Statistics value chart interface cell mode drill down

• US 10,261,673 B2
• Filed: 10/28/2014
• Issued: 04/16/2019
• Est. Priority Date: 10/05/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Burke, Cory Eugene, Feeney, Katherine Kyle, Lamas, Divanny I., Robichaud, Marc Vincent, Ness, Matthew G., Lee, Clara E.
• Primary Examiner(s): Amin, Mustafa A
• Application Number:
  US14/526,468
• Publication Number:
  US 20160098385A1
• Time in Patent Office: 1,631 Days
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/18 of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06V 10/22 by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition

Abstract

In embodiments of statistics value chart interface cell mode drill down, a first interface displays in a table format that includes columns each with field values of an event field, and each column having a column heading of a different one of the event fields, and includes rows each with one or more of the field values, each field value in a row associated with a different one of the event fields, and having an aggregated metric that represents a number of events with field-value pairs that match all of the field values listed in a respective row and the corresponding event fields listed in the respective columns. A cell can be emphasized that includes one of the field values in a row that corresponds to one of the different event fields in a column, and in response, a menu displays options to transition to a second interface.

Claims

1. A computer-implemented method, comprising:

receiving a set of events responsive to a search query;

causing display of a first interface in a table format that includes;

one or more columns, each column comprising field values of an event field, and each column having a column heading comprising a different one of the event fields; and

one or more rows, each row comprising;

one or more of the field values, each field value in a row associated with a different one of the event fields; and

an aggregated metric calculated from a number of the events of the set of events having field-value pairs that match the one or more field values listed with the aggregated metric in the row and match the corresponding event fields listed in the respective columns, wherein the row represents the number of the events;

causing emphasis of a cell in the table format in response to a user selection of the cell, the cell including a field value of the one or more field values in the row, the field value corresponding to one of the different one of the event fields in a column; and

causing display of a menu of options corresponding to the emphasized cell, the options selectable to transition to a second interface that is separate from the first interface based on a selected option of the options, wherein the selected option causes each event of the number of the events represented by at least one of the one or more rows to be represented as a corresponding row in the second interface based on the field value in the emphasized cell.

2. The method as recited in claim 1, wherein the aggregated metric of the row comprises an average calculated from the number of the events.

3. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events formed by the corresponding row for each of the events, the events being included in the list either based on each event having a field-value pair that matches the field value of the emphasized cell, or based on the event not having any field-value pair that match the field value of the emphasized cell.

4. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events formed by the corresponding row for each of the events, the events being included in the list based on each event having a field-value pair that matches the field value of the emphasized cell.

5. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events formed by the corresponding row for each of the events, the events being included in the list based on each event not having any field-value pair that matches the field value of the emphasized cell.

6. The method as recited in claim 1, wherein each column comprising the column heading is included in the table format based on the different one of the event fields in the column heading being individually user selected for inclusion in the table format.

7. The method as recited in claim 1, wherein each column comprising the column heading is included in the table format based on being individually referenced in a command of the search query.

8. The method as recited in claim 1, wherein each event to be represented as a corresponding row in the second interface is determined from the field value in the emphasized cell.

9. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell and the field-value pairs that match the field values listed in the row to the left of the emphasized cell.

10. The method as recited in claim 1, wherein the event represented as the corresponding row in the second interface is not represented by the row of the emphasized cell based on the field value in the emphasized cell.

11. The method as recited in claim 1, wherein:

the second interface is an events interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell and one or more of the field-value pairs that match the field values listed in the row of the emphasized cell;

or

the second interface is the first interface displayed excluding the field-value pairs that match the field value in the emphasized cell and the corresponding column.

12. The method as recited in claim 1, further comprising:

receiving a user selection of the emphasized cell, wherein the display of the menu is in response to the user selection of the emphasized cell.

13. The method as recited in claim 1, wherein the options displayed in the menu include a new search option causes a new search query to be run resulting in a new set of events that includes at least one event that is not represented in first interface, the at least one event being represented in the second interface.

14. The method as recited in claim 1, wherein the options displayed in the menu include a view events option that is selectable to said transition to the second interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell.

15. The method as recited in claim 1, wherein the options displayed in the menu include an other events option that is selectable to said transition to the second interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell.

16. The method as recited in claim 1, wherein the options displayed in the menu include an exclude from results option that is selectable to said transition to the first interface displayed excluding the field value of the emphasized cell and the corresponding column.

