Statistics Time Chart Interface Cell Mode Drill Down

• US 20160098464A1
• Filed: 10/28/2014
• Published: 04/07/2016
• Est. Priority Date: 10/05/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Burke, Cory Eugene, Feeney, Katherine Kyle, Lamas, Divanny I., Robichaud, Marc Vincent, Ness, Matthew G., Lee, Clara E.
• Granted Patent: US 10,139,997 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 40/18 of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06V 10/22 by selection of a specific region containing or referencing a pattern; Locating or processing of specific regions to guide the detection or recognition

Abstract

In embodiments of statistics time chart interface cell mode drill down, a first interface displays in a table format that includes columns each having a column heading comprising a different value, each different value associated with a particular event field, and includes one or more rows, each row having a time increment and aggregated metrics that each represent a number of events having a field-value pair that matches the different value represented in one of the columns and within the time increment over which the aggregated metric is calculated. A cell can be emphasized that includes one of the aggregated metrics in a row that includes the respective time increment, and in response, a menu displays options to transition to a second interface.

Claims

1. A method, comprising:

executing a search system on one or more computing devices to perform;

causing display of a first interface in a table format that includes;

one or more columns, each column having a column heading comprising a different value, each different value associated with a particular event field;

one or more rows, each row comprising a time increment and one or more aggregated metrics, each aggregated metric representing a number of events having a field-value pair that matches the different value represented in one of the columns and within the time increment over which the aggregated metric is calculated;

causing emphasis of a cell in the table format, the cell including one of the aggregated metrics in a row that includes the respective time increment; and

causing display of a menu of options that are selectable to transition to a second interface based on a selected one of the options.

2. The method as recited in claim 1, wherein the time increment of each row includes a date associated with the time increment.

3. The method as recited in claim 1, wherein the second interface is an events interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell.

4. The method as recited in claim 1, wherein the second interface is the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

5. The method as recited in claim 1, wherein:

the second interface is an events interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell;

or

the second interface is the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

6. The method as recited in claim 1, further comprising:

receiving a selection of the emphasized cell; and

said causing the display of the menu proximate the emphasized cell in the first interface based on the selection of the emphasized cell.

7. The method as recited in claim 1, wherein the options displayed in the menu include a view events option and an exclude from results option.

8. The method as recited in claim 1, wherein the options displayed in the menu include a view events option that is selectable to said transition to the second interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell.

9. The method as recited in claim 1, wherein the options displayed in the menu include an exclude from results option that is selectable to said transition to the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

10. The method as recited in claim 1, wherein:

the options displayed in the menu include a view events option and an exclude from results option;

the view events option being selectable to said transition to the second interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell; and

the exclude from results option being selectable to said transition to the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

11. The method as recited in claim 1, wherein the menu includes a view events option and a corresponding designation of a time duration that encompasses the time increment corresponding to the emphasized cell, the designation further displaying the field-value pair corresponding to the column of the respective value.

12. The method as recited in claim 1, wherein the menu includes an exclude from results option and a corresponding designation displaying the field-value pair corresponding to the column of the respective value.

13. The method as recited in claim 1, further comprising:

said causing the emphasized cell responsive to detection of an input pointer detected over any of the one or more aggregated metrics in the row with the emphasized cell.

14. The method as recited in claim 1, wherein said causing emphasis of the cell in the row that includes the time increment and the one or more aggregated metrics.

15. The method as recited in claim 1, wherein events are initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

16. The method as recited in claim 1, wherein events are returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

17. The method as recited in claim 1, wherein events each comprise a portion of raw data that is associated with a timestamp indicating a respective point in time.

18. A system, comprising:

one or more data stores configured to store collected data that is searchable by a search system using a late-binding schema;

a processing system to implement the search system on one or more computing devices, the search system configured to;

initiate display of a first interface in a table format that includes;

one or more columns, each column having a column heading comprising a different value, each different value associated with a particular event field;

one or more rows, each row comprising a time increment and one or more aggregated metrics, each aggregated metric representing a number of events having a field-value pair that matches the different value represented in one of the columns and within the time increment over which the aggregated metric is calculated;

emphasize a cell in the table format, the cell including one of the aggregated metrics in a row that includes the respective time increment; and

initiate display of a menu of options that are selectable to transition to second interface based on a selected one of the options.

19. The system as recited in claim 18, wherein the time increment of each row includes a date associated with the time increment.

20. The system as recited in claim 18, wherein the second interface is an events interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell.

21. The system as recited in claim 18, wherein the second interface is the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

22. The system as recited in claim 18, wherein the options displayed in the menu include a view events option and an exclude from results option;

the view events option being selectable to initiate displaying a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell; and

the exclude from results option being selectable to initiate excluding the field-value pair corresponding to the column of the respective value.

23. The system as recited in claim 18, wherein:

the options displayed in the menu include a view events option and an exclude from results option;

the view events option being selectable to said transition to the second interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell; and

the exclude from results option being selectable to said transition to the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

24. The system as recited in claim 18, wherein the menu includes a view events option and a corresponding designation of a time duration that encompasses the time increment corresponding to the emphasized cell, the designation further displaying the field-value pair corresponding to the column of the respective value.

25. The system as recited in claim 18, wherein the menu includes an exclude from results option and a corresponding designation displaying the field-value pair corresponding to the column of the respective value.

26. One or more computer-readable, non-volatile storage memory comprising stored instructions that are executable and, responsive to execution by a computing device, the computing device performs operations comprising:

causing display of a first interface in a table format that includes;

one or more columns, each column having a column heading comprising a different value, each different value associated with a particular event field;

one or more rows, each row comprising a time increment and one or more aggregated metrics, each aggregated metric representing a number of events having a field-value pair that matches the different value represented in one of the columns and within the time increment over which the aggregated metric is calculated;

causing emphasis of a cell in the table format, the cell including one of the aggregated metrics in a row that includes the respective time increment; and

causing display of a menu of options that are selectable to transition to a second interface based on a selected one of the options.

27. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the time increment of each row includes a date associated with the time increment.

28. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the second interface is an events interface that displays a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell.

29. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the second interface is the first interface displayed excluding the field-value pair corresponding to the column of the respective value.

30. The one or more computer-readable, non-volatile storage memory as recited in claim 26, wherein the options displayed in the menu include a view events option and an exclude from results option;

the view events option being selectable to initiate displaying a narrowed list of events that include the field-value pair that matches the different value represented in one of the columns and within a time duration of the time increment in the row with the emphasized cell; and

the exclude from results option being selectable to initiate excluding the field-value pair corresponding to the column of the respective value.