Statistics Value Chart Interface Cell Mode Drill Down

• US 20160098385A1
• Filed: 10/28/2014
• Published: 04/07/2016
• Est. Priority Date: 10/05/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Burke, Cory Eugene, Feeney, Katherine Kyle, Lamas, Divanny I., Robichaud, Marc Vincent, Ness, Matthew G., Lee, Clara E.
• Granted Patent: US 10,261,673 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/18 of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06V 10/22 by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition

Abstract

In embodiments of statistics value chart interface cell mode drill down, a first interface displays in a table format that includes columns each with field values of an event field, and each column having a column heading of a different one of the event fields, and includes rows each with one or more of the field values, each field value in a row associated with a different one of the event fields, and having an aggregated metric that represents a number of events with field-value pairs that match all of the field values listed in a respective row and the corresponding event fields listed in the respective columns. A cell can be emphasized that includes one of the field values in a row that corresponds to one of the different event fields in a column, and in response, a menu displays options to transition to a second interface.

Claims

1. A method, comprising:

executing a search system on one or more computing devices to perform;

causing display of a first interface in a table format that includes;

one or more columns, each column comprising field values of an event field, and each column having a column heading comprising a different one of the event fields;

one or more rows, each row comprising one or more of the field values, each field value in a row associated with a different one of the event fields, and each row comprising an aggregated metric that represents a number of events having field-value pairs that match all of the one or more field values listed in a respective row and the corresponding event fields listed in the respective columns;

causing emphasis of a cell in the table format, the cell including one of the field values in a row that corresponds to one of the different event fields in a column; and

causing display of a menu of options that are selectable to transition to a second interface based on a selected one of the options.

2. The method as recited in claim 1, wherein each of the one or more rows further include an aggregated metric that represents a number of events having field-value pairs matching the one or more field values listed in a respective row.

3. The method as recited in claim 1, wherein the second interface is an events interface that displays either a list of events that include the field-value pairs that match the field value of the emphasized cell, or other events that do not include the field-value pairs that match the field value of the emphasized cell.

4. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell.

5. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell.

6. The method as recited in claim 1, wherein the second interface is an events interface that displays either a list of events that include field-value pairs that match the one or more of the field values listed in the row with the emphasized cell, or other events that do not include field-value pairs that match the one or more of the field values listed in the row with the emphasized cell.

7. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events that include field-value pairs that match the one or more of the field values listed in the row with the emphasized cell.

8. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of other events that do not include field-value pairs that match the one or more of the field values listed in the row with the emphasized cell.

9. The method as recited in claim 1, wherein the second interface is an events interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell and the field-value pairs that match the field values listed in the row to the left of the emphasized cell.

10. The method as recited in claim 1, wherein the second interface is the first interface displayed excluding the field value in the emphasized cell and the corresponding column.

11. The method as recited in claim 1, wherein:

the second interface is an events interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell and one or more of the field-value pairs that match the field values listed in the row of the emphasized cell;

or

the second interface is the first interface displayed excluding the field-value pairs that match the field value in the emphasized cell and the corresponding column.

12. The method as recited in claim 1, further comprising:

receiving a selection of the emphasized cell; and

said causing the display of the menu proximate the emphasized cell in the first interface based on the selection of emphasized cell.

13. The method as recited in claim 1, wherein the options displayed in the menu include a view events option, an other events option, an exclude from results option, and a new search option.

14. The method as recited in claim 1, wherein the options displayed in the menu include a view events option that is selectable to said transition to the second interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell.

15. The method as recited in claim 1, wherein the options displayed in the menu include an other events option that is selectable to said transition to the second interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell.

16. The method as recited in claim 1, wherein the options displayed in the menu include an exclude from results option that is selectable to said transition to the first interface displayed excluding the field value of the emphasized cell and the corresponding column.

17. The method as recited in claim 1, wherein the options displayed in the menu include a new search option that is selectable to create a new search based on the field value of the emphasized cell.

18. The method as recited in claim 1, wherein:

the options displayed in the menu include a view events option, an other events option, an exclude from results option, and a new search option;

the view events option being selectable to said transition to the second interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell;

the other events option being selectable to said transition to the second interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell;

the exclude from results option being selectable to said transition to the first interface displayed excluding the field value of the emphasized cell and the corresponding column; and

the new search option being selectable to create a new search based on the field value of the emphasized cell.

19. The method as recited in claim 1, wherein the menu includes a designation of a field-value pair that includes the field value of the emphasized cell.

20. The method as recited in claim 1, wherein the menu includes a designation of a field-value pair that includes the field value of the emphasized cell, and the field values listed in the row to the left of the emphasized cell.

21. The method as recited in claim 1, wherein the menu includes a designation of a field-value pair that includes the field value of the emphasized cell, and one or more of the field values listed in the row of the emphasized cell.

22. The method as recited in claim 1, further comprising:

said emphasizing the cell responsive to detection of an input pointer over the emphasized cell in the first interface.

23. The method as recited in claim 1, wherein said causing emphasis of the cell in the row of the one or more fields comprises highlighting the row.

24. The method as recited in claim 1, wherein the events are initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

25. The method as recited in claim 1, wherein the events are returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

26. The method as recited in claim 1, wherein the events each comprise a portion of raw data that is associated with a timestamp indicating a respective point in time.

27. A system, comprising:

one or more data stores configured to store collected data that is searchable by a search system using a late-binding schema;

a processing system to implement the search system on one or more computing devices, the search system configured to;

initiate display of a first interface in a table format that includes;

one or more columns, each column comprising field values of an event field, and each column having a column heading comprising a different one of the event fields;

one or more rows, each row comprising one or more of the field values, each field value in a row associated with a different one of the event fields, and each row comprising an aggregated metric that represents a number of events having field-value pairs that match all of the one or more field values listed in a respective row and the corresponding event fields listed in the respective columns;

emphasize a cell in the table format, the cell including one of the field values in a row that corresponds to one of the different event fields in a column; and

initiate display of a menu of options that are selectable to transition to a second interface based on a selected one of the options.

28. The system as recited in claim 27, wherein the second interface is the first interface displayed excluding the field-value pairs that match the field value in the emphasized cell and the corresponding column.

29. The system as recited in claim 27, wherein the options displayed in the menu include a view events option, an other events option, an exclude from results option, and a new search option;

the view events option being selectable to said transition to the second interface that displays a list of events that include the field-value pairs that match the field value of the emphasized cell;

the other events option being selectable to said transition to the second interface that displays a list of other events that do not include the field-value pairs that match the field value of the emphasized cell;

the exclude from results option being selectable to said transition to the first interface displayed excluding the field value of the emphasized cell and the corresponding column; and

the new search option being selectable to create a new search based on the field value of the emphasized cell.

30. One or more computer-readable, non-volatile storage memory comprising stored instructions that are executable and, responsive to execution by a computing device, the computing device performs operations comprising:

causing display of a first interface in a table format that includes;

one or more columns, each column comprising field values of an event field, and each column having a column heading comprising a different one of the event fields;

one or more rows, each row comprising one or more of the field values, each field value in a row associated with a different one of the event fields, and each row comprising an aggregated metric that represents a number of events having field-value pairs that match all of the one or more field values listed in a respective row and the corresponding event fields listed in the respective columns;

causing emphasis of a cell in the table format, the cell including one of the field values in a row that corresponds to one of the different event fields in a column; and

causing display of a menu of options that are selectable to transition to a second interface based on a selected one of the options.