DATA MODEL FOR MACHINE DATA FOR SEMANTIC SEARCH
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments are directed towards generating data models that may give semantic meaning for unstructured data or structured data that may include data generated and/or received by search engines, including a time series engine. Data models also may be generated to provide semantic meaning to structured data. A data model may be composed of a hierarchical data model objects analogous to an object-oriented programming class hierarchy. Users may employ a data modeling application to produce reports using search objects that may be part of, or associated with the data model. The data modeling application may employ the search object and the data model to generate a query string for searching a data repository to produce a result set. A data modeling application may map the result set data to data model objects that may be used to generate reports.
-
Citations
54 Claims
-
1-24. -24. (canceled)
-
25. A computer implemented method, comprising:
-
storing a set of time stamped events in a data store on a computing device including one or more processors, wherein the set of events are searchable, and wherein the set of events include unstructured machine data; generating, by the computing device, a data model that models the set of events, wherein the data model defines a schema for the unstructured data in the set of events without modifying an organization of the unstructured data, wherein the data model includes one or more sub-models, and wherein each sub-model includes criteria for identifying a subset of the set of events corresponding to the sub-model; displaying a graphical interface that enables selection of one or more sub-models of the data model; receiving input corresponding to a selection of a sub-model through the graphical interface; narrowing the set of events that are searchable to a subset of events that correspond to criteria for the selected sub-model; and generating a search query based on the generated data model. - View Dependent Claims (26, 27, 28, 29, 30, 31, 32, 33, 34)
-
-
35. A system, comprising:
-
a processor, and a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including; storing a set of time stamped events in a data store on a computing device including one or more processors, wherein the set of events are searchable, and wherein the set of events include unstructured machine data; generating a data model that models the set of events, wherein the data model defines a schema for the unstructured data in the set of events without modifying an organization of the unstructured data, wherein the data model includes one or more sub-models, and wherein each sub-model includes criteria for identifying a subset of the set of events corresponding to the sub-model; displaying a graphical interface that enables selection of one or more sub-models of the data model; receiving input corresponding to a selection of a sub-model through the graphical interface; narrowing the set of events that are searchable to a subset of events that correspond to criteria for the selected sub-model; and generating a search query based on the generated data model. - View Dependent Claims (36, 37, 38, 39, 40, 41, 42, 43, 44)
-
-
45. A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:
-
store a set of time stamped events in a data store on a computing device including one or more processors, wherein the set of events are searchable, and wherein the set of events include unstructured machine data; generate a data model that models the set of events, wherein the data model defines a schema for the unstructured data in the set of events without modifying an organization of the unstructured data, wherein the data model includes one or more sub-models, and wherein each sub-model includes criteria for identifying a subset of the set of events corresponding to the sub-model; display a graphical interface that enables selection of one or more sub-models of the data model; receive input corresponding to a selection of a sub-model through the graphical interface; narrow the set of events that are searchable to a subset of events that correspond to criteria for the selected sub-model; and generate a search query based on the generated data model. - View Dependent Claims (46, 47, 48, 49, 50, 51, 52, 53, 54)
-
Specification