Generating Reports from Unstructured Data
First Claim
1. A method comprising:
- identifying events matching criteria of an initial search query, wherein each of the events comprises a portion of raw machine data that is associated with a time;
identifying a set of fields, each field defined for one or more of the identified events, and each field is defined by an extraction rule for extracting a value for each of the one or more identified events from the portion of raw data in the event;
causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events, each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields;
receiving, via the GUI, a report definition indicating how to report information relating to the matching events; and
generating, based on the report definition, a report comprising information relating to the matching events.
1 Assignment
0 Petitions
Accused Products
Abstract
The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.
-
Citations
30 Claims
-
1. A method comprising:
-
identifying events matching criteria of an initial search query, wherein each of the events comprises a portion of raw machine data that is associated with a time; identifying a set of fields, each field defined for one or more of the identified events, and each field is defined by an extraction rule for extracting a value for each of the one or more identified events from the portion of raw data in the event; causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events, each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields; receiving, via the GUI, a report definition indicating how to report information relating to the matching events; and generating, based on the report definition, a report comprising information relating to the matching events. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
-
-
29. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by a processing device, cause the processing device to perform operations comprising:
-
identifying events matching criteria of an initial search query, wherein each of the events comprises a portion of raw machine data that is associated with a time; identifying a set of fields, each field defined for one or more of the identified events, and each field is defined by an extraction rule for extracting a value for each of the one or more identified events from the portion of raw data in the event; causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events, each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields; receiving, via the GUI, a report definition indicating how to report information relating to the matching events; and generating, based on the report definition, a report comprising information relating to the matching events.
-
-
30. A system comprising:
-
a non-transitory computer readable storage medium comprising program instructions; and a processing device configured to execute the program instructions to cause; identifying events matching criteria of an initial search query, wherein each of the events comprises a portion of raw machine data that is associated with a time; identifying a set of fields, each field defined for one or more of the identified events, and each field is defined by an extraction rule for extracting a value for each of the one or more identified events from the portion of raw data in the event; causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events, each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields; receiving, via the GUI, a report definition indicating how to report information relating to the matching events; and generating, based on the report definition, a report comprising information relating to the matching events.
-
Specification