Data summary view

Patent metadata

Field	Value
Publication number	US-10185708-B2
Application number	US-201514815928-A
Country	US
Kind code	B2
Filing date	Jul 31, 2015
Priority date	Jan 30, 2015
Publication date	Jan 22, 2019
Grant date	Jan 22, 2019

Abstract

Embodiments of the present invention provide methods, computer-readable media, and systems directed at providing a data summary view. In some embodiments, a method may include receiving a request to display a data summary view of search results of a search query. The request may be received while the search results are displayed in a table format. The method may further include causing display of the data summary view. The data summary view can include a summary report for a selected event attribute of a plurality of event attributes that are represented in the table format. The summary report can include summary entries that present a summary of data items of the selected event attribute and a summary graph of the data items. The summary graph may depict a distribution of at least a subset of the data items of the selected event attribute over a period of time.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
receiving a request to display a data summary view of search results of a search query, the request being received while the search results are displayed in a table format within a search screen, the table format including:
a plurality of rows, each row representing an event of a set of events, the set of events satisfying the search query: and
a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

in response to receiving the request, causing display of the data summary view, the data summary view including a summary report that summarizes a set of the data items corresponding to a selected one of the event attributes associated with a respective one of the columns, the summary report including:
summary entries that present a summary of the set of data items of the selected event attribute; and
a summary graph of the set of data items, the summary graph depicting a graphical distribution of at least a subset of the set of data items of the selected event attribute over a period of time.

2. The computer-implemented method of claim 1 , wherein the data summary view includes an additional summary report for each of one or more additional event attributes of the plurality of event attributes, each additional summary report including summary entries and a summary graph of data items of a respective one of the one or more additional event attributes.

3. The computer-implemented method of claim 1 , wherein the data summary view includes additional summary reports such that the respective event attributes represented by the columns of the table format are each represented by a respective summary report, each of the additional summary reports including summary entries and a summary graph of data items for the respective event attribute.

4. The computer-implemented method of claim 1 , wherein causing display of the data summary view includes causing the data summary view to overlay the table format.

5. The computer-implemented method of claim 1 , wherein causing display of the data summary view includes causing the data summary view to overlay the table format, the method further comprising enabling a user to switch from the data summary view to the table format from within the data summary view and switch from the table format to the data summary view from within the table format.

6. The computer-implemented method of claim 1 , wherein causing display of the data summary view includes causing the data summary view to overlay the respective one of the columns that represents the selected event attribute.

7. The computer-implemented method of claim 1 , wherein causing display of the data summary view includes causing the data summary view to overlay the respective one of the columns that represents the selected event attribute such that a remainder of the table format is still visible.

8. The computer-implemented method of claim 1 ,
wherein each of the plurality of columns is selectable by a user,
wherein the request to display a data summary view includes an identifier of a column of the plurality of columns that has been selected by the user, and
wherein the selected event attribute is the respective event attribute represented by the identified column.

9. The computer-implemented method of claim 1 , wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:
in response to receiving a selection of a summary entry, updating the search query based on the selected summary entry.

10. The computer-implemented method of claim 1 , wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:
in response to receiving a selection of a summary entry:
causing display of a list of options corresponding to the selected summary entry; and
updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

11. The computer-implemented method of claim 1 , wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:
in response to receiving a selection of a summary entry:
causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute; and
updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

12. The computer-implemented method of claim 1 , wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:
in response to receiving a selection of a summary entry:
causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute, wherein the data type of the selected summary entry is a time data type, numeric data type, a categorical data type, or a user defined data type; and
updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

13. The computer-implemented method of claim 1 , wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:
in response to receiving a selection of a summary entry:
causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute;
updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options; and
automatically updating the search results and the summary report to correspond with the updated search query.

14. The computer-implemented method of claim 1 , wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:
in response to receiving a selection of a summary entry:
causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute;
updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options; and
automatically updating the search results and the summary report to correspond with the updated search query, wherein updating the search results comprises: applying a late binding schema to the set of events, the late binding schema associated with one or more extraction rules that are based on the updated search query.

15. The computer-implemented method of claim 1 , wherein the summary graph is interactive to enable selection, by the user, of values of data items of an event attribute within the summary graph, the method further comprising:
in response to receiving a selection of a value within the summary graph by the user:
causing display of a list of options corresp

Assignees

• Splunk Inc

Inventors

• Miller Jesse
• Robichaud Marc V
• Burke Cory
• Lloyd Jeffrey Thomas

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• G06F40/177

  of tables; using ruled lines · CPC title

• G06Q10/00

  Administration; Management · CPC title

• G06F16/235

  Update request formulation · CPC title

• G06F3/04842

  Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) · CPC title