Loading queries using search points

Patent metadata

Field	Value
Publication number	US-11429600-B2
Application number	US-202016776317-A
Country	US
Kind code	B2
Filing date	Jan 29, 2020
Priority date	Jul 27, 2016
Publication date	Aug 30, 2022
Grant date	Aug 30, 2022

Abstract

A method includes causing display to a user of at least one event of a first result set from a first pipelined search on events at an event source. Each event comprises a time stamp and a portion of machine data. A selection of a command is received from the user. The selection is to extend the first pipelined search with the selected command in a second pipelined search. The system selects between the first result set and the event source for execution of the second pipelined search based on an analysis of the selected command and at least one command of the first pipelined search. Based on the selecting being of the first result set, display to the user is caused of at least one event of a second result set from the execution of the second pipelined search on the first result set.

First claim

The invention claimed is:

1. A computer-implemented method, the method comprising:
receiving, by at least one processor, a request to load a pipelined search that defines a sequence of commands;
responsive to the request, identifying, by the at least one processor, a search point of the pipelined search that corresponds to a command that is prior to a subsequent command in the sequence of commands based at least on an analysis of the command;
receiving, by the at least one processor, a first result set that corresponds to the search point of the pipelined search;
based on the identifying, executing, by the at least one processor, a query on the first result set, the query comprising one or more commands from the sequence of commands that implement a portion of the pipelined search from the search point through to a subsequent point in the pipelined search that corresponds to the subsequent command; and
causing, by the at least one processor, display of at least one event of a second result set from the executing of the query on the first result set.

2. The computer-implemented method of claim 1 , wherein the receiving of the request is in response to a selection from a user interface to load the pipelined search into a search interface, and the pipelined search is a saved pipeline loaded from a data object that represents the saved pipeline.

3. The computer-implemented method of claim 1 , wherein the analysis includes determining a most recent filtering command in the pipelined search that is prior to the subsequent command in the sequence of commands.

4. The computer-implemented method of claim 1 , wherein the analysis is of a plurality of commands of the sequence of commands.

5. The computer-implemented method of claim 1 , wherein a plurality of commands in the sequence of commands each have respective metadata and the analysis is of the metadata of the plurality of commands.

6. The computer-implemented method of claim 1 , wherein the subsequent point of the pipelined search is an endpoint of the pipelined search.

7. The computer-implemented method of claim 1 , further comprising constructing the query to include at least one command that instructs a search to be executed on the first result set.

8. The computer-implemented method of claim 1 , wherein prior to the request to load the pipelined search, the command is added to the sequence of commands based on a selection of an option of a plurality of selectable options in an option menu, each selectable option corresponding to one or more of the plurality of selectable commands.

9. The computer-implemented method of claim 1 , further comprising:
receiving, from a user interface, a selection of an additional command to use to extend the pipelined search in an extended pipelined search corresponding to a data processing pipeline defined by the pipelined search with an extended portion that comprises the selected additional command;
analyzing the selected additional command and at least one command of the pipelined search to select between an execution the extended pipelined search on an event source or the second result set; and
based at least in part on the analyzing, selecting the second result set for the execution and causing the user interface to present one or more events of a third result set from the execution of the extended pipelined search on the second result set.

10. The computer-implemented method of claim 1 , further comprising:
receiving, from a user interface, a selection of an additional command to use to extend the pipelined search in an extended pipelined search corresponding to a data processing pipeline defined by the pipelined search with an extended portion that comprises the selected additional command;
analyzing the selected additional command and at least one command of the pipelined search to select between an execution of the extended pipelined search on an event source or the second result set; and
based at least in part on the analyzing, selecting the event source for the execution and causing the user interface to present one or more events of a third result set from the execution of the extended pipelined search on the event source.

11. The computer-implemented method of claim 1 , further comprising:
assigning the first result set as the search point of the pipelined search prior to the receiving of the request to load the pipelined search; and
in response to the request, identifying the first result set for the executing of the query based on the first result set being assigned as the search point.

12. The computer-implemented method of claim 1 , further comprising, at a first time prior to the request to load the pipelined search, generating the first result set based on an execution of the pipelined search on an event source, wherein at a second time of the executing of the query, the event source includes at least one different event than at the first time.

13. The computer-implemented method of claim 1 , where the first result set comprises a plurality of events that includes the at least one event of the second result set, each event comprising a time stamp and a portion of machine data.

14. The computer-implemented method of claim 1 , wherein the executing of the query applies a late-binding schema to the at least one event of the second result set.

15. The computer-implemented method of claim 1 , wherein the query is represented in a pipeline query language that specifies the one or more commands.

16. One or more non-transitory computer-readable media having instructions stored thereon, the instructions, when executed by at least one processor of a computing device, to cause the computing device to perform a method comprising:
receiving, by at least one processor, a request to load a pipelined search that defines a sequence of commands;
responsive to the request, identifying, by the at least one processor, a search point of the pipelined search that corresponds to a command that is prior to a subsequent command in the sequence of commands based at least on an analysis of the command;
receiving, by the at least one processor, a first result set that corresponds to the search point of the pipelined search;
based on the identifying, executing, by the at least one processor, a query on the first result set, the query comprising one or more commands from the sequence of commands that implement a portion of the pipelined search from the search point through to a subsequent point in the pipelined search that corresponds to the subsequent command; and
causing, by the at least one processor, display of at least one event of a second result set from the executing of the query on the first result set.

17. The one or more computer-readable media of claim 16 , wherein the receiving of the request is in response to a selection from a user interface to load the pipelined search into a search interface.

18. The one or more computer-readable media of claim 16 , wherein the analysis includes determining a most recent filtering command in the pipelined search that is prior to the subsequent command in the sequence of commands.

19. The one or more computer-readable media of claim 16 , wherein the analysis is of a plurality of commands of the sequence of commands.

20. The one or more computer-readable media of claim 16 , wherein a plurality of commands in the sequence of commands each have respective metadata and the analysis is of the metadata of the plurality of commands.

21. The one or more computer-readable med

Assignees

• Splunk Inc

Inventors

• Miller Jesse Brandau
• Robichaud Marc V
• Burke Cory Eugene

Classifications

• G06F16/248

  Presentation of query results · CPC title

• G06F16/2455

  Query execution · CPC title

• G06F16/2425 Primary

  Iterative querying; Query formulation based on the results of a preceding query · CPC title

• G06F16/2428

  Query predicate definition using graphical user interfaces, including menus and forms (G06F16/2423 takes precedence) · CPC title