Field value search drill down

• US 10,303,344 B2
• Filed: 10/28/2014
• Issued: 05/28/2019
• Est. Priority Date: 10/05/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Burke, Cory Eugene, Feeney, Katherine Kyle, Lamas, Divanny I., Robichaud, Marc Vincent, Ness, Matthew G., Lee, Clara E.
• Primary Examiner(s): Uddin, Mohammed R
• Application Number:
  US14/526,406
• Publication Number:
  US 20160098485A1
• Time in Patent Office: 1,673 Days
• Field of Search: 707706, 707708, 707711, 707732, 707803
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/18 of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06V 10/22 by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition

Abstract

In embodiments of field value search drill down, a search system exposes a search interface that displays one or more events returned as a search result set. A field-value pair can be emphasized in the field-value pairs of an event displayed in the search interface, and a menu is displayed with search options that are selectable to operate on the emphasized field-value pair of the event. The menu includes the search options to add search criteria of the emphasized field-value pair to a search command in a search bar of the search interface, exclude the search criteria of the emphasized field-value pair from a search, or create a new data search based on the emphasized field-value pair. A selection of one of the search options in the menu can be received, and the search command in the search bar is updated based on the search option that is selected.

Claims

1. A computer-implemented method, comprising:

within a search interface, causing display of a first search command within a search bar and a separate event area for each event included in a set of events that are included in search results of the first search command, wherein each separate event area includes a field and a value of a field-value pair for a corresponding event included in the set of events;

in response to a user selection of at least a portion of a first field-value pair in a first event area corresponding to a first event of the set of events, causing the first field-value pair to be an emphasized field-value pair, wherein the emphasized field-value pair indicates a first field name and a first value for a first field;

causing display of a menu of search options that are selectable to operate on the emphasized field-value pair of the event;

receiving a selection of one of the search options displayed in the menu; and

causing display of an updated search command in the search bar, wherein the displayed updated search command is based on the first search command, the search option selected from the menu, and each of the first field name and the first value for the first field that are indicated by the emphasized field-value pair in the first event area corresponding to the first event.

2. The method as recited in claim 1, wherein the user selection is in an event field-picker interface displaying a listing of multiple field-value pairs that is specific to the event.

3. The method as recited in claim 1, wherein the causing of the emphasis of the field-value pair is responsive to detection of an input pointer over the field-value pair.

4. The method as recited in claim 1, further comprising:

receiving an input associated with the emphasized field-value pair; and

wherein the menu of the search options is displayed responsive to the received input.

5. The method as recited in claim 1, wherein the menu of the search options is displayed proximate the emphasized field-value pair in the search interface.

6. The method as recited in claim 1, wherein the search options displayed in the menu include an add to search option, an exclude from search option, and a new search option.

7. The method as recited in claim 1, wherein the search options displayed in the menu include an add to search option that is selectable to automatically add text defining search criteria of the emphasized field-value pair to the first search command displayed in the search bar, the text narrowing results of the first search command to events comprising the emphasized field-value pair.

8. The method as recited in claim 1, wherein the search options displayed in the menu include an exclude from search option that is selectable to automatically add text defining search criteria of the emphasized field-value pair to the first search command displayed in the search bar, the text narrowing results of the search first command to events that do not include the emphasized field-value pair.

9. The method as recited in claim 1, wherein the search options displayed in the menu include a new search option that is selectable to automatically create a new data search based on the emphasized field-value pair, wherein search criteria of the emphasized field-value pair replaces the first search command displayed in the search bar to define the new data search.

10. The method as recited in claim 1, wherein the menu includes a statistical event count of a number of multiple events that include the emphasized field-value pair.

11. The method as recited in claim 1, wherein the menu includes a statistical event count of a number of multiple events that exclude the emphasized field-value pair.

12. The method as recited in claim 1, wherein the menu includes the search options to:

add search criteria of the emphasized field-value pair to the first search command displayed in the search bar;

add the search criteria of the emphasized field-value pair to the first search command as the search criteria excluded from events that do not include the emphasized field-value pair;

or

create a new data search based on the emphasized field-value pair, wherein the search criteria of the emphasized field-value pair replaces the search criteria in the search bar.

13. The method as recited in claim 1, wherein:

said receiving the selection of a search option adds search criteria of the emphasized field-value pair to a data search, and wherein the method further comprises;

updating the first search command such that the updated search command displayed in the search bar includes the search criteria of the emphasized field-value pair in the search bar;

performing a data search based on the updated search command to determine additional events that each include the search criteria of the emphasized field-value pair; and

causing display of the additional events that each include the emphasized field-value pair in the search interface.

14. The method as recited in claim 1, wherein:

said receiving the selection of a search option excludes search criteria of the emphasized field-value pair from a data search by automatically causing updating of the first search command such that the updated search command displayed in the search bar is based on the search criteria of the emphasized field-value pair; and

the method further comprises;

performing the data search based on the updated search command to determine additional events that do not include the search criteria of the emphasized field-value pair; and

causing display of the additional events that do not include the emphasized field-value pair.

15. The method as recited in claim 1, wherein:

said receiving the selection of a search option to create creates a new data search based on the emphasized field-value pair, and wherein the method further comprises;

updating the first search command such that the updated search command displayed in the search bar is based on replacing the first search command with search criteria of the emphasized field-value pair;

performing the new data search based on the updated search command to determine additional events that include the search criteria of the emphasized field-value pair; and

causing display of the additional events that include the emphasized field-value pair.

16. The method as recited in claim 1, further comprising:

the menu of the search options includes selectable interface links, each associated with a corresponding search option; and

a selectable interface link being selectable to initiate a new search interface.

17. The method as recited in claim 1, wherein said causing emphasis of the value of the field-value pair comprises highlighting the field-value pair.

