Executing search commands based on selections of time increments and field-value pairs

• US 10,599,308 B2
• Filed: 10/24/2018
• Issued: 03/24/2020
• Est. Priority Date: 10/05/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Burke, Cory Eugene, Feeney, Katherine Kyle, Lamas, Divanny I., Robichaud, Marc Vincent, Ness, Matthew G., Lee, Clara E.
• Primary Examiner(s): Bycer, Eric J.
• Application Number:
  US16/169,815
• Publication Number:
  US 20190056853A1
• Time in Patent Office: 517 Days
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/18 of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06V 10/22 by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition

Abstract

In embodiments of statistics time chart interface cell mode drill down, a first interface displays in a table format that includes columns each having a column heading comprising a different value, each different value associated with a particular event field, and includes one or more rows, each row having a time increment and aggregated metrics that each represent a number of events having a field-value pair that matches the different value represented in one of the columns and within the time increment over which the aggregated metric is calculated. A cell can be emphasized that includes one of the aggregated metrics in a row that includes the respective time increment, and in response, a menu displays options to transition to a second interface.

Claims

1. A method, comprising:

causing display of a first interface in a table format that includes;

a first column and a second column, wherein the first column is associated with a plurality of time increments and the second column is associated with a first value of a first event field of a plurality of events;

a first cell, of the first column, that displays a first time increment of the plurality of time increments;

a second cell, of the second column, that displays a first aggregated metric that indicates a number of events of the plurality of events, wherein each event contributing to the number of events occurred within the first time increment and has a field-value pair that matches the first value of the first event field;

in response to receiving a first selection of the second cell and a second selection of a first option of a plurality of options, identifying one or more events of the plurality of events, wherein each of the identified one or more events has a first relationship to the first time increment and a second relationship to the first value of the first event field that is based on the selected first option; and

causing display of the identified one or more events.

2. The method as recited in claim 1, wherein the first time increment includes a date.

3. The method as recited in claim 1, wherein the identified one or more events is displayed via a second interface that displays a narrowed list of events, wherein each event included in the narrowed lists of events has a field-value pair that matches the first value of the first event field and occurred within the first time increment.

4. The method as recited in claim 1, wherein the identified one or more events excludes events having a field-value pair matching a different value than the first value of the first event field.

5. The method as recited in claim 1, wherein the first aggregated metric indicates a number of events corresponding to a first row of the first interface, and the identified one or more events includes each event included in the number of events corresponding to the first row.

6. The method as recited in claim 1, wherein the first relationship comprises the time being within the respective time increment.

7. The method as recited in claim 1, wherein the plurality of options are displayed in a menu of the first interface, and the menu includes a view events option corresponding to the first relationship comprising the identified one or more events being within the first time increment and an exclude from results option corresponding to the first relationship comprising the time being outside of the first time increment.

8. The method as recited in claim 1, wherein the plurality of options are displayed in a menu of the first interface, and the menu includes a view events option that is selectable to cause a second interface that displays the identified one or more events to display a narrowed list of events, wherein each event included in the narrowed list of events has a field-value pair that matches the first value of the first event field and occurred within the first time increment.

9. The method as recited in claim 1, wherein the plurality of options are displayed in a menu of the second interface, and the menu includes an exclude from results option, wherein when the exclude from results option is selected, the first relationship comprises that the time associated with the identified one or more events is outside the first time increment, and the at least the identified one or more events excludes events having a field-value pair matching the first value of the first event field and occurred within the first time increment.

10. The method as recited in claim 1, wherein:

the plurality of options are displayed in a menu of the first interface, and the menu includes a view events option and an exclude from results option, wherein

when the view events option is selected, a second interface displays a narrowed list of events and each event included in the narrowed list of events has a field-value pair that matches the first value of the first event field and occurred within the first time increment, and

when the exclude from results option is selected, a separate list of events is displayed by the second interface, the separate list of events excludes the events having the field-value pair matching the first value of the first event field.

11. The method as recited in claim 1, wherein a menu of the first interface displays the plurality of options, and the menu includes a view events option and a corresponding designation of a time duration that encompasses the first time increment, the corresponding designation further displaying a field-value pair matching the first value of the first event field.

