Data source correlation user interface

Patent metadata

Field	Value
Publication number	US-10997192-B2
Application number	US-201916264562-A
Country	US
Kind code	B2
Filing date	Jan 31, 2019
Priority date	Jan 31, 2019
Publication date	May 4, 2021
Grant date	May 4, 2021

Abstract

Systems and methods are disclosed for implementing a data stream correlation user interface. The data stream correlation user interface provides workflows for selecting individual data sources from a matrix of data sources, identifying individual data fields of the data sources, establishing criteria for determining correlations between them, and reviewing and enabling user verification of correlated data sources. Correlations may be established based on the values of data fields in individual records of the data sources, and may be determined based on correspondences or associations between the values, lookup tables, formulas, user-specified criteria, or other relationships.

First claim

What is claimed is:

1. A computer-implemented method comprising:
receiving, via a first user interface that displays a plurality of data sources as a matrix and enables selection of individual data sources, information indicating selection of a first data source and a second data source from the plurality of data sources, wherein the first data source comprises a first set of records corresponding to a first plurality of data fields, and wherein the second data source comprises a second set of records corresponding to a second plurality of data fields;
receiving, via a second user interface that enables selection of individual data fields from the first plurality of data fields and the second plurality of data fields, information indicating selection of a first data field from the first plurality of data fields and a second data field from the second plurality of data fields; and
displaying a third user interface that includes information regarding one or more associations between individual records of the first set of records and individual records of the second set of records, the one or more associations determined based at least in part on the first data field and the second data field.

2. The computer-implemented method of claim 1 , wherein the one or more associations associate a first record in the first set of records with a plurality of records in the second set of records.

3. The computer-implemented method of claim 1 , wherein the one or more associations associate a plurality of records in the first set of records with a first record in the second set of records.

4. The computer-implemented method of claim 1 further comprising receiving, via the second user interface, information indicating selection of an additional data field from the first plurality of data fields.

5. The computer-implemented method of claim 1 , wherein the information regarding the one or more associations includes a value of the first data field, a value of the second data field, and a value of an additional data field from the first plurality of data fields.

6. The computer-implemented method of claim 1 , wherein the first data field of the first data source corresponds to the second data field of the second data source.

7. The computer-implemented method of claim 1 , wherein values stored in the first data field of the first data source comprise a representation of values stored in the second data field of the second data source.

8. The computer-implemented method of claim 1 , wherein values stored in the first data field of the first data source link event data stored in individual records of the first data source to event data stored in individual records of the second data source.

9. The computer-implemented method of claim 1 , wherein the one or more associations between individual records of the first set of records and individual records of the second set of records are determined based at least in part on a value of the first data field in a record of the first data source corresponding to a value of the second data field in a record of the second data source.

10. The computer-implemented method of claim 1 , wherein the second user interface displays a percentage of records of the first data source that are associated with one or more records of the second data source.

11. The computer-implemented method of claim 1 , wherein the second user interface includes controls that enable selection of either the first data source or the second data source.

12. The computer-implemented method of claim 1 further comprising:
receiving, via the second user interface, information indicating a selection of the second data source;
determining, based at least in part on the first data field and the second data field, a percentage of records of the second data source that are associated with one or more records of the first data source; and
updating the second user interface to display the percentage.

13. The computer-implemented method of claim 1 , wherein the second user interface comprises one or more columns, each of the one or more columns corresponding to a respective data field of at least one of the first data source or the second data source.

14. The computer-implemented method of claim 1 , wherein the second user interface comprises one or more rows, each of the one or more rows corresponding to a respective record of at least one of the first data source or the second data source.

15. The computer-implemented method of claim 1 , wherein the second user interface comprises one or more rows corresponding to individual records of the first data source, and wherein each of the one or more rows indicates whether an individual record of the first data source is associated with at least one record of the second data source.

16. The computer-implemented method of claim 1 , wherein the one or more associations between individual records of the first set of records and individual records of the second set of records are determined based at least in part on a lookup table.

17. The computer-implemented method of claim 1 , wherein the one or more associations between individual records of the first set of records and individual records of the second set of records are determined based at least in part on one or more criteria.

18. The computer-implemented method of claim 1 further comprising obtaining one or more criteria for determining associations between individual records of the first set of records and individual records of the second set of records.

19. The computer-implemented method of claim 1 , wherein the second user interface enables input of one or more criteria for determining associations between individual records of the first set of records and individual records of the second set of records.

20. The computer-implemented method of claim 1 , wherein the one or more associations between individual records of the first set of records and individual records of the second set of records are determined based at least in part on a degree of correlation between the first data field and the second data field.

21. The computer-implemented method of claim 1 , wherein the one or more associations between individual records of the first set of records and individual records of the second set of records are determined based at least in part on a degree of correlation satisfying a threshold.

22. The computer-implemented method of claim 1 , wherein the second user interface displays information regarding a degree of correlation between the first data field and the second data field.

23. The computer-implemented method of claim 1 further comprising updating the first user interface to indicate that the first data source has been associated with the second data source.

24. The computer-implemented method of claim 1 , wherein the information indicating selection of a first data source and a second data source comprises information indicating selection of a cell of the matrix, wherein the first data source corresponds to a row of the matrix containing the cell, and wherein the second data source corresponds to a column of the matrix containing the cell.

25. The computer-implemented method of claim 1 , wherein selection of the first data source and the second data source via the first user interface causes display of the second user interface.

26. The computer-implemented method of claim 1 , wherein selection of the first data field c

Assignees

• Splunk Inc

Inventors

• Boster Paul
• Kramer Keith
• Noel Cary
• Park Isabelle

Classifications

• G06F16/252

  between a Database Management System and a front-end application · CPC title

• G06F16/248 Primary

  Presentation of query results · CPC title

• G06F3/04842

  Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) · CPC title