PREVIEWING PARSED RAW DATA USING A GRAPHICAL USER INTERFACE

• US 20160055214A1
• Filed: 10/31/2015
• Published: 02/25/2016
• Est. Priority Date: 08/17/2012
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Blank, Mitchell Neuman Jr., Budchenko, Leonid, Carasso, David, Delfino, Micah James, Hwang, Johnvey, Sorkin, Stephen Phillip, Woo, Eric Timothy
• Granted Patent: US 9,442,981 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/316 Indexing structures
• CPC Class Codes: G06F 16/901 Indexing; Data structures therefor; Storage structures for retrieval from the web G06F16/951
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/0485 Scrolling or panning
• CPC Class Codes: G06F 40/205 Parsing
• CPC Class Codes: G06V 10/245 by locating a pattern; Special marks for positioning
• CPC Class Codes: G06V 40/161 Detection; Localisation; Normalisation

Abstract

Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

Claims

1. A method, comprising:

selecting a portion of raw data from at least one data source;

receiving a first user input received via a graphical user interface defining a parsing rule to be applied to the selected portion of raw data;

parsing the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data;

causing the graphical user interface to display at least a portion of the set of searchable, time-stamped events;

in response to a second user input received via the graphical user interface, processing raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the parsing the selected portion of raw data further comprises:

causing display of the parsing rule in the graphical user interface.

3. The method of claim 1, wherein the display of the at least a portion of the set of searchable, time-stamped events includes an indication of how at least some of the selected portion of raw data has been parsed.

4. The method of claim 1, further comprising:

prior to receiving a first user input received via the graphical user interface, causing display of one or more selectable parsing rules.

5. The method of claim 1, further comprising:

prior to receiving a first user input received via the graphical user interface, causing display of one or more selectable parsing rules;

wherein the first user input is a parsing rule selected from the one or more parsing rules.

6. The method of claim 1, further comprising:

prior to receiving a first user input received via the graphical user interface, causing display of one or more selectable parsing rules;

wherein one or more of the selectable parsing rules were created by a user based on existing parsing rules;

wherein the first user input is a parsing rule selected from the one or more selectable parsing rules.

7. The method of claim 1, further comprising:

prior to receiving a first user input received via the graphical user interface, causing the graphical user interface to display the selected portion of raw data.

8. The method of claim 1, further comprising:

prior to receiving a first user input received via the graphical user interface, causing the graphical user interface to display the selected portion of raw data in a scrollable display.

9. The method of claim 1, wherein the causing the graphical user interface to display at least the portion of the set of searchable, time-stamped events displays the at least a portion of the set of searchable, time-stamped events in a scrollable display.

10. The method of claim 1, further comprising:

receiving a third user input indicating a user preference not to use the parsing rule;

parsing the selected portion of raw data into a set of searchable, time-stamped events using a second parsing rule.

11. The method of claim 1, further comprising:

receiving a third user input indicating a user preference not to use the parsing rule;

selecting a second parsing rule;

parsing the selected portion of raw data into a set of searchable, time-stamped events using the second parsing rule.

12. The method of claim 1, further comprising:

receiving a third user input indicating a user preference not to use the parsing rule;

receiving a fourth user input selecting a second parsing rule;

parsing the selected portion of raw data into a set of searchable, time-stamped events using the second parsing rule.

13. A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

selecting a portion of raw data from at least one data source;

receiving a first user input received via a graphical user interface defining a parsing rule to be applied to the selected portion of raw data;

parsing the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data;

causing the graphical user interface to display at least a portion of the set of searchable, time-stamped events;

in response to a second user input received via the graphical user interface, processing raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data.

14. The non-transitory computer-readable medium of claim 13, wherein the parsing the selected portion of raw data further comprises:

causing display of the parsing rule in the graphical user interface.

15. The non-transitory computer-readable medium of claim 13, wherein the display of the at least a portion of the set of searchable, time-stamped events includes an indication of how at least some of the selected portion of raw data has been parsed.

