Punchcard chart visualization for machine data search and analysis system

Patent metadata

Field	Value
Publication number	US-10459938-B1
Application number	US-201615224612-A
Country	US
Kind code	B1
Filing date	Jul 31, 2016
Priority date	Jul 31, 2016
Publication date	Oct 29, 2019
Grant date	Oct 29, 2019

Abstract

Disclosed are a system and a method for providing user-interactive flow diagrams such as Sankey diagrams. In an embodiment, a machine data search and analysis system retrieving search results including a plurality of events, in response to a search query. The system identifies a first characteristic type from data of the plurality of events as a horizontal dimension of a multi-dimensional chart, and a second characteristic type from the retrieved data as a vertical dimension of the multi-dimensional chart. The system causes display of the multi-dimensional chart indicative of the data of the plurality of events. The multi-dimensional chart includes a table of a plurality of objects. Each object of the plurality of objects represents one or more events that share a common value of the first characteristic type and share a common value of the second characteristic type.

First claim

What is claimed is:

1. A method comprising:
in response to a search query, retrieving search results including a plurality of events, each of the plurality of events containing time-stamped data, at a system for indexing and searching data;
identifying a first characteristic type from the time-stamped data of the plurality of events as a horizontal dimension of an interactive multi-dimensional chart, and a second characteristic type from the time-stamped data as a vertical dimension of the interactive multi-dimensional chart; and
causing display of the interactive multi-dimensional chart indicative of the time-stamped data of the plurality of events, the interactive multi-dimensional chart including a table of a plurality of objects, each object of the plurality of objects representing one or more events that share a common value of the first characteristic type and share a common value of the second characteristic type;
wherein causing display of the interactive multi-dimensional chart includes:
formatting the time-stamped data corresponding to the plurality of events into a data object that is readable by a code library for generating a static visualization;
receiving state information that is indicative of a current state of display of the interactive multi-dimensional chart, wherein use of the state information enables the interactive multiple-dimensional chart to be displayed at a plurality of different devices without saving a rendering of the interactive multiple-dimensional chart; and
processing the data object using the code library to render the interactive multi-dimensional chart based on the received state information.

2. The method of claim 1 , wherein the time-stamped data comprises machine data.

3. The method of claim 1 , wherein the time-stamped data comprises real-time event data.

4. The method of claim 1 , further comprising:
in response to a signal indicative of a user interaction with an individual object of the plurality of objects of the interactive multi-dimensional chart, identifying a subset of events that correspond with the individual object; and
dynamically updating display of the interactive multi-dimensional chart by processing the subset of events using the code library.

5. The method of claim 1 , wherein the code library is open source.

6. The method of claim 1 , further comprising:
continually updating the interactive multi-dimensional chart when the search results are updated with new events.

7. The method of claim 1 , wherein a size of each individual object is indicative of a total number of the one or more events or a result of a statistical aggregation from a field across the one or more events, the one or more events sharing the common value of the first characteristic type and sharing the common value of the second characteristic type.

8. The method of claim 1 , wherein a color of each individual object is indicative of a common value of a third characteristic type shared by the one or more events.

9. The method of claim 1 , wherein a color of each individual object is indicative of a data range of a field that is shared by the one or more events.

10. The method of claim 1 , wherein a color of each individual object is indicative of a category that is shared by the one or more events.

11. The method of claim 1 , wherein the plurality of objects are a plurality of dots.

12. The method of claim 1 , further comprising:
in response to a cursor being positioned over an individual object of the plurality of objects, displaying a total number of the one or more events that share the common value of the first characteristic type and share the common value of the second characteristic type.

13. The method of claim 1 , further comprising:
in response to a cursor being positioned over an individual object of the plurality of objects, displaying a hovering window that includes additional information related to the individual object.

14. The method of claim 1 , further comprising:
in response to a cursor being positioned over an individual object of the plurality of objects, displaying an event represented by the individual object.

15. The method of claim 1 , wherein the horizontal dimension represents a first time unit and the vertical dimension represents a second time unit, the first time unit being a subset of the second time unit.

16. The method of claim 1 , further comprising:
generating a user interface element for users to specify a time range of events as part of the search query.

17. The method of claim 1 , further comprising:
in response to a user input, dynamically switching the interactive multi-dimensional chart between a categorical color mode and a sequential color mode;
wherein in a sequential color mode, a color of an individual object of the plurality of objects is indicative of a data range of a field that is shared by the events represented by the individual object; and
wherein in a categorical color mode, a color of an individual object of the plurality of objects is indicative of a category that is shared by the events represented by the individual object.

18. The method of claim 1 , further comprising:
displaying the plurality of objects in a plurality of colors, wherein a color of an individual object of the plurality of objects denotes a data range of a field that is shared by the events represented by the individual object;
in response to a user input, adjusting the data ranges of the field for the plurality of colors; and
dynamically changing the colors of the objects based on the adjusted data range of the field.

19. The method of claim 1 , further comprising:
in response to a signal indicative of a user input selecting an individual object of the plurality of objects, identifying the one or more events represented by the individual object as a selected subset; and
generating a second interactive multi-dimensional chart indicative of time-stamped data of the subset of events.

20. The method of claim 1 , further comprising:
in response to a signal indicative of a user input selecting an individual object of the plurality of objects, identifying a subset of events that correspond with the individual object;
receiving a user input identifying a third characteristic type from time-stamped data of the subset of events as a horizontal dimension of the interactive multi-dimensional chart, and identifying a fourth characteristic type from the time-stamped data of the subset of events as a vertical dimension of the interactive multidimensional chart; and
dynamically updating the interactive multi-dimensional chart to include a second table of a second plurality of objects, each object of the second plurality of objects representing one or more of the subset of events that share a common value of the third characteristic type and share a common value of the fourth characteristic type.

21. The method of claim 1 , further comprising:
in response to a signal indicative of a user input selecting an individual object of the plurality of objects, identifying a subset of events that correspond with the individual object;
automatically identifying, without requiring further human input, a third characteristic type from time-stamped data of the subset of events as a horizontal dimension of the interactive multi-dimensional chart, and a fourth characteristic type from the time-stamped data of the subset of events as a vertical dimension of the interactive multi-dimensional chart; and
dynamically updating the interactive m

Assignees

• Splunk Inc

Inventors

• Agnew Marshall Chalmers
• Porath Michael
• Wied Patrick
• Mullen Clark Eugene

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• G06F16/248 Primary

  Presentation of query results · CPC title

• G06F16/26

  Visual data mining; Browsing structured data · CPC title

• G06F3/0482

  Interaction with lists of selectable items, e.g. menus · CPC title

• G06F16/2264

  Multidimensional index structures · CPC title