Interface templates for query commands

Patent metadata

Field	Value
Publication number	US-9836501-B2
Application number	US-201514815923-A
Country	US
Kind code	B2
Filing date	Jul 31, 2015
Priority date	Jan 30, 2015
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

A method includes causing display of events that correspond to search results of a search query in a table. The table includes rows representing events comprising data items of event attributes, columns forming cells with the row, the columns representing respective event attributes, and interactive regions corresponding to one or more data items of the displayed data items. The method also includes in response to the user selecting a designated interactive region, causing display of a list of options, each displayed option corresponding to an interface template for composing query commands, and based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

First claim

The invention claimed is:

1. A computer-implemented method for composing queries in a query interface, the method comprising:
causing display of a set of events that are search results of a search query, each event corresponding to a portion of raw machine data associated with a timestamp, the display of the set of events being in a table, the table comprising:
a plurality of rows, each row representing an event of the events, the events associated with data items of event attributes;
a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of the event attributes, the cells of the column displaying the data items of the respective event attribute; and
interactive regions of the table, each interactive region corresponding to one or more data items of the displayed data items and being user selectable to cause display of a list of options corresponding to the selected interactive region;

in response to a first user selection of a designated interactive region of the interactive regions of the table, causing display of the list of options corresponding to the designated interactive region, each displayed option corresponding to an interface template for composing query commands; and
based on a second user selection an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

2. The computer-implemented method of claim 1 , wherein the one or more commands are composed based on user input into one or more form elements of a form, the instructions of the interface template mapping the one or more form elements to one or more portions of the one or more commands.

3. The computer-implemented method of claim 1 , further comprising:
based on the user selection of the option in the displayed list of options, causing display of a graphical user interface defined by the instructions of the interface template; and
composing the one or more commands from user input to the graphical user interface.

4. The computer-implemented method of claim 1 , further comprising:
after adding the one or more commands to the search query, receiving a request from a user to modify the one or more commands added to the search query;
in response to the request, causing a form to be presented comprising one or more form elements defined by the instructions of the interface template associated with the option; and
modifying the one or more commands in the search query based on input from the user to the one or more form elements, the instructions of the interface template mapping input to one or more portions of the one or more commands.

5. The computer-implemented method of claim 1 , wherein the instructions of the interface template comprise:
extracting values of the one or more data items that corresponds to the designated interactive region;
determining a number of form elements to display to the user based on the extracted values;
causing display of each of the form elements to the user based on the user selecting an option in the displayed list of options; and
composing the one or more commands based on input from the user into one or more of the form elements.

6. The computer-implemented method of claim 1 , wherein the one or more commands are composed and added to the search query based on user input into one or more form elements defined by the instructions of the interface template, and the method further comprises:
adding one or more subsequent commands to the search query;
receiving a selection, by a user of a command entry representing the one or more commands that were added to the search query; and
based on the selection, causing presentation of at least one of the one or more form elements to the user for modifying the one or more commands that were added to the search query, the at least one of the one or more form elements comprising the user input that was received to compose the one or more commands that were added to the search query.

7. The computer-implemented method of claim 1 , wherein the one or more commands are composed and added to the search query using a form defined by the instructions of the interface template, and the method further comprises:
adding one or more subsequent commands to the search query;
receiving a selection, by a user of a command entry representing the one or more commands of the search query; and
based on the selection, causing presentation of the form to the user for modifying the one or more commands that were added to the search query.

8. The computer-implemented method of claim 1 , wherein the causing one or more commands to be added to the search query automatically causes the displayed events in the table to be updated to correspond to search results of the search query comprising the added one or more commands.

9. The computer-implemented method of claim 1 , further comprising:
receiving a selection, by a user of a command entry representing one or more previously added commands of the search query; and
based on the selection, causing a currently displayed form defined by the instructions of the interface template for composing the one or more commands to be replaced with a form defined by instructions of another interface template for composing the one or more previously added commands.

10. The computer-implemented method of claim 1 , further comprising:
receiving a selection, by a user of a command entry representing one or more previously added commands of the search query; and
based on the selection, causing one or more currently displayed form elements defined by the instructions of the interface template for composing the one or more commands to be replaced in an interface panel with one or more form elements defined by instructions of another interface template for composing the one or more previously added commands.

11. The computer-implemented method of claim 1 , further comprising:
causing display of an interface panel to the user, the interface panel being configured to display form elements for composing commands of the search query;
in response to a user request to hide the interface panel, hiding the displayed interface panel including the form elements; and
based on the user selection of the option in the displayed list of options, causing the hidden interface panel to be automatically unhidden, and causing the unhidden interface panel to include form elements defined by the instructions for composing the one or more commands.

12. The computer-implemented method of claim 1 , wherein the instructions define that each command composed using the interface template identifies the one or more data items that corresponds to the designated interactive region in the command.

13. The computer-implemented method of claim 1 , wherein the instructions define that each command composed using the interface template is composed by determining an identifier of an event attribute of the one or more data items that corresponds to the designated interactive region, and including the identifier in the command.

14. The computer-implemented method of claim 1 , wherein the instructions specify a command identifier to include in each command composed using the interface template.

15. The computer-implemented method of claim 1 , comprising executing the search query on the set of events to produce the search results, wherein each event includes the portion of raw ma

Assignees

• Splunk Inc
• Splunk Inc

Inventors

• Robichaud Marc V
• Miller Jesse
• Burke Cory
• James Alexander
• Lloyd Jeffrey Thomas

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• G06F40/177

  of tables; using ruled lines · CPC title

• G06F16/26

  Visual data mining; Browsing structured data · CPC title

• G06F16/235

  Update request formulation · CPC title

• G06F16/3334

  Selection or weighting of terms from queries, including natural language queries · CPC title