17. The method as recited in claim 1, wherein the options displayed in the menu include a new search option that is selectable to create a new search based on the field value of the emphasized cell.

18. The method as recited in claim 1, wherein:

the options displayed in the menu include a view events option, an other events option, an exclude from results option, and a new search option;

the view events option being selectable to said transition to the second interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell;

the other events option being selectable to said transition to the second interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell;

the exclude from results option being selectable to said transition to the first interface displayed excluding the field value of the emphasized cell and the corresponding column; and

the new search option being selectable to create a new search based on the field value of the emphasized cell.

19. The method as recited in claim 1, wherein the menu displays a field-value pair of the field-value pairs, the field-value pair having a field value included in the emphasized cell.

20. The method as recited in claim 1, wherein the menu includes a designation of a field-value pair of the field-value pairs, the field-value pair having a field value included in the emphasized cell, the menu further including designations of members of the field values listed in the row to the left of the emphasized cell.

21. The method as recited in claim 1, wherein the menu includes a designation of a field-value pair that includes the field value of the emphasized cell, and one or more of the field values listed in the row of the emphasized cell.

22. The method as recited in claim 1, further comprising:

said emphasizing the cell responsive to detection of an input pointer over the emphasized cell in the first interface.

23. The method as recited in claim 1, wherein said causing emphasis of the cell in the row of the one or more fields comprises highlighting the row.

24. The method as recited in claim 1, wherein the events are initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

25. The method as recited in claim 1, wherein the events are returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

26. The method as recited in claim 1, wherein the events each comprise a portion of raw data that is associated with a timestamp indicating a respective point in time, the corresponding row of each event in the second interface displaying the portion of raw machine data.

27. A computer-implemented system, comprising:

one or more processors; and

one or more computer-readable media having executable instructions embodied thereon, which, when executed by the one or more processors, cause the one or more processors to perform a method comprising;

receiving a set of events responsive to a search query;

causing display of a first interface in a table format that includes;

one or more columns, each column comprising field values of an event field, and each column having a column heading comprising a different one of the event fields; and

one or more rows, each row comprising;

one or more of the field values, each field value in a row associated with a different one of the event fields; and

an aggregated metric calculated from a number of the events of the set of events having field-value pairs that match the one or more field values listed with the aggregated metric in the row and match the corresponding event fields listed in the respective columns, wherein the row represents the number of the events;

causing emphasis of a cell in the table format in response to a user selection of the cell, the cell including a field value of the one or more field values in the row, the field value corresponding to one of the different one of the event fields in a column; and

causing display of a menu of options corresponding to the emphasized cell, the options selectable to transition to a second interface that is separate from the first interface based on a selected option of the options, wherein the selected option causes each event of the number of the events represented by at least one of the one or more rows to be represented as a corresponding row in the second interface based on the field value in the emphasized cell.

28. The system as recited in claim 27, wherein the event represented as the corresponding row in the second interface is not represented by the row of the emphasized cell based on the field value in the emphasized cell.

29. The system as recited in claim 27, wherein the options displayed in the menu include a view events option, an other events option, an exclude from results option, and a new search option;

the view events option being selectable to said transition to the second interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell;

the other events option being selectable to said transition to the second interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell;

the exclude from results option being selectable to said transition to the first interface displayed excluding the field value of the emphasized cell and the corresponding column; and

the new search option being selectable to create a new search based on the field value of the emphasized cell.

30. One or more non-transitory computer-readable, non-volatile storage memory comprising stored instructions that are executable to cause one or more processors to perform operations comprising:

receiving a set of events responsive to a search query;

causing display of a first interface in a table format that includes;

one or more columns, each column comprising field values of an event field, and each column having a column heading comprising a different one of the event fields; and

one or more rows, each row comprising;

one or more of the field values, each field value in a row associated with a different one of the event fields; and

an aggregated metric calculated from a number of the events of the set of events having field-value pairs that match the one or more field values listed with the aggregated metric in the row and match the corresponding event fields listed in the respective columns, wherein the row represents the number of the events;

causing emphasis of a cell in the table format in response to a user selection of the cell, the cell including a field value of the one or more field values in the row, the field value corresponding to one of the different one of the event fields in a column; and

causing display of a menu of options corresponding to the emphasized cell, the options selectable to transition to a second interface that is separate from the first interface based on a selected option of the options, wherein the selected option causes each event of the number of the events represented by at least one of the one or more rows to be represented as a corresponding row in the second interface based on the field value in the emphasized cell.