Creating an entity definition from a search result set

• US 10,503,745 B2
• Filed: 07/27/2017
• Issued: 12/10/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Boe, Brent, Hardin, Alan, Hsiao, Fang I., Reyes, Brian C.
• Primary Examiner(s): Walsh, John B
• Application Number:
  US15/662,206
• Publication Number:
  US 20170322985A1
• Time in Patent Office: 866 Days
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A processing device performs a search query to produce a search result set having entries having data items. A table, having rows and columns, is displayed in a user interface. Each data item of a particular entry appears in a respective column of the same row of the table. Each column may correspond to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each data item of the particular entry an element value of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Claims

1. A method comprising:

performing a first search query in response to user input to produce a search result set comprising one or more entries each having one or more data items;

causing display of the entries in a table of a user interface, the table having rows and columns, wherein the data items of each entry appear in respective columns of the same row;

receiving user input designating, for a column of the table, information for at least one of identifying or locating a data item appearing in the column within an entity definition; and

storing the data item appearing in the column in the entity definition in accordance with the user input;

wherein the entity definition represents an entity from among one or more entities that provide a service, the entity definition having an identification of machine data produced by or about the entity, the service having a Key Performance Indicator (KPI) defined by a second search query that derives a value at least in part from the machine data, thereby transforming at least the machine data to the value which indicates the performance of the service at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment;

wherein the method is performed by a computer system comprising one or more processing devices.

2. The method of claim 1 wherein storing the data item comprises:

storing the data item in the entity definition in association with identifying information designated by the user input.

3. The method of claim 1 wherein storing the data item comprises:

storing the data item in the entity definition in association with identifying information designated by the user input wherein the identifying information represents an element name.

4. The method of claim 1 wherein storing the data item comprises:

storing the data item within the entity definition at a location corresponding to the locating information designated by the user input.

5. The method of claim 1 wherein storing the data item comprises:

storing the data item within a component of the entity definition having a type corresponding to the locating information designated by the user input.

6. The method of claim 1 wherein storing the data item comprises:

storing the data item within the entity definition at a location corresponding to the locating information designated by the user input and in association with identifying information designated by the user input.

7. The method of claim 1 wherein storing the data item comprises:

storing the data item in association with an element name represented by the identifying information designated by the user input and within a component of the entity definition having a type corresponding to the locating information designated by the user input.

8. The method of claim 1 wherein storing the data item comprises:

establishing a correspondence between an entry and a particular entity definition.

9. The method of claim 1 wherein storing the data item comprises:

establishing a correspondence between an entry and a particular entity definition based on a second data item of the entry.

10. The method of claim 1 wherein storing the data item comprises:

establishing a correspondence between an entry and a particular entity definition based on a second data item of the entry; and

storing the data item within the entity definition at a location corresponding to the locating information designated by the user input and in association with the identifying information designated by the user input.

11. The method of claim 1 wherein storing the data item comprises:

identifying the entity definition based on one or more data items of the entry; and

storing the data item within the entity definition at a location corresponding to the locating information designated by the user input and in association with the identifying information designated by the user input.

12. The method of claim 1 wherein receiving user input designating, for a column of the table, information for at least one of identifying or locating within an entity definition a data item appearing in the column, comprises receiving a user input indicating acceptance of a default value, the default value corresponding to a data item of a header entry of the search result set.

13. The method of claim 1 wherein the machine data produced by or about the entity comprises machine data from two or more sources.

14. The method of claim 1 wherein the machine data produced by or about the entity comprises machine data produced by the entity and machine data produced about the entity by a source other than the entity.

15. The method of claim 1 wherein the machine data produced by or about the entity comprises unstructured machine data.

16. The method of claim 1 wherein the machine data produced by or about the entity comprises unstructured machine data stored as timestamped events.

17. The method of claim 1 wherein the machine data produced by or about the entity comprises unstructured machine data stored as timestamped events each comprising a segment of raw data.

18. The method of claim 1 further comprising storing the user input in an import configuration.

19. The method of claim 1 further comprising:

detecting a change between the search result set and a second search result set produced by a subsequent performance of the first search query; and

in response to detecting the change, storing a data item of an entry of the second search result set in an entity definition in accordance with a stored import configuration.

20. The method of claim 1 wherein the first search query is an ad-hoc search query or a saved search query.

21. A system comprising:

a memory; and

a processing device coupled with the memory to;

perform a first search query in response to user input to produce a search result set comprising one or more entries each having one or more data items;

cause display of the entries in a table of a user interface, the table having rows and columns, wherein the data items of each entry appear in respective columns of the same row;

receive user input designating, for a column of the table, information for at least one of identifying or locating a data item appearing in the column within an entity definition; and

store the data item appearing in the column in the entity definition in accordance with the user input;

wherein the entity definition represents an entity from among one or more entities that provide a service, the entity definition having an identification of machine data produced by or about the entity, the service having a Key Performance Indicator (KPI) defined by a second search query that derives a value at least in part from the machine data, thereby transforming at least the machine data to the value which indicates the performance of the service at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

22. The system of claim 21 wherein to store the data item comprises:

storing the data item within the entity definition at a location corresponding to locating information designated by the user input and in association with identifying information designated by the user input.

23. The system of claim 21 wherein to store the data item comprises:

establishing a correspondence between an entry and a particular entity definition based on a second data item of the entry; and

storing the data item within the entity definition at a location corresponding to the locating information designated by the user input and in association with the identifying information designated by the user input.

24. The system of claim 21 wherein the machine data produced by or about the entity comprises machine data from two or more sources.

25. The system of claim 21 wherein the machine data produced by or about the entity comprises unstructured machine data stored as timestamped events.

26. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

performing a first search query in response to user input to produce a search result set comprising one or more entries each having one or more data items;

causing display of the entries in a table of a user interface, the table having rows and columns, wherein the data items of each entry appear in respective columns of the same row;

receiving user input designating, for a column of the table, information for at least one of identifying or locating a data item appearing in the column within an entity definition; and

storing the data item appearing in the column in the entity definition in accordance with the user input;

wherein the entity definition represents an entity from among one or more entities that provide a service, the entity definition having an identification of machine data produced by or about the entity, the service having a Key Performance Indicator (KPI) defined by a second search query that derives a value at least in part from the machine data, thereby transforming at least the machine data to the value which indicates the performance of the service at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

27. The computer readable storage medium of claim 26 wherein storing the data item comprises:

storing the data item within the entity definition at a location corresponding to locating information designated by the user input and in association with identifying information designated by the user input.

28. The computer readable storage medium of claim 26 wherein storing the data item comprises:

establishing a correspondence between an entry and a particular entity definition based on a second data item of the entry; and

storing the data item within the entity definition at a location corresponding to the locating information designated by the user input and in association with the identifying information designated by the user input.

29. The computer readable storage medium of claim 26 wherein the machine data produced by or about the entity comprises machine data from two or more sources.

30. The computer readable storage medium of claim 26 wherein the machine data produced by or about the entity comprises unstructured machine data stored as timestamped events.