ADVANCED FIELD EXTRACTOR WITH MODIFICATION OF AN EXTRACTED FIELD
First Claim
1. A computer-implemented method comprising:
- accessing in memory a set of events, each event identified by an associated time stamp;
wherein each event in the set of events includes a portion of raw data;
receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields;
automatically determining an initial extraction rule that extracts the selected portions of text within the first event;
causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and;
selecting one or more non-adjoining strings to concatenate with the selected field;
selecting a portion of the selected field to be trimmed from the beginning or end of the selected field;
orselecting sub-portions of text to extract from within the selected field.
2 Assignments
0 Petitions
Accused Products
Abstract
The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.
-
Citations
29 Claims
-
1. A computer-implemented method comprising:
-
accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and; selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field;
orselecting sub-portions of text to extract from within the selected field. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A computer-implemented system comprising:
-
a processor, memory coupled to the processor, and instructions stored in the memory that implement the actions of; accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and; selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field;
orselecting sub-portions of text to extract from within the selected field. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20)
-
-
21. A tangible computer-readable memory having instructions stored in the memory that implement the actions including:
-
accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and; selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field;
orselecting sub-portions of text to extract from within the selected field. - View Dependent Claims (22, 23, 24, 25, 26, 27, 28, 29)
-
Specification