Determining rules based on text

Patent metadata

Field	Value
Publication number	US-11100150-B2
Application number	US-201715582671-A
Country	US
Kind code	B2
Filing date	Apr 29, 2017
Priority date	Jan 23, 2013
Publication date	Aug 24, 2021
Grant date	Aug 24, 2021

Abstract

Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

First claim

The invention claimed is:

1. A computer-implemented method, comprising:
accessing in memory a set of events, each event identified by an associated time stamp and including a portion of raw data from machine data;
transmitting for display a user interface including a first event and a plurality of second events of the set of events;
receiving data indicating a selected portion of text within the first event;
automatically determining a field extraction rule that extracts as a field value the selected portion of text when the field extraction rule is applied to the first event;
transmitting for display an updated user interface that includes the second events and that visually emphasizes, within the corresponding second event, a field value extracted for each second event by applying the extraction rule to the second events;
receiving a rejection of a visually emphasized field value extracted by applying the extraction rule to a particular second event, the rejection indicating that the rejected field value in the particular second event does not comprise a desired value to extract from the particular second event via the extraction rule;
based on the rejection of the visually emphasized field value of the particular second event, automatically modifying the field extraction rule such that the modified field extraction rule extracts the selected portion of text within the first event when the modified field extraction rule is applied and does not extract the rejected field value in the particular second event when the modified field extraction rule is applied; and
transmitting for display a second updated user interface presenting the second events, including the particular second event with the rejected field value, wherein the rejected field value presented within the particular second event is visually de-emphasized to indicate that the rejected field value in the particular second event is not extracted.

2. The method of claim 1 , wherein the first event includes unstructured data.

3. The method of claim 1 , further comprising:
receiving a selected portion of text within a third event that is not indicated as being selected by the field extraction rule; and
modifying the modified field extraction rule to extract the selected portion of text within the first event and to also extract the selected portion of text within the third event.

4. The method of claim 1 , wherein the field extraction rule comprises a regular expression.

5. The method of claim 1 , further comprising:
displaying natural language representing the field extraction rule;
receiving an edit to the natural language;
determining a new modified field extraction rule corresponding to the edited natural language;
and
determining values for the field corresponding to the new modified field extraction rule.

6. The method of claim 1 , further comprising determining a data type of the selected portion of text within the first event, and wherein determining the field extraction rule that extracts as the field value from the selected portion of text within the first event further comprises extracting a value of the data type as the value of the field for at least one other event.

7. The method of claim 1 , further comprising:
receiving an indication that a value is to serve as a counter example for the field; and
modifying the field extraction rule to bias against identifying the counter-example value as a value for the field.

8. A network device that is operative for generating extraction rules, comprising:
a transceiver that is operative to communicate over a network;
a memory that is operative to store at least instructions; and
a processor device that is operative to execute instructions that enable actions, including:
accessing in memory a set of events, each event identified by an associated time stamp, wherein each event in the set of events includes a portion of raw data from machine data;
transmitting for display a user interface including a first event and a plurality of second events of the set of events;
receiving data indicating a selection of a portion of text within the first event;
automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event;
transmitting for display an updated user interface that includes the second events and that visually emphasizes, within the corresponding second event, a value of the field extracted by applying the extraction rule to the second events;
receiving a rejection of a visually emphasized field value extracted by applying the extraction rule to a particular second event, the rejection indicating that the rejected field value in the particular second event does not comprise a desired value to extract from the particular second event via the extraction rule;
based on the rejection of the visually emphasized field value of the particular second event, automatically modifying the field extraction rule such that the modified field extraction rule extracts the selected portion of text within the first event when the modified field extraction rule is applied and would not extract the rejected field value in the particular second event when the modified field extraction rule is applied; and
transmitting for display a second updated user interface presenting the second events, including the particular second event with the rejected field value, wherein the rejected field value presented within the particular second event is visually de-emphasized to indicate that the rejected field value in the particular second event is not extracted.

9. The network device of claim 8 , wherein the first event includes machine data.

10. The network device of claim 8 , wherein the first event includes unstructured data.

11. The network device of claim 8 , wherein storing the plurality of events includes indexing each event of the plurality of events.

12. The network device of claim 8 , wherein the actions further comprise:
receiving a selected portion of text within a third event that is not indicated as being selected by the field extraction rule; and
modifying the modified field extraction rule to extract the selected portion of text within the first event and to also extract the selected portion of text within the third event.

13. The network device of claim 8 , wherein the field extraction rule comprises a regular expression.

14. The network device of claim 8 , wherein the actions further comprise:
displaying natural language representing the field extraction rule;
receiving an edit to the natural language;
determining a new modified field extraction rule corresponding to the edited natural language;
and
determining values for the field corresponding to the new modified field extraction rule.

15. The network device of claim 8 , wherein the actions further comprise determining a data type of the selection of the portion of text within the first event, and wherein determining the field extraction rule that extracts as the value of the field the selection of the portion of text within the first event comprises determining that the field extraction rule would extract a value comprising the data type as the value of the field for at least one other event.

16. A processor readable non-transitive storage media that includes instructions for generating extraction rules over a network, wherein execution of the instructions by a processor device enables actions, comprising:
accessing in memory a set of events, each event identified by

Assignees

• Splunk Inc

Inventors

• Carasso R David
• Delfino Micah James
• Hwang Johnvey

Classifications

• G06F16/34 Primary

  Browsing; Visualisation therefor (browsing or visualisation for clustering or classification G06F16/358) · CPC title

• G06F16/242 Primary

  Query formulation · CPC title

• G06F16/2477

  Temporal data queries · CPC title

• G06F3/0484

  for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title