabilities for each of the context clusters and the context of the user device, a context cluster for selection input by the user device, and providing, to the user device, data that causes the user device to display a context cluster selection input that indicates the selected context cluster for user selection.

Abstract: A non-transitory computer-readable storage medium storing a program that causes a processor to execute a process. The process includes selecting a section from among a plurality of sections, performing on an input data group the time-series analysis from a top section to the section when each of a plurality of approximation application degrees is set in the section, based on a result of the performing, for each of the plurality of approximation application degrees is set, calculating an error and an index value for a result of the time-series analysis when an approximation calculation is not applied, the index value indicating a degree of speed-up, storing an approximation application degree in which the error falls within a range, and the index value obtained when the error falls within the range, and executing the time-series analysis on an another input data group by applying a combination of the approximation application degrees.

Abstract: Methods, computer program products, and systems are presented. The methods include, for instance: obtaining domain data sources on a monolith database operating in a subject domain. Entities and relations of the monolith database are identified. By decomposing the entities of the monolith database for key entities in the subject domain, entities for a distributed database that is functionally equivalent to the monolith database are identified. Transactions performed on the monolith database and the entities of the distributed database involved therein are identified and the transactions are decomposed for the distributed database.

Abstract: A data intake and query system can manage the search of large amounts of data using one or more processing nodes. When a new processing node is added or becomes available, the node coordinator can reassign duties from one or more processing nodes to the new processing node. The node coordinator can initially assign the new processing node one or more groups of data for backup purposes. At a later time, the node coordinator can reassign the new processing node to the one or more groups of data for searching purposes.

Abstract: A method for matching an instance to exemplars within a system includes receiving a plurality of literature regarding medical subject matter; including the received plurality of literature related to the medical subject matter into a text artifact; indexing the artifact using encodings to derive an initial code signature; deriving association rules from the artifact seeded by the signature to obtain a list of terminology to code mappings; receiving extensions to each of the code mappings to augment the mappings with the received extensions; indexing the artifact using the received extensions to obtain an exemplar code signature for the certain subject matter; and storing the generated exemplars for matching and instance; receiving an instance and generating an instance code signature using the received extensions; matching the instance code signature to one or more exemplar code signatures.

Abstract: In an approach, a processor groups documents into a plurality of groups based on similarity, where: documents of each group have a same document structure; and the document structure is defined by coordinates of text blocks. A processor, for each group of the plurality of groups and for each document of the respective group: retrieves a value of each text block of the respective document in accordance with a document structure of the group; and assigns to each text block of the respective document an attribute that represents the retrieved value of the text block. A processor assigns a first document of the documents to an entity of a database that matches the first document based on the group of text block values and the assigned attributes of the document.

Abstract: The present invention provides methods, systems and computer program products that enable the optimized synchronization of data between mobile client devices assigned to field operators in an industrial plant and a centralized repository for plant data. The invention optimizes synchronization of data between mobile client devices assigned to field operators in an industrial plant and a centralized repository for plant data by selecting a reduced set of data records associated with a field operator, for data synchronization based on one or more of a set of data record selection parameters, and a set of version synchronization rules to ensure that only data records that are relevant to a field operator's foreseeable activities in a shift are downloaded to the field operator's mobile client device.

Abstract: A cyberthreat detection system queries a content database for unstructured content that contains a set of keywords, clusters the unstructured content into clusters based on topics, and determines a cybersecurity cluster utilizing a list of vetted cybersecurity phrases. The set of keywords represents a target of interest such as a newly discovered cyberthreat, an entity, a brand, or a combination thereof. The cybersecurity cluster thus determined is composed of unstructured content that has the set of keywords as well as some percentage of the vetted cybersecurity phrases. If the size of the cybersecurity cluster, as compared to the amount of unstructured content queried from the content database, meets or exceeds a predetermined threshold, the query is saved as a new classifier rule that can then be used by a cybersecurity classifier to automatically, dynamically and timely identify the target of interest in unclassified unstructured content.