Techniques are described for providing a ML data analytics application including guided ML workflows that facilitate the end-to-end training and use of various types of ML models, where such guided workflows may also be referred to as ML “experiments.” For example, the ML data analytics application may enable users to create experiments related to prediction of numeric fields (for example, using linear regression techniques), predicting categorical fields (for example, using logistic regression), detecting numerical outliers (for example, using various distribution statistics), detecting categorical outliers (for example, using probabilistic statistics), forecasting time series data, and clustering numeric events (for example, using k-means, density-based spatial clustering of applications with noise (DBSCAN), spectral clustering, or other techniques), among other possible uses of various types of ML models to analyze data.

Operational machine components of an information technology (IT) or other microprocessor- or microcontroller-permeated environment generate disparate forms of machine data. Network connections are established between these components and processors of an automatic data intake and query system (DIQS). The DIQS conducts network transactions on a periodic and/or continuous basis with the machine components to receive the disparate data and ingest certain of the data as measurement entries of a DIQS metrics datastore that is searchable for DIQS query processing. The DIQS may receive search queries to process against the received and ingested data via an exposed network interface. In one example embodiment, a query building component conducts a user interface using a network attached client device. The query building component may elicit search criteria via the user interface using a natural language interface, construct a proper query therefrom, and present new information based on results returned from the DIQS.

Disclosed is a technique that can be performed by a server computer system. The technique can include obtaining data from each of multiple endpoint devices to form global data. The global data can be generated by the endpoint devices in accordance with local instructions in each of the endpoint devices. The technique further includes generating global instructions based on the global data and sending the global instructions to a particular endpoint device. The global instructions configure the particular endpoint device to perform a data analytic operation that analyzes events. The events can include raw data generated by a sensor of the particular endpoint device.

Computer-implemented techniques for data extraction are described. The techniques include a method and system for retrieving an extraction job specification, wherein the extraction job specification comprises a source repository identifier that identifies a source repository comprising a plurality of data records; a data recipient identifier that identifies a data recipient; and a schedule that indicates a timing of when to retrieve the plurality of data records. The method and system further include retrieving the plurality of data records from the source repository based on the schedule, creating an extraction transaction from the plurality of data records, wherein the extraction transaction comprises a subset of the plurality of data records and metadata, and sending the extraction transaction to the data recipient.

Computer-implemented techniques for data extraction are described. The techniques include a method and system for retrieving an extraction job specification, wherein the extraction job specification comprises a source repository identifier that identifies a source repository comprising a plurality of data records; a data recipient identifier that identifies a data recipient; and a schedule that indicates a timing of when to retrieve the plurality of data records. The method and system further include retrieving the plurality of data records from the source repository based on the schedule, creating an extraction transaction from the plurality of data records, wherein the extraction transaction comprises a subset of the plurality of data records and metadata, and sending the extraction transaction to the data recipient.

A computer-implemented method may include monitoring an age of a tile of a map, where the map includes multiple tiles including the tile. The method may also include, based on the age exceeding a threshold age, determining that the tile of the map is to be updated, and receiving a location indicator from a vehicle. The method may additionally include transmitting an update message to a vehicle traversing a track within the tile as indicated by the location indicator, where the update message includes instructions to cause the vehicle to gather and submit sensor data to a computing system. The method may also include receiving the sensor data from the vehicle, and updating the tile of the map based on the received sensor data.

Systems and methods are described for assigning a processing task from one component of a data intake and query system to a different component of the data intake and query system. As part of processing a query, the system can determine that a particular processing task is to be executed by a particular component of the data intake and query system. Based on the characteristics of the component that is to execute the processing task, the system can assign the task or a supplemental task to one or more other components of the data intake and query system.

A method comprising receiving by an arbitrary query engine a user request to perform a query associated with user data including first data and second data; partitioning the query into first and second sub-queries; providing the first sub-query to a first service provider interface (SPI) integrated into a first service configured to operate on the first data in a first datastore, the first SPI including a common interface component configured based on a uniform access specification to facilitate external communication between the arbitrary query engine and the first SPI, and the first SPI including a first service interface component configured to transform between the uniform access specification and a first service data specification and to facilitate internal data management; obtaining from the first datastore the first data formatted according to the first service data specification; transforming the first data; and providing the transformed first data to the arbitrary query engine.

Embodiments are directed towards a graphical user interface identify locations within event records with splittable timestamp information. A display of event records is provided using any of a variety of formats. A splittable timestamp selector allows a user to select one or more locations within event records as having time related information that may be split across the one or more locations, including, information based on date, time of day, day of the week, or other time information. Any of a plurality of mechanisms is used to associate the selected locations with the split timestamp information, including tags, labels, or header information within the event records. In other embodiments, a separate table, list, index, or the like may be generated that associates the selected locations with the split timestamp information. The split timestamp information may be used within extraction rules for selecting subsets or the event records.

A data analytics system may include a first risk relationship data store containing electronic records that represent a plurality of risk relationships between the enterprise and a first risk relationship provider. Similarly, a second risk relationship data store containing electronic records that represent a plurality of risk relationships between the enterprise and a second risk relationship provider. A back-end application computer server may include a data mining engine that analyzes a set of electronic records in the first and second risk relationship data stores to identify flags corresponding to risk drivers. A predictive analytics engine may then calculate a risk score associated with the set of electronic records based on the associated entity attribute values and the identified flags corresponding to risk drivers. An insight platform may automatically generate a recommended action for the enterprise to lower the calculated risk score.