Text-based table manipulation of event data

• US 10,013,454 B2
• Filed: 01/30/2015
• Issued: 07/03/2018
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Robichaud, Marc Vincent, Burke, Cory Eugene, Lloyd, Jeffrey Thomas
• Primary Examiner(s): Bullock, Joshua
• Application Number:
  US14/611,026
• Publication Number:
  US 20160224619A1
• Time in Patent Office: 1,250 Days
• Field of Search: 707700
• CPC Class Codes: G06F 16/2428 Query predicate definition using graphical user interfaces, including menus and forms G06F16/2423 takes precedence
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials

Abstract

A search interface is displayed in a table format that includes one or more columns, each column including data items of an event attribute, the data items being of a set of events, and a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column. Based on a user selecting a portion of the textual representation in a corresponding cell, a list of options is displayed that corresponds to the selected portion of the textual representation. Furthermore, one or more commands are added to a search query that corresponds to the set of events, the one or more commands being based on at least an option that is selected from the list of options and the selected portion of the textual representation in the corresponding cell.

Claims

1. A computer-implemented method comprising:

causing display of a set of events that are search results of a search query that specifies a plurality of commands, each event corresponding to a portion of raw machine data associated with a timestamp extracted from the portion of raw machine data, the display of the set of events being in a table format that includes;

one or more columns, each column comprising data items of an event attribute, the data items being of the set of events; and

a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column, the textual representation being selectable by a user, the textual representation including at least some of the portion of raw machine data of a corresponding event;

based on a user selection of a text portion of the textual representation in a corresponding cell;

causing display of a list of options corresponding to the selected text portion of the textual representation in the corresponding cell; and

causing one or more commands to be added to the plurality of commands specified in the search query, wherein the one or more commands are based on an option that is selected from the list of options and the selected text portion of the textual representation in the corresponding cell.

2. The computer-implemented method of claim 1, wherein a row of the plurality of rows includes a first cell comprising the portion of raw machine data of an event, a second cell comprising a first field value produced from a first portion of the portion of raw machine data of the event, and a third cell comprising a second field value produced from a second portion of the portion of raw machine data of the event, and wherein the corresponding cell is one of the first cell, the second cell, and the third cell.

3. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that the selected text portion of the textual representation represents a data item comprising event raw data.

4. The computer-implemented method of claim 1, wherein the textual representation for each cell in the corresponding column comprises a field value of a field extracted from the set of events using a common extraction rule.

5. The computer-implemented method of claim 1, comprising further based on the user selection of the text portion of the textual representation in the corresponding cell, causing a field label-value pair to be detected in at least the selected text portion of the textual representation, wherein one or more options in the list of options are based on the detecting of the field label-value pair.

6. The computer-implemented method of claim 1, wherein one or more options in the list of options are based on an identification of the selected text portion of the textual representation comprising at least some of a field label of a field label-value pair.

7. The computer-implemented method of claim 1, wherein the textual representation comprises a character string and the text portion is a substring of the character string.

8. The computer-implemented method of claim 1, wherein the textual representation is of a single data item.

9. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on detection of at least one field label-value pair in the corresponding cell.

10. The computer-implemented method of claim 1, further comprising:

causing a field label of a field label-value pair to be detected in at least some of the selected text portion of the textual representation; and

causing the field label to be displayed in an option in the displayed list of options.

11. The computer-implemented method of claim 1, comprising receiving one or more command elements of the one or more commands entered into a form by the user, the option being displayed in the list of options as the form.

12. The computer-implemented method of claim 1, wherein the one or more commands are further based on the event attribute for each of the at least one data items corresponding to the textual representation comprising the selected text portion of the textual representation.

13. The computer-implemented method of claim 1, wherein one or more command elements of the one or more commands include at least the selected text portion of the textual representation.

14. The computer-implemented method of claim 1, further based on the user selection of the text portion of the textual representation in the corresponding cell, causing the event attribute for each of the at least one of the data items corresponding to the textual representation comprising the selected portion of the textual representation to be included as one or more command elements of the one or more commands.

15. The computer-implemented method of claim 1, comprising:

based on the user selection of the text portion of the textual representation in the corresponding cell;

causing the search query comprising the one or more commands to be automatically executed;

causing the set of events to be updated to correspond to the executed search query; and

causing the displayed search interface to be updated to correspond to the updated set of events.

16. The computer-implemented method of claim 1, comprising:

based on the user selection of the text portion of the textual representation in the corresponding cell, causing a displayed representation of the search query in the user interface to be automatically updated to include a representation of the added one or more commands.

17. The computer-implemented method of claim 1, comprising:

based on the user selection of the text portion of the textual representation in the corresponding cell, causing the search query comprising the added one or more commands to be executed, the executing applying a late binding schema to events, the late binding schema associated with one or more extraction rules defining one or more fields for the set of events.