18. The method as recited in claim 1, wherein the event is one of multiple events returned as a search result set, the multiple events initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

19. The method as recited in claim 1, wherein the event is one of multiple events returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

20. The method as recited in claim 1, wherein multiple events each comprise a portion of raw data that is associated with a timestamp indicating a respective point in time.

21. A computer-implemented system, comprising:

one or more processors; and

one or more computer-readable media storing instructions thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

within a search interface, causing display of a first search command within a search bar and a separate event area for each event included in a set of events that are included in search results of the first search command, wherein each separate event area includes a field and a value of a field-value pair for a corresponding event included in the set of events;

in response to a user selection of at least a portion of a first field-value pair in a first event area corresponding to a first event of the set of events, causing emphasis of the first field-value pair to be an emphasized field-value pair, wherein the emphasized field-value pair indicates a first field name and a first value for a first field;

causing display of a menu of search options that are selectable to operate on the emphasized field-value pair of the event;

receiving a selection of one of the search options displayed in the menu; and

causing display of an updated search command in the search bar, wherein the displayed updated search command is based on the first search command, the search option selected from the menu, and each of the first field name and the first value for the first field that are indicated by the emphasized field-value pair in the first event area corresponding to the first event.

22. The system as recited in claim 21, wherein the user selection is in an event field-picker interface displaying a listing of multiple field-value pairs that is specific to the event.

23. The system as recited in claim 21, wherein the menu includes:

a first statistical event count that indicates a number of multiple events that include the emphasized field-value pair; and

a second statistical event count that indicates a number of additional multiple events that exclude the emphasized field-value pair.

24. The system as recited in claim 21, wherein the menu includes an add to search option, an exclude from search option, and a new search option, the search options being selectable to:

add search criteria of the emphasized field-value pair to the first search command displayed in the search bar;

add the search criteria of the emphasized field-value pair to first the search command displayed in the search bar as the search criteria excluded from events that do not include the emphasized field-value pair;

or

create a new data search based on the emphasized field-value pair, wherein the search criteria of the emphasized field-value pair replaces the search criteria in the search bar.

25. The system as recited in claim 21, wherein:

said receiving the selection of a search option adds search criteria of the emphasized field-value pair to a data search, and the operations further comprise;

updating the first search command such that the updated search command displayed in the search bar includes the search criteria of the emphasized field-value pair in the search bar;

performing a data search based on the updated search command to determine additional events that each include the search criteria of the emphasized field-value pair; and

causing display of the additional events that each include the emphasized field-value pair in the search interface.

26. The system as recited in claim 21, wherein:

said receiving the selection of a search option excludes search criteria of the emphasized field-value pair from a data search by automatically causing updating of the first search command such that the updated search command displayed in the search bar is based on the search criteria of the emphasized field-value pair; and

the operations further comprise;

performing the data search based on the updated search command to determine additional events that do not include the search criteria of the emphasized field-value pair; and

causing display of the additional events that do not include the emphasized field-value pair.

27. The system as recited in claim 21, wherein:

said receiving the selection of a search option creates a new data search based on the emphasized field-value pair, and the operations further comprises;

updating the first search command such that the updated search command displayed in the search bar is based on replacing the search command with search criteria of the emphasized field-value pair;

performing the new data search based on the updated search command to determine additional events that include the search criteria of the emphasized field-value pair; and

causing display of the additional events that include the emphasized field-value pair.

28. One or more computer-readable, non-volatile storage memory comprising stored instructions that are executable and, responsive to execution by a computing device, cause the computing device to perform operations comprising:

within a search interface, causing display of a first search command within a search bar and a separate event area for each event included in a set of events that are included in search results of the first search command, wherein each separate event area includes a field and a value of a field-value pair for a corresponding event included in the set of events;

in response to a user selection of at least a portion of a first field-value pair in a first event area corresponding to a first event of the set of events, causing the first field-value pair to be an emphasized field-value pair, wherein the emphasized field-value pair indicates a first field name and a first value for a first field;

causing display of a menu of search options that are selectable to operate on the emphasized field-value pair of the event;

receiving a selection of one of the search options displayed in the menu; and

causing display of an updated search command in the search bar, wherein the displayed updated search command is based on the search option selected from the menu for each of the first field name and the first value for the first field that are indicated by the emphasized field-value pair in the first event area corresponding to the first event.

29. The one or more computer-readable, non-volatile storage memory as recited in claim 28, wherein:

the search options displayed in the menu include an add to search option, an exclude from search option, and a new search option;

the add to search option being selectable to add search criteria of the emphasized field-value pair to the fist search command displayed in the search bar;

the exclude from search option being selectable to add the search criteria of the emphasized field-value pair to the first search command displayed in the search bar as the search criteria excluded from events that do not include the emphasized field-value pair; and

the new search option being selectable to create a new data search based on the emphasized field-value pair, wherein search criteria of the emphasized field-value pair replaces the first search command in the search bar.

30. The one or more computer-readable, non-volatile storage memory as recited in claim 28, wherein the menu of the search options includes selectable interface links, each associated with a corresponding search option, and a selectable interface link being selectable to initiate a new search interface.

31. The one or more computer-readable, non-volatile storage memory as recited in claim 28, wherein the search bar comprises a text box including text representing the first search command, the set of events is a result set of performing a search based on the first search command displayed in the search bar, and the operations further comprise updating the first search command such that the updated search command includes additional text.

32. The one or more computer-readable, non-volatile storage memory as recited in claim 28, wherein causing display of the set of events comprises, for each given event in the set of events, causing display of a corresponding portion of raw machine data and a list of field-value pairs associated with the given event, the user selection comprising a user interaction with the field-value pair in the list of field-value pairs associated with corresponding the event.