16. The non-transitory computer-readable medium of claim 13, wherein the one or more sequences of instructions when executed by the one or more processors causes the one or more processors to perform:

prior to receiving a first user input received via the graphical user interface, causing display of one or more selectable parsing rules.

17. The non-transitory computer-readable medium of claim 13, wherein the one or more sequences of instructions when executed by the one or more processors causes the one or more processors to perform:

prior to receiving a first user input received via the graphical user interface, causing display of one or more selectable parsing rules;

wherein the first user input is a parsing rule selected from the one or more parsing rules.

18. The non-transitory computer-readable medium of claim 13, wherein the one or more sequences of instructions when executed by the one or more processors causes the one or more processors to perform:

prior to receiving a first user input received via the graphical user interface, causing display of one or more selectable parsing rules;

wherein one or more of the selectable parsing rules were created by a user based on existing parsing rules;

wherein the first user input is a parsing rule selected from the one or more selectable parsing rules.

19. The non-transitory computer-readable medium of claim 13, wherein the one or more sequences of instructions when executed by the one or more processors causes the one or more processors to perform:

prior to receiving a first user input received via the graphical user interface, causing the graphical user interface to display the selected portion of raw data.

20. The non-transitory computer-readable medium of claim 13, wherein the one or more sequences of instructions when executed by the one or more processors causes the one or more processors to perform:

receiving a third user input indicating a user preference not to use the parsing rule;

parsing the selected portion of raw data into a set of searchable, time-stamped events using a second parsing rule.

21. The non-transitory computer-readable medium of claim 13, wherein the one or more sequences of instructions when executed by the one or more processors causes the one or more processors to perform:

receiving a third user input indicating a user preference not to use the parsing rule;

selecting a second parsing rule;

parsing the selected portion of raw data into a set of searchable, time-stamped events using the second parsing rule.

22. An apparatus, comprising:

a raw data selector, implemented at least partially in hardware, that selects a portion of raw data from at least one data source;

a user input receiver, implemented at least partially in hardware, that receives a first user input received via a graphical user interface defining a parsing rule to be applied to the selected portion of raw data;

a raw data parser, implemented at least partially in hardware, that parses the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data;

a display subsystem, implemented at least partially in hardware, that causes the graphical user interface to display at least a portion of the set of searchable, time-stamped events;

the raw data parser, in response to a second user input received via the graphical user interface, processes raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data.

23. The apparatus of claim 22, wherein the display subsystem causes display of the parsing rule in the graphical user interface.

24. The apparatus of claim 22, wherein the display subsystem causes display of an indication of how at least some of the selected portion of raw data has been parsed in the graphical user interface.

25. The apparatus of claim 22, wherein the display subsystem, prior to receiving a first user input received via the graphical user interface, causes display of one or more selectable parsing rules.

26. The apparatus of claim 22, wherein:

the display subsystem, prior to receiving a first user input received via the graphical user interface, causes display of one or more selectable parsing rules;

the first user input is a parsing rule selected from the one or more parsing rules.

27. The apparatus of claim 22, wherein:

the display subsystem, prior to receiving a first user input received via the graphical user interface, causes display of one or more selectable parsing rules;

one or more of the selectable parsing rules were created by a user based on existing parsing rules;

the first user input is a parsing rule selected from the one or more selectable parsing rules.

28. The apparatus of claim 22, wherein the display subsystem, prior to receiving a first user input received via the graphical user interface, causes the graphical user interface to display the selected portion of raw data.

29. The apparatus of claim 22, wherein:

the user input receiver receives a third user input indicating a user preference not to use the parsing rule;

the raw data parser parses the selected portion of raw data into a set of searchable, time-stamped events using a second parsing rule.

30. The apparatus of claim 22, further comprising:

wherein the user input receiver receives a third user input indicating a user preference not to use the parsing rule;

a parsing rule selector, implemented at least partially in hardware, that selects a second parsing rule;

wherein the raw data parser parses the selected portion of raw data into a set of searchable, time-stamped events using the second parsing rule.