Abstract: In a method for visualizing cyclical patterns in metric data, receiving, by one or more processors, data relating to a computer environment. The method further includes creating, by one or more processors, a visualization, wherein the visualization presents the data in a first format. The method further includes causing, by one or more processors, the visualization to be displayed in a user interface. The method further includes receiving, by one or more processors, an indication of a user interaction in the user interface, wherein the user interaction indicates an alternative visualization of the data, wherein the alternative visualization presents the data in a second format that includes a fragment of the received data. The method further includes creating, by one or more processors, the alternative visualization.

Abstract: A method, computer program product, and system for constructing a dynamic knowledge base of software usage patterns. A user action is monitored to identify one or more user action sequences. A common action sequence for the user action is identified, based on the one or more user action sequences. An instructional information resource is identified that corresponds to the common action resource, wherein the instructional information resource is accessed by the user. A database is constructed based on the common action sequence. The database organizes the common action sequences and instruction information resource. The instructional information resource is determined to be above a threshold based on the number of times the user consults the instructional information resource.

Abstract: A method and system for improving virtual keyboard input is provided. The method includes presenting a GUI comprising a character display portion and a virtual touch screen activated keyboard. The virtual touch screen activated keyboard internally includes currently viewable alphabetical character keys and a free sketch area for entering specialized characters not currently viewable via the virtual keyboard. A selection for an alphabetical character is received via the virtual touch screen activated keyboard and presented via the display portion. A user defined motion sketching a character associated with the specialized characters is detected from a user via the free sketch area. The character is converted into one of the specialized characters and presented to the user.

Abstract: A method and system are provided for retraining an analytic model. The method includes building, by a processor, a Markov chain for the analytic model. The Markov chain has only two states that consist of an alarm state and a no alarm state. The method further includes updating, by the processor, the Markov chain with observed states, for each of a plurality of timestamps evaluated during a burn-in period. The method also includes updating, by the processor, state transition probabilities within the Markov chain, for each of a plurality of timestamps evaluated after the burn-in period. The method additionally includes generating, by the processor, a signal for causing the model to be retrained, responsive to any of the state transition probabilities representing a probability of greater than 0.5 of seeing the alarm state in a previous interval and again in a current interval.

Abstract: A method, computer program product, and system for constructing a dynamic knowledge base of software usage patterns. A user action is monitored to identify one or more user action sequences. A common action sequence for the user action is identified, based on the one or more user action sequences. An instructional information resource is identified that corresponds to the common action resource, wherein the instructional information resource is accessed by the user. A database is constructed based on the common action sequence. The database organizes the common action sequences and instruction information resource. The instructional information resource is determined to be above a threshold based on the number of times the user consults the instructional information resource.

Abstract: A method of identifying topics which a user requires help with when using a software program is described. For each of a plurality of help documents, the help document is associated with a set of topics and their relative prevalence within the help document. User access to the help documents is tracked during use of the software program. Topics in relation to which help was required during use of the software program are identified based on an amount of access to one or more of the help documents and the relative prevalence of topics within the accessed help documents.

Abstract: In a method for visualizing cyclical patterns in metric data, receiving, by one or more processors, data relating to a computer environment. The method further includes creating, by one or more processors, a visualization, wherein the visualization presents the data in a first format. The method further includes causing, by one or more processors, the visualization to be displayed in a user interface. The method further includes receiving, by one or more processors, an indication of a user interaction in the user interface, wherein the user interaction indicates an alternative visualization of the data, wherein the alternative visualization presents the data in a second format that includes a fragment of the received data. The method further includes creating, by one or more processors, the alternative visualization.

Abstract: Software that generates statistical models of events impacting computer systems and uses those models to detect similar events in the future. The software performs the following operations: (i) receiving a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event; (ii) extracting a first set of feature vectors from the first set of values; (iii) generating a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and (iv) determining that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

Abstract: Deploying a model for anomaly detection in time series data. A period of data is received. A model of the period of data is received. It is determined that the model fits a part of the period of data and that the fitted part of the period of data includes the most recent data. A reduced model for the part of the period of data that fit the received model is built. The reduced model is deployed.

Abstract: Software that generates statistical models of events impacting computer systems and uses those models to detect similar events in the future. The software performs the following operations: (i) receiving a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event; (ii) extracting a first set of feature vectors from the first set of values; (iii) generating a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and (iv) determining that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

Abstract: Anomaly detection is provided. A first component of a first data resource of a plurality of data resources is identified. Each data resource of the plurality of data resources includes one or more components. A score of the first component is determined based, at least in part, on underlying data of the first component and underlying data of one or more other components of data resources of the plurality of data resources that correspond to the first component. An interest level of the first data resource is determined. A relationship between the score of the first component and the interest level of the first data resource is modeled.

Abstract: Anomaly detection is provided. A first component of a first data resource of a plurality of data resources is identified. Each data resource of the plurality of data resources includes one or more components. A score of the first component is determined based, at least in part, on underlying data of the first component and underlying data of one or more other components of data resources of the plurality of data resources that correspond to the first component. An interest level of the first data resource is determined. A relationship between the score of the first component and the interest level of the first data resource is modeled.