Discovering fields to filter data returned in response to a search

Patent metadata

Field	Value
Publication number	US-9582585-B2
Application number	US-201414448937-A
Country	US
Kind code	B2
Filing date	Jul 31, 2014
Priority date	Sep 7, 2012
Publication date	Feb 28, 2017
Grant date	Feb 28, 2017

Abstract

Fields may be discovered in events that are returned in response to an initial search. The events may comprise portions of raw data. Furthermore, the fields may be defined by extraction rules for extracting values from corresponding portions of raw data. The displaying of a graphical user interface (GUI) may be caused where the GUI enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar. At least one criterion for at least one field from the subset of the discovered fields may be received through a portion of the GUI that does not include a search bar for entering a search query. The events returned in response to the initial search query may be caused to be filtered based on the received criterion.

First claim

What is claimed is:

1. A method comprising:
accessing events returned in response to an initial search query, the accessed events comprising portions of raw data;
discovering fields in the accessed events, the fields being defined by extraction rules each comprising a regular expression for extracting values from corresponding portions of raw data;
causing display of a graphical user interface (GUI) that enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar;
receiving through a portion of the GUI that does not include a search bar for entering a search query at least one criterion for at least one field from the subset of the discovered fields;
causing, by a processing device, the events returned in response to the initial search query to be filtered based on the received at least one criterion for the at least one field;
determining a number of the returned events that comprise a first field of the discovered fields; and
calculating a score for the first field based on the number of the returned events that comprise the first field, wherein a first field name associated with the first field is selected to be displayed in the GUI based on the calculated score.

2. The method of claim 1 , wherein the raw data included in the events includes machine data.

3. The method of claim 1 , wherein the fields are pre-defined fields.

4. The method of claim 1 , wherein the fields are discovered as the events are accessed.

5. The method of claim 1 , further comprising:
causing display of a visualization of data in the filtered events.

6. A method comprising:
accessing events returned in response to an initial search query, the accessed events comprising portions of raw data;
discovering fields in the accessed events, the fields being defined by extraction rules each comprising a regular expression for extracting values from corresponding portions of raw data;
causing display of a graphical user interface (GUI) that enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar;
receiving through a portion of the GUI that does not include a search bar for entering a search query at least one criterion for at least one field from the subset of the discovered fields;
causing, by a processing device, the events returned in response to the initial search query to be filtered based on the received at least one criterion for the at least one field;
determining a number of unique values of a first field of the discovered fields; and
calculating a score for the first field based on the number of unique values of the first field, wherein a first field name associated with the first field is selected to be displayed in the GUI based on the calculated score.

7. The method of claim 6 , wherein the raw data included in the events includes machine data.

8. The method of claim 6 , wherein the fields are pre-defined fields.

9. The method of claim 6 , wherein the fields are discovered as the events are accessed.

10. The method of claim 6 , further comprising:
causing display of a visualization of data in the filtered events.

11. A method comprising:
accessing events returned in response to an initial search query, the accessed events comprising portions of raw data;
discovering fields in the accessed events, the fields being defined by extraction rules each comprising a regular expression for extracting values from corresponding portions of raw data;
causing display of a graphical user interface (GUI) that enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar;
receiving through a portion of the GUI that does not include a search bar for entering a search query at least one criterion for at least one field from the subset of the discovered fields;
causing, by a processing device, the events returned in response to the initial search query to be filtered based on the received at least one criterion for the at least one field;
calculating a score for each of the discovered fields; and
receiving a threshold percentage of the discovered fields to display in the GUI, wherein the set of field names associated with at least a portion of the discovered fields are selected to be displayed in the GUI based on the threshold percentage and the calculated score for each of the discovered fields, wherein the threshold percentage indicates a percentage of the discovered fields to be selected to be displayed in the GUI.

12. The method of claim 11 , wherein the raw data included in the events includes machine data.

13. The method of claim 11 , wherein the fields are pre-defined fields.

14. The method of claim 11 , wherein the fields are discovered as the events are accessed.

15. The method of claim 11 , further comprising:
causing display of a visualization of data in the filtered events.

16. A method comprising:
accessing events returned in response to an initial search query, the accessed events comprising portions of raw data;
discovering fields in the accessed events, the fields being defined by extraction rules each comprising a regular expression for extracting values from corresponding portions of raw data;
causing display of a graphical user interface (GUI) that enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar;
receiving through a portion of the GUI that does not include a search bar for entering a search query at least one criterion for at least one field from the subset of the discovered fields;
causing, by a processing device, the events returned in response to the initial search query to be filtered based on the received at least one criterion for the at least one field;
generating a data model based on discovered fields and the initial search query.

17. The method of claim 16 , wherein the raw data included in the events includes machine data.

18. The method of claim 16 , wherein the fields are pre-defined fields.

19. The method of claim 16 , wherein the fields are discovered as the events are accessed.

20. The method of claim 16 , further comprising:
causing display of a visualization of data in the filtered events.

21. A method comprising:
accessing events returned in response to an initial search query, the accessed events comprising portions of raw data;
discovering fields in the accessed events, the fields being defined by extraction rules each comprising a regular expression for extracting values from corresponding portions of raw data;
causing display of a graphical user interface (GUI) that enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar;
receiving through a portion of the GUI that does not include a search bar for entering a search query at least one criterion for at least one field from the subset of the discovered fields;
causing, by a processing device, the events returned in response to the initial search query to be filtered based on the received at least one criterion for the at least one field;
generating a data model based on the discovered fields; and
modifying a search defining events to which a data model is applicable based on the one or more discovered fields associated with the selected one or more field names.

22. The method of claim 21 , wherein the raw data include

Assignees

• Splunk Inc

Inventors

• Neels Alice Emily
• Vasan Sundar
• Fishel Simon
• Robichaud Marc Vincent

Classifications

• G06F16/24578

  using ranking · CPC title

• G06F16/245

  Query processing · CPC title

• G06F16/9535 Primary

  Search customisation based on user profiles and personalisation · CPC title

• G06F3/0482

  Interaction with lists of selectable items, e.g. menus · CPC title

• G06F3/04842

  Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) · CPC title