12. The method as recited in claim 1, wherein a menu of the first interface displays the plurality of options, and the menu includes an exclude from results option and a corresponding designation displaying a field-value pair matching a different value than the first value of the first event field.

13. The method as recited in claim 1, wherein in response to receiving the first selection of the second cell, the second cell is emphasized and is responsive to detection of an input pointer over the first aggregated metric of the second cell.

14. The method as recited in claim 1, wherein in response to receiving the first selection of the second cell, the second cell is emphasized by highlighting the second cell.

15. The method as recited in claim 1, wherein the identified one or more events are initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

16. The method as recited in claim 1, wherein the identified one or more events are returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

17. The method as recited in claim 1, wherein each event of the identified one or more events comprises a portion of raw data that is associated with a timestamp indicating a respective point in time.

18. A system, comprising:

a processor device; and

a computer-readable storage medium, coupled with the processor device, having instructions stored thereon, which, when executed by the processor device, cause the system to perform actions comprising;

causing display of a first interface in a table format that includes;

a first column and a second column, wherein the first column is associated with a plurality of time increments and the second column is associated with a first value of a first event field of a plurality of events;

a first cell, of the first column, that displays a first time increment of the plurality of time increments;

a second cell, of the second column, that displays a first aggregated metric that indicates a number of events of the plurality of events, wherein each event contributing to the number of events occurred within the first time increment and has a field-value pair that matches the first value of the first event field;

in response to receiving a first selection of the second cell and a second selection of a first option of a plurality of options, identifying one or more events of the plurality of events, wherein each of the identified one or more events has a first relationship to the first time increment and a second relationship to the first value of the first event field that is based on the selected first option; and

causing display of the identified one or more events.

19. The system as recited in claim 18, wherein the first time increment includes a date.

20. The system as recited in claim 18, wherein the identified one or more events is displayed via a second interface that displays a narrowed list of events, wherein each event included in the narrowed lists of events has a field-value pair that matches the first value of the first event field and occurred within the first time increment.

21. The system as recited in claim 18, wherein the identified one or more events excludes events having a field-value pair matching a different value than the first value of the first event field.

22. The system as recited in claim 18, wherein the first aggregated metric indicates a number of events corresponding to a first row of the first interface, and the identified one or more events includes each event included in the number of events corresponding to the first row.

23. The system as recited in claim 18, wherein the first aggregated metric indicates a number of events corresponding to the first row.

24. The system as recited in claim 18, wherein the first relationship comprises the time being within the respective time increment.

25. The system as recited in claim 18, wherein the plurality of options are displayed in a menu of the first interface, and the menu includes a view events option corresponding to the first relationship comprising the identified one or more events being within the first time increment and an exclude from results option corresponding to the first relationship comprising the time being outside of the first time increment.

26. One or more non-transitory computer-readable, non-volatile storage memory comprising stored instructions that are executable and, responsive to execution by a computing device, the computing device performs operations comprising:

causing display of a first interface in a table format that includes;

a first column and a second column, wherein the first column is associated with a plurality of time increments and the second column is associated with a first value of a first event field of a plurality of events;

a first cell, of the first column, that displays a first time increment of the plurality of time increments;

a second cell, of the second column, that displays a first aggregated metric that indicates a number of events of the plurality of events, wherein each event contributing to the number of events occurred within the first time increment and has a field-value pair that matches the first value of the first event field;

in response to receiving a first selection of the second cell and a second selection of a first option of a plurality of options, identifying one or more events of the plurality of events, wherein each of the identified one or more events has a first relationship to the first time increment and a second relationship to the first value of the first event field that is based on the selected first option; and

causing display of the identified one or more events.

27. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the first time increment includes a date.

28. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the identified one or more events is displayed via a second interface that displays a narrowed list of events, wherein each event included in the narrowed lists of events has a field-value pair that matches the first value of the first event field and occurred within the first time increment.

29. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the identified one or more events excludes events having a field-value pair matching a different value than the first value of the first event field.

30. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the plurality of options are displayed in a menu of the first interface, and the menu includes a view events option that is selectable to cause a second interface that displays the identified one or more events to display a narrowed list of events, wherein each event included in the narrowed list of events has a field-value pair that matches the first value of the first event field and occurred within the first time increment.