Source type definition configuration using a graphical user interface

Patent metadata

Field	Value
Publication number	US-11789901-B2
Application number	US-202117443436-A
Country	US
Kind code	B2
Filing date	Jul 26, 2021
Priority date	Jan 30, 2015
Publication date	Oct 17, 2023
Grant date	Oct 17, 2023

Abstract

A data intake and query system provides interfaces that enable users to configure source type definitions used by the system. A data intake and query system generally refers to a system for collecting and analyzing data including machine-generated data. Such a system may be configured to consume many different types of machine data generated by any number of different data sources including various servers, network devices, applications, etc. At a high level, a source type definition comprises one or more properties that define how various components of a data intake and query system collect, index, store, search and otherwise interact with particular types of data consumed by the system. The interfaces provided by the system generally comprise one or more interface components for configuring various attributes of a source type definition.

First claim

The invention claimed is:

1. A method, comprising:
causing a display to display a graphical user interface, wherein the graphical user interface includes:
an attribute of data of a particular source type, wherein data of the particular source type is generated by one or more computing devices in an information technology environment, and
a user editable field for entering a value associated with the attribute;

receiving, via the graphical user interface, user input corresponding to the value for the attribute;
storing, in a configuration file, the value in association with the attribute as an attribute-value pair of a plurality of attribute-value pairs that correspond to data of the particular source type; and
causing the configuration file to be stored on at least one computing device of a data intake and query system, wherein the at least one computing device uses the attribute-value pair to generate at least one event from data of the particular source type.

2. The method of claim 1 , further comprising:
subsequent to causing the configuration file to be stored on the at least one computing device, receiving a query for data of the particular source type; and
processing, the query based at least in part on the attribute-value pair stored in the configuration file.

3. The method of claim 1 , wherein the configuration file further includes at least one attribute related to determining a timestamp for events generated from data of the particular source type.

4. The method of claim 1 , wherein the configuration file further includes at least one attribute related to extracting at least one field from events generated from data of the particular source type.

5. The method of claim 1 , wherein the value stored in association with the attribute comprises a regular expression.

6. The method of claim 1 , wherein causing the configuration file to be stored on at least one computing devices comprises communicating the configuration file to the at least one computing device.

7. The method of claim 1 , wherein the graphical user interface is a first graphical user interface, the method further comprising:
causing display of a second graphical user interface displaying a list of source type definitions; and
receiving an indication of a selection of a particular source type definition from the list of source type definitions,
wherein the first graphical user interface is caused to be displayed in response to receiving an indication of the selection of the particular source type definition.

8. The method of claim 1 , wherein the graphical user interface is a first graphical user interface, the method further comprising:
causing display of a second graphical user interface displaying a list of source type definitions,
wherein the second graphical user interface includes one or more interface components to create a new source type definition or to delete at least one source type definition from the list of source type definitions.

9. The method of claim 1 , further comprising:
receiving, by the at least one computing device, particular data of the particular source type; and
based at least in part on the value stored in the configuration file:
generating, by the at least one computing device, a plurality of events from the particular data, and
determining, by the at least one computing device, a timestamp for each event of the plurality of events.

10. The method of claim 1 , further comprising:
obtaining a sample of data of the particular source type;
generating a plurality of sample events using the value in association with the attribute; and
causing display of the plurality of sample events.

11. The method of claim 1 , further comprising:
obtaining a sample of data of the particular source type;
generating a plurality of sample events using the value in association with the attribute;
causing display of the plurality of sample events; and
receiving, via the graphical user interface, an indication that the plurality of sample events are approved, wherein the causing the configuration file to be stored on the at least one computing device is based at least in part on the receiving the indication that the plurality of sample events are approved.

12. Non-transitory, computer-readable storage media storing computer-executable instructions that, when executed by one or more computing devices of a data intake and query system, cause the one or more computing devices to:
cause a display to display a graphical user interface, wherein the graphical user interface includes:
an attribute of data of a particular source type, wherein data of the particular source type is generated by one or more computing devices in an information technology environment, and
a user editable field for entering a value associated with the attribute;

receive, via the graphical user interface, user input corresponding to the value for the attribute;
store, in a configuration file, the value in association with the attribute as an attribute-value pair of a plurality of attribute-value pairs that correspond to data of the particular source type; and
cause the configuration file to be stored on at least one computing device of the data intake and query system, wherein the at least one computing device uses the attribute-value pair to generate at least one event from data of the particular source type.

13. The non-transitory, computer-readable storage media of claim 12 , wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
receive a query for data of the particular source type; and
process the query based at least in part on the attribute-value pair stored in the configuration file.

14. The non-transitory, computer-readable storage media of claim 12 , wherein the graphical user interface is a first graphical user interface, and wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
cause display of a second graphical user interface displaying a list of source type definitions; and
receive an indication of a selection of a particular source type definition from the list of source type definitions,
wherein the first graphical user interface is caused to be displayed in response to receipt of the indication of the selection of the particular source type definition.

15. The non-transitory, computer-readable storage media of claim 12 , wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
obtain a sample of data of the particular source type;
generate a plurality of sample events using the value in association with the attribute; and
cause display of the plurality of sample events.

16. The non-transitory, computer-readable storage media of claim 12 , wherein the computer-executable instructions, when executed by the one or more computing devices, further cause the one or more computing devices to:
obtain a sample of data of the particular source type;
generate a plurality of sample events using the value in association with the attribute;
cause display of the plurality of sample events; and
receive, via the graphical user interface, an indication that the plurality of sample events are approved, wherein the configuration file is stored on the at least one computing device based at least in part on receipt of the indication that the plurality of sample events are approved.

17. A syst

Assignees

• Splunk Inc

Inventors

• Munk Alexander D
• Miller Jesse

Classifications

• G06F16/13 Primary

  File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) · CPC title

• G06F3/0482

  Interaction with lists of selectable items, e.g. menus · CPC title

• G06F16/148

  File search processing · CPC title

• G06F16/168

  Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs (query results presentation G06F16/156) · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title