US 12,169,471 B2
Managing datasets generated by search queries
Qianjie Zhong, Shanghai (CN); Ting Wang, Shanghai (CN); Margaret Lee, Dublin, CA (US); Dawei Li, Shanghai (CN); Nick Filippi, Atherton, CA (US); Yue Ni, Shanghai (CN); and Shiming Yuan, Shanghai (CN)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Feb. 10, 2022, as Appl. No. 17/669,156.
Application 17/669,156 is a continuation of application No. 16/777,357, filed on Jan. 30, 2020, granted, now 11,288,231.
Application 16/777,357 is a continuation of application No. 15/461,076, filed on Mar. 16, 2017, granted, now 10,585,851, issued on Mar. 10, 2020.
Application 15/461,076 is a continuation of application No. 14/396,367, abandoned, previously published as PCT/CN2014/081910, filed on Jul. 9, 2014.
Prior Publication US 2022/0171736 A1, Jun. 2, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 16/11 (2019.01); G06F 11/07 (2006.01); G06F 16/16 (2019.01); G06F 16/245 (2019.01); G06F 16/2455 (2019.01); G06F 16/2458 (2019.01); G06F 16/25 (2019.01); G06F 16/9535 (2019.01); G08B 21/18 (2006.01)
CPC G06F 16/125 (2019.01) [G06F 11/0727 (2013.01); G06F 11/0775 (2013.01); G06F 16/162 (2019.01); G06F 16/245 (2019.01); G06F 16/2455 (2019.01); G06F 16/24565 (2019.01); G06F 16/2477 (2019.01); G06F 16/254 (2019.01); G06F 16/9535 (2019.01); G08B 21/18 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method performed by one or more processing devices, the method comprising:
executing a search query on a portion of searchable data specified by a time window defined relative to a current time, to produce a dataset comprising one or more results;
determining that a portion of the dataset satisfies a triggering condition defining an alert associated with the search query;
generating, based on the triggering condition being satisfied, an instance of the alert;
associating, using a memory data structure, the instance of the alert with an identifier of the search query and a time parameter specifying a time of execution of the search query that has triggered the instance of the alert;
receiving, from a client computing device, a request for the portion of the dataset; and
reproducing the portion of the dataset that satisfies the triggering condition defining the alert by re-executing the search query, modified via a system component, including a filtering condition that substitutes the time window defined relative to the current time with the time window defined relative to the time parameter specifying the time of execution of the search query that triggered the instance of the alert, the time parameter identified via the memory data structure.