Data model selection and application based on data sources
First Claim
1. A method, comprising:
- selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models representing a view of the data associated with the specific data source, the data comprising a plurality of time-stamped, searchable events, each event in the plurality of time-stamped, searchable events including a portion of unstructured raw machine data reflecting activity in an information technology environment;
causing display, in a graphical user interface, of a representation of one or more objects that are included in the one or more data models;
receiving a selection of a first object representation of a first object among the representation of the one or more objects via the graphical user interface;
based on the first object representation, retrieving, from computer memory, a previously stored object query and an object schema associated with the first object representation;
retrieving a set of time-stamped, searchable events from the data using the object query; and
extracting first field values from one or more fields, identified by the object schema, in portions of unstructured raw machine data in the set of time-stamped, searchable events;
wherein the method is performed by one or more computing devices.
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments include generating data models that may give semantic meaning for unstructured or structured data that may include data generated and/or received by search engines, including a time series engine. A method includes generating a data model for data stored in a repository. Generating the data model includes generating an initial query string, executing the initial query string on the data, generating an initial result set based on the initial query string being executed on the data, determining one or more candidate fields from one or results of the initial result set, generating a candidate data model based on the one or more candidate fields, iteratively modifying the candidate data model until the candidate data model models the data, and using the candidate data model as the data model.
83 Citations
30 Claims
-
1. A method, comprising:
-
selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models representing a view of the data associated with the specific data source, the data comprising a plurality of time-stamped, searchable events, each event in the plurality of time-stamped, searchable events including a portion of unstructured raw machine data reflecting activity in an information technology environment; causing display, in a graphical user interface, of a representation of one or more objects that are included in the one or more data models; receiving a selection of a first object representation of a first object among the representation of the one or more objects via the graphical user interface; based on the first object representation, retrieving, from computer memory, a previously stored object query and an object schema associated with the first object representation; retrieving a set of time-stamped, searchable events from the data using the object query; and extracting first field values from one or more fields, identified by the object schema, in portions of unstructured raw machine data in the set of time-stamped, searchable events; wherein the method is performed by one or more computing devices. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to perform the steps of:
-
selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models representing a view of the data associated with the specific data source, the data comprising a plurality of time-stamped, searchable events, each event in the plurality of time-stamped, searchable events including a portion of unstructured raw machine data reflecting activity in an information technology environment; causing display, in a graphical user interface, of a representation of one or more objects that are included in the one or more data models; receiving a selection of a first object representation of a first object among the representation of the one or more objects via the graphical user interface; based on the first object representation, retrieving, from computer memory, a previously stored object query and an object schema associated with the first object representation; retrieving a set of time-stamped, searchable events from the data using the object query; and extracting first field values from one or more fields, identified by the object schema, in portions of unstructured raw machine data in the set of time-stamped, searchable events. - View Dependent Claims (20, 29, 30)
-
-
21. A non-transitory computer readable storage medium including computer program instructions that, when executed on a processor, implement a method comprising:
-
selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models representing a perspective of the data associated with the specific data source, the data comprising a plurality of time stamped events, each event in the plurality of time stamped events including a portion of unstructured raw machine data reflecting activity in an information technology environment; causing display, in an object-selection interface, of one or more objects that are included in the one or more data models; receiving, from a user via the object-selection interface, a selection of a first object among the one or more objects included in the one or more data models; and retrieving, from computer memory, a previously stored object definition that corresponds to the first object, wherein the previously stored object definition includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of unstructured raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields included in the unstructured raw machine data. - View Dependent Claims (22, 23, 24)
-
-
25. A system including one or more processors coupled to memory, the memory loaded with computer instructions that, when executed on the processors, implement the steps of:
-
selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models representing a view of the data associated with the specific data source, the data comprising a plurality of time stamped events, each event in the plurality of time stamped events including a portion of unstructured raw machine data reflecting activity in an information technology environment; causing display, in an object-selection interface, of one or more objects that are included in the one or more data models; receiving, from a user via the object-selection interface, a selection of a first object among the one or more objects included in the one or more data models; retrieving, from computer memory, a previously stored object definition that corresponds to the first object, wherein the previously stored object definition includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of unstructured raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields included in the unstructured raw machine data. - View Dependent Claims (26, 27, 28)
-
Specification