Abstract: Methods of managing distributed analytics on device groups are described. In an embodiment, a management service within a distributed analytics system provides an interface to allow a user to define a group of devices based on a property of the devices. When the property of a device in the system satisfies the criterion specified by the user, the device is added to the group and the device may subsequently be removed from the group if the device no longer satisfies the criterion. Once a group has been defined, the management service enables users to specify management operations, such as creating, starting, stopping or deleting queries or management operations relating to other entities of end devices, which are to be implemented on all the devices in the group and the management service propagates the operation to all devices in the group, irrespective of their current connectivity status.

Abstract: Embodiments described herein are directed to methods and systems for enhanced event processing. An enhanced event processing request is received, the enhanced processing request comprising an indication of input data from a database data source. The input data indicated in the enhanced event processing request is accessed using a constructed data stream. The constructed data stream provides access to a collection of snapshots over time of database data of the database data source. The data from constructed data stream source may be accessed as a function of a selected value and a selected time. The constructed data stream data includes the temporal element, which is unavailable with the database data, the temporal element facilitates performing enhanced event processing for the database data using the constructed data stream data. An output for the enhanced event processing request is generated based on the input data accessed using the constructed data stream data.

Abstract: A method is described of pre-processing real-time data to be processed by one or more real-time analytics services. The method includes: receiving, at a stateless ingress node, data from one or more client devices; transforming the data in real-time at the stateless ingress node; determining in real-time, at the stateless ingress node, a real-time analytics service for the transformed data; and forwarding in real-time the transformed data to the determined real-time analytics service for stateful processing.

Abstract: A method is described of pre-processing real-time data to be processed by one or more real-time analytics services. The method includes: receiving, at a stateless ingress node, data from one or more client devices; transforming the data in real-time at the stateless ingress node; determining in real-time, at the stateless ingress node, a real-time analytics service for the transformed data; and forwarding in real-time the transformed data to the determined real-time analytics service for stateful processing.

Abstract: Methods, systems, and computer-readable media to generate a user interface (UI) to analyze a complex event processing (CEP) query are disclosed. A particular method includes receiving data representing an event flow associated with execution of a CEP query. The CEP query includes a plurality of operators. A UI including a graph is generated. The graph includes a plurality of nodes. Each node of the graph corresponds to an operator of the CEP query, and each edge of the graph corresponds to a stream between operators of the CEP query. The method includes receiving an input identifying a particular node of the graph, where the particular node corresponds to a particular operator of the CEP query. In response to the input, an operator-specific output associated with at least one event processed by the particular operator is displayed.

Abstract: An analysis module is configured to receive data associated with an event flow. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow. The analysis module is configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface.

Abstract: A complex event processor is described which has a communications interface configured to retrieve event data by pulling it from one or more sources and to receive at least one live event stream pushed to the interface. An event processing pipeline connected to the communications interface comprises a plurality of operator nodes connected between the communications interface and a combiner node which is a node configured to combine event data from the source and from the live event stream. The communications interface is configured to retrieve events from the source and to push the events retrieved from the source along the event processing pipeline towards the combiner node. The communications interface is configured to retrieve and push the retrieved events only in response to request messages passed in an upstream direction from the combiner node to the communications interface along the pipeline.

Abstract: Methods, systems, and computer-readable media to generate a user interface (UI) to analyze a complex event processing (CEP) query are disclosed. A particular method includes receiving data representing an event flow associated with execution of a CEP query. The CEP query includes a plurality of operators. A UI including a graph is generated. The graph includes a plurality of nodes. Each node of the graph corresponds to an operator of the CEP query, and each edge of the graph corresponds to a stream between operators of the CEP query. The method includes receiving an input identifying a particular node of the graph, where the particular node corresponds to a particular operator of the CEP query. In response to the input, an operator-specific output associated with at least one event processed by the particular operator is displayed.

Abstract: An analysis module is configured to receive data associated with an event flow. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow. The analysis module is configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface.

Abstract: A complex event processor is described which has a communications interface configured to retrieve event data by pulling it from one or more sources and to receive at least one live event stream pushed to the interface. An event processing pipeline connected to the communications interface comprises a plurality of operator nodes connected between the communications interface and a combiner node which is a node configured to combine event data from the source and from the live event stream. The communications interface is configured to retrieve events from the source and to push the events retrieved from the source along the event processing pipeline towards the combiner node. The communications interface is configured to retrieve and push the retrieved events only in response to request messages passed in an upstream direction from the combiner node to the communications interface along the pipeline.

