Statistics time chart interface cell mode drill down

• US 10,139,997 B2
• Filed: 10/28/2014
• Issued: 11/27/2018
• Est. Priority Date: 10/05/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Burke, Cory Eugene, Feeney, Katherine Kyle, Lamas, Divanny I., Robichaud, Marc Vincent, Ness, Matthew G., Lee, Clara E.
• Primary Examiner(s): Bycer, Eric J.
• Application Number:
  US14/526,478
• Publication Number:
  US 20160098464A1
• Time in Patent Office: 1,491 Days
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/18 of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06V 10/22 by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition

Abstract

In embodiments of statistics time chart interface cell mode drill down, a first interface displays in a table format that includes columns each having a column heading comprising a different value, each different value associated with a particular event field, and includes one or more rows, each row having a time increment and aggregated metrics that each represent a number of events having a field-value pair that matches the different value represented in one of the columns and within the time increment over which the aggregated metric is calculated. A cell can be emphasized that includes one of the aggregated metrics in a row that includes the respective time increment, and in response, a menu displays options to transition to a second interface.

Claims

1. A method, comprising:

causing display of a first interface in a table format that includes;

one or more columns, each column having a column heading representing a different value, each different value associated with a particular event field, and a first value is represented in the column heading of a first column of the one or more columns;

one or more rows, each row comprising at least a first cell and a second cell that is associated with the first column, the first cell of each of the one or more rows displaying a time increment and the second cell of each of the one or more rows displaying an aggregated metric representing a number of events, wherein each event contributing to the number of events has a field-value pair that matches the first value represented in the first column and occurred within the time increment displayed in the first cell;

in response to a user selection of a second cell of a first row of the one or more rows, causing emphasis of the second cell of the first row, wherein a first cell of the first row displays a first time increment; and

causing display of a menu of options corresponding to the emphasis of the second cell of the first row, wherein a selection of an option in the menu causes transition to a second interface displaying at least one event determined based on an association with a time that has a defined relationship to the first time increment and another association with the first value.

2. The method as recited in claim 1, wherein the first time increment includes a date.

3. The method as recited in claim 1, wherein the second interface is an events interface that displays a narrowed list of events, wherein each event included in the narrowed lists of events has a field-value pair that matches the first value represented in the first column associated with the second cell of the first row and occurred within the first time increment.

4. The method as recited in claim 1, wherein at least one event displayed by the second interface excludes events having a field-value pair matching a different value than the first value represented in the first column associated with the second cell of the first row.

5. The method as recited in claim 1, wherein a first aggregated metric displayed by the second cell of the first row indicates a number of events corresponding to the first row, and the at least one event displayed by the second interface includes each event included in the number of events.

6. The method as recited in claim 1, wherein the defined relationship comprises the time being within the respective time increment.

7. The method as recited in claim 1, wherein the options displayed in the menu include a view events option corresponding to the defined relationship comprising the time being within the first time increment and an exclude from results option corresponding to the defined relationship comprising the time being outside of the first time increment.

8. The method as recited in claim 1, wherein the options displayed in the menu include a view events option that is selectable to cause the second interface to display a narrowed list of events, wherein each event included in the narrowed list of events has a field-value pair that matches a first value represented in a first column associated with the second cell of the first row and occurred within the first time increment.

9. The method as recited in claim 1, wherein the options displayed in the menu include an exclude from results option, wherein when the exclude from results option is selected, the defined relationship comprises that the time associated with the at least one event is outside the first time increment, and the at least one event excludes events having a field-value pair matching the first value represented by the first column associated with the second cell of the first row.

10. The method as recited in claim 1, wherein:

the options displayed in the menu include a view events option and an exclude from results option, wherein

when the view events option is selected, the second interface displays a narrowed list of events and each event included in the narrowed list of events has a field-value pair that matches the first value represented in the first column associated with the second cell of the first row and occurred within the first time increment, and

when the exclude from results option is selected, a separate list of events is displayed by the second interface, the separate list of events excludes the events having the field-value pair matching the first value represented in the first column.

11. The method as recited in claim 1, wherein the menu includes a view events option and a corresponding designation of a time duration that encompasses the first time increment, the corresponding designation further displaying a field-value pair matching the first value represented in first column associated with the second cell of the first row.

12. The method as recited in claim 1, wherein the menu includes an exclude from results option and a corresponding designation displaying a field-value pair matching a different value than the first value represented in the first column associated with the second cell of the first row.

13. The method as recited in claim 1, wherein said causing emphasis of the second cell of the first row is responsive to detection of an input pointer over a first aggregated metric displayed by the second cell of the first row.

14. The method as recited in claim 1, wherein said causing emphasis of the second cell of the first row comprises highlighting the second cell of the first row.