18. The computer-implemented method of claim 1, wherein the one or more commands are operable by the search system to extract one or more field label-values pairs from at least the corresponding cell and assign the field label-value pairs to at least one event of the set of events.

19. The computer-implemented method of claim 1, causing display of the option as a form in the displayed list of options, the form comprising at least one form element operable to enter one or more command elements into the one or more commands;

and

further based on the user selection of the text portion of the textual representation in the corresponding cell, causing the form to be automatically reproduced in the search interface, the reproduced form being operable by the user to modify the one or more commands added in the search query.

20. The computer-implemented method of claim 1, comprising:

based on the user selection of the text portion of the textual representation in the corresponding cell, causing a command entry that represents the one or more commands to be automatically added to a displayed list of command entries in the search interface, each of the command entries respectively representing one or more commands of a plurality of commands of the search query, the list of command entries being displayed in a sequence corresponding to the plurality of commands of the search query.

21. The computer-implemented method of claim 1, wherein the one or more commands are of a pipelined search language.

22. A system for searching data, the system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

causing display of a set of events that are search results of a search query that specifies a plurality of commands, each event corresponding to a portion of raw machine data associated with a timestamp extracted from the portion of raw machine data, the display of the set of events being in a table format that includes;

one or more columns, each column comprising data items of an event attribute, the data items being of the set of events; and

a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column, the textual representation being selectable by a user, the textual representation including at least some of the portion of raw machine data of a corresponding event;

based on a user selection of a text portion of the textual representation in a corresponding cell;

causing display of a list of options corresponding to the selected text portion of the textual representation in the corresponding cell; and

causing one or more commands to be added to the plurality of commands specified in the search query, wherein the one or more commands are based on an option that is selected from the list of options and the selected text portion of the textual representation in the corresponding cell.

23. The system of claim 22, wherein one or more options in the list of options are based on an identification of the selected text portion of the textual representation comprising at least some of a field label of a field label-value pair.

24. The system of claim 22, wherein the operations comprise:

further based on the user selection of the text portion of the textual representation in the corresponding cell;

causing the search query comprising the one or more commands to be executed;

causing the set of events to be updated to correspond to the executed search query; and

causing the displayed search interface to be updated to correspond to the updated set of events.

25. The system of claim 22, wherein the operations comprise:

based on the user selection of the text portion of the textual representation in the corresponding cell, causing a displayed representation of the search query in the user interface to be automatically updated to include a representation of the added one or more commands.

26. One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by a computing device, perform a method, the method comprising:

causing display of a set of events that are search results of a search query that specifies a plurality of commands, each event corresponding to a portion of raw machine data associated with a timestamp extracted from the portion of raw machine data, the display of the set of events being in a table format that includes;

one or more columns, each column comprising data items of an event attribute, the data items being of the set of events; and

a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column, the textual representation being selectable by a user, the textual representation including at least some of the portion of raw machine data of a corresponding event;

based on a user selection of a text portion of the textual representation in a corresponding cell;

causing display of a list of options corresponding to the selected text portion of the textual representation in the corresponding cell; and

causing one or more commands to be added to the plurality of commands specified in the search query, wherein the one or more commands are based on an option that is selected from the list of options and the selected text portion of the textual representation in the corresponding cell.

27. The one or more computer-storage media of claim 26, the method comprising:

further based on the user selection of the text portion of the textual representation in the corresponding cell;

causing the search query comprising the one or more commands to be automatically updated;

causing the set of events to be updated to correspond to the executed search query; and

causing the displayed search interface to be updated to correspond to the updated set of events.

28. The one or more computer-storage media of claim 26, the method further comprising receiving one or more command elements of the one or more commands entered into a form by the user, the option being displayed in the list of options as the form.

29. The one or more computer-storage media of claim 26, wherein one or more options in the list of options are based on an identification of the selected text portion of the textual representation comprising at least some of a field label of a field label-value pair.

30. The system of claim 26, wherein the method comprises:

based on the user selection of the text portion of the textual representation in the corresponding cell, causing a displayed representation of the search query in the user interface to be automatically updated to include a representation of the added one or more commands.

31. The one or more computer-storage media of claim 26, wherein the search query is represented as a search string that specifies the plurality of commands, and the one or more commands are caused to be added to the search query sequentially after the search string.

32. The one or more computer-storage media of claim 26, wherein the added one or more commands cause results of the search query to be produced from intermediate search results produced by the plurality of commands.

33. The one or more computer-storage media of claim 26, wherein the display of the set of events in the table format is in a search screen, and the causing one or more commands to be added to the search query causes the table format in the displayed search screen to be automatically updated to add a new column that represents a new field extracted from the events by the one or more commands added to the search query.

34. The one or more computer-storage media of claim 26, wherein the one or more commands includes a command of a plurality of predetermined commands of a search language, the option, when selected causing a command identifier of the command and arguments of the command to be added to the search query, wherein the arguments are composed based on the text portion that was user selected to cause the display of the list of options.