Abstract: Embodiments described herein are directed to methods, and systems for generating event processing language code in a development environment using an event processing compiler. A query in event processing language is received in a development environment. The query can be associated with sample data from input files or an input data source. An event processing compiler compiles the query, where the compiler transforms the query from event processing language code to a development environment script language code. In particular, the event processing language code transforms the code based on event processing attributes that are intricately aligned in syntax and semantic between the event processing language and the development environment script language. The query as a development environment script is executed using sample data.

Abstract: Embodiments described herein are directed to methods and systems for enhanced event processing. An enhanced event processing request is received, the enhanced processing request comprising an indication of input data from a database data source. The input data indicated in the enhanced event processing request is accessed using a constructed data stream. The constructed data stream provides access to a collection of snapshots over time of database data of the database data source. The data from constructed data stream source may be accessed as a function of a selected value and a selected time. The constructed data stream data includes the temporal element, which is unavailable with the database data, the temporal element facilitates performing enhanced event processing for the database data using the constructed data stream data. An output for the enhanced event processing request is generated based on the input data accessed using the constructed data stream data.

Abstract: The formulation of transformations on one or more input event streams to generation one or more output event streams. Accordingly, the transformations may be considered to be a query on the original input event stream(s). The event query includes event stream source representations representing an input event stream available in a particular execution context. The event query also includes a transformation module identifying the transformation set to be performed on the input event streams in the execution context. Once the query is properly formed, an execution module may then cause the transformations to be executed upon the designated input event stream(s) to generate output event streams.

Abstract: An analysis module is configured to receive data associated with an event flow. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow. The analysis module is configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface.

Abstract: Methods, systems, and computer-readable media to analyze a CEP query are disclosed. A particular analysis module is configured to receive data associated with an event flow generated by execution of a CEP query. The data is received from a first analysis module (e.g., in a stack of analysis modules) or from the event flow via a software communication interface. The analysis module is also configured to execute an analysis operation on the data to generate a result. The analysis module can output the result to a second analysis module (e.g., in the stack of analysis modules) or to a user interface via the software communication interface.

Abstract: A method is described of pre-processing real-time data to be processed by one or more real-time analytics services. The method includes: receiving, at a stateless ingress node, data from one or more client devices; transforming the data in real-time at the stateless ingress node; determining in real-time, at the stateless ingress node, a real-time analytics service for the transformed data; and forwarding in real-time the transformed data to the determined real-time analytics service for stateful processing.

Abstract: A monitor-mine-manage cycle is described, for example, for managing a data center, a manufacturing process, an engineering process or other processes. In various example, the following steps are performed as a continuous automated loop: receiving raw events from an observed system; monitoring the raw events and transforming them into complex events; mining the complex events and reasoning on results; making a set of proposed actions based on the mining; and managing the observed system by applying one or more of the proposed actions to the system. In various examples, the continuous automated loop proceeds while raw events are continuously received from the observed system and monitored. In some examples an application programming interface is described comprising programming statements which allow a user to implement a monitor-mine-manage loop.

Abstract: Methods of managing distributed analytics on device groups are described. In an embodiment, a management service within a distributed analytics system provides an interface to allow a user to define a group of devices based on a property of the devices. When the property of a device in the system satisfies the criterion specified by the user, the device is added to the group and the device may subsequently be removed from the group if the device no longer satisfies the criterion. Once a group has been defined, the management service enables users to specify management operations, such as creating, starting, stopping or deleting queries or management operations relating to other entities of end devices, which are to be implemented on all the devices in the group and the management service propagates the operation to all devices in the group, irrespective of their current connectivity status.

Abstract: Root cause analysis for complex event processing is described. In embodiments, root cause analysis at a complex event processor is automatically performed by selecting an output event from an operator and correlating the output event to an input event using event type and lifetime data for the input event and the output event stored in a data store. Embodiments describe how the lifetime data can comprise a start time and an end time for the event, and the correlation can be based on a comparison of the start and end times between the input and output events. Embodiments describe how the correlation algorithm used is selected in dependence on the event type. In embodiments, a complex event processing engine comprises a logging unit arranged to store in the data store an indicator of an event type and lifetime data for each output event from an operator.

Abstract: The claimed subject matter provides a method for processing a stream of events. The method includes receiving a stream of events at a local device. The stream of events is associated with the local device. Further, the stream of events includes one or more out-of-order events. The method also includes executing a first complex event processing query against the stream of events. The stream of events is processed based on multiple levels of consistency defined by a set of operators. Additionally, the method includes correcting the out-of-order events based on the set of operators. A first output is generated in which consistency is guaranteed based on the corrected out-of-order events. The method also includes sending the first output to a server that performs complex event processing on the output.