15. The method as recited in claim 1, wherein the at least one event displayed by the second interface is initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

16. The method as recited in claim 1, wherein the at least one event displayed by the second interface is returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

17. The method as recited in claim 1, wherein each event of the at least one event displayed by the second interface comprises a portion of raw data that is associated with a timestamp indicating a respective point in time.

18. A system, comprising:

one or more data stores configured to store collected data that is searchable by a search system using a late-binding schema;

one or more hardware processors to implement the search system on one or more computing devices, the search system configured to;

initiate display of a first interface in a table format that includes;

one or more columns, each column having a column heading representing a different value, each different value associated with a particular event field, and a first value is represented in the column heading of a first column of the one or more columns;

one or more rows, each row comprising at least a first cell and a second cell that is associated with the first column, the first cell of each of the one or more rows displaying displaying a time increment and the second cell of each of the one or more rows displaying an aggregated metric representing a number of events, wherein each event contributing to the number of events has a field-value pair that matches the first value represented in the first column and occurred within the time increment displayed in the first cell;

emphasize a second cell of a first row of the one or more rows, wherein the second cell of the first row displays a first aggregated metric and a first cell of the first row displays a first time increment; and

cause display of a menu of options corresponding to the emphasis of the second cell of the first row, selection of an option in the menu causing transition to a second interface displaying at least one event determined based on an association with a time that has a defined relationship to the first time increment and another association with the first value.

19. The system as recited in claim 18, wherein the first time increment includes a date.

20. The system as recited in claim 18, wherein the second interface is an events interface that displays a narrowed list of events, and each event included in the narrowed list of events has a field-value pair that matches the first value represented in the first column associated with the second cell of the first row and occurred within the first time increment.

21. The system as recited in claim 18, wherein at least one event displayed by the second interface excludes events having a field-value pair matching a different value than the first value represented in the first column associated with the second cell of the first row.

22. The system as recited in claim 18, wherein the options displayed in the menu include a view events option and an exclude from results option, wherein

when the view events option is selected the second interface displays a narrowed list of events and each event included in the narrowed list of events has a field-value pair that matches the first value represented in the first column associated with the second cell of the first row and occurred within the first time increment, and

when the exclude from results option is selected, a separate list of events is displayed by the second interface, the separate list of events excludes the events having the field-value matching the first value represented in the first column.

23. The system as recited in claim 18, wherein the first aggregated metric indicates a number of events corresponding to the first row.

24. The system as recited in claim 18, wherein the menu includes a view events option and a corresponding designation of a time duration that encompasses the first time increment, the designation further displaying a field-value pair matching the first value represented in the first column associated with the second cell of the first row.

25. The system as recited in claim 18, wherein the menu includes an exclude from results option and a corresponding designation a field-value pair matching a different value than the first value represented in the first column associated with the second cell of the first row.

26. One or more non-transitory computer-readable, non-volatile storage memory comprising stored instructions that are executable and, responsive to execution by a computing device, the computing device performs operations comprising:

causing display of a first interface in a table format that includes;

one or more columns, each column having a column heading representing a different value, each different value associated with a particular event field, and a first value is represented in the column heading of a first column of the one or more columns;

one or more rows, each row comprising at least a first cell and a second cell that is associated with the first column, the first cell of each of the one or more rows displaying a time increment and the second cell of each of the one or more rows displaying an aggregated metric representing a number of events, wherein each event contributing to the number of events has a field-value pair that matches the first value represented in the first column and occurred within the time increment displayed in the first cell;

causing emphasis of a second cell of a first row of the one or more rows, wherein the second cell of the first row displays a first aggregated metric and a first cell of the first row displays a first time increment; and

causing display of a menu of options corresponding to the emphasis of the second cell of the first row, selection of an option in the menu causing transition to a second interface displaying at least one event determined based on an association with a time that has a defined relationship to the first time increment and another association with the first value.

27. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the first time increment includes a date.

28. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the second interface is an events interface that displays a narrowed list of events, and each event included in the narrowed list of events has a field-value pair that matches the first value represented in the first column associated with the second cell of the first work and occurred within the first time increment.

29. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the at least one event displayed by the second interface excludes events having a field-value pair matching a different value than the first value represented in the first column associated with the second cell of the first row.

30. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the options displayed in the menu include a view events option and an exclude from results option, wherein

when the view events option is selected, the second interface displays a narrowed list of events and each event included in the narrowed list of events has a field-value pair that matches the first value represented in the first column associated with second cell of the first row and occurred within the first time increment, and

when the exclude from results option is selected, a separate list of events is displayed by the second interface, the second list of events excludes the events having the field-value pair matching the first value represented in the first column.