DATA SUMMARY VIEW

• US 20160224532A1
• Filed: 07/31/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: MILLER, JESSE, Robichaud, Marc V., Burke, Cory, Lloyd, Jeffrey Thomas
• Granted Patent: US 10,185,708 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/235 Update request formulation
• CPC Class Codes: G06F 16/2372 Updates performed during offline database operations
• CPC Class Codes: G06F 16/2423 Interactive query statement specification based on a database schema
• CPC Class Codes: G06F 16/24524 Access plan code generation and invalidation; Reuse of access plans
• CPC Class Codes: G06F 16/24544 Join order optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/33 Querying
• CPC Class Codes: G06F 16/3334 Selection or weighting of terms from queries, including natural language queries
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 40/177 of tables; using ruled lines
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]

Abstract

Embodiments of the present invention provide methods, computer-readable media, and systems directed at providing a data summary view. In some embodiments, a method may include receiving a request to display a data summary view of search results of a search query. The request may be received while the search results are displayed in a table format. The method may further include causing display of the data summary view. The data summary view can include a summary report for a selected event attribute of a plurality of event attributes that are represented in the table format. The summary report can include summary entries that present a summary of data items of the selected event attribute and a summary graph of the data items. The summary graph may depict a distribution of at least a subset of the data items of the selected event attribute over a period of time.

Claims

1. A computer-implemented method comprising:

receiving a request to display a data summary view of search results of a search query, the request being received while the search results are displayed in a table format within a search screen, the table format including;

a plurality of rows, each row representing an event of a set of events, the set of events satisfying the search query; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

in response to receiving the request, causing display of the data summary view, the data summary view including a summary report for a selected event attribute of the plurality of event attributes, the summary report including summary entries that present a summary of data items of the selected event attribute and a summary graph of the data items, the summary graph depicting a distribution of at least a subset of the data items of the selected event attribute over a period of time.

2. The computer-implemented method of claim 1, wherein the data summary view includes an additional summary report for each of one or more additional event attributes of the plurality of event attributes, each additional summary report including summary entries and a summary graph of data items of a respective one of the one or more additional event attributes.

3. The computer-implemented method of claim 1, wherein the data summary view includes additional summary reports such that the respective event attributes represented by the columns of the table format are each represented by a respective summary report, each of the additional summary reports including summary entries and a summary graph of data items for the respective event attribute.

4. The computer-implemented method of claim 1, wherein causing display of the data summary view includes causing the data summary view to overlay the table format.

5. The computer-implemented method of claim 1, wherein causing display of the data summary view includes causing the data summary view to overlay the table format, the method further comprising enabling a user to switch from the data summary view to the table format from within the data summary view and switch from the table format to the data summary view from within the table format.

6. The computer-implemented method of claim 1, wherein causing display of the data summary view includes causing the data summary view to overlay a column that represents the selected event attribute.

7. The computer-implemented method of claim 1, wherein causing display of the data summary view includes causing the data summary view to overlay a column that represents the selected event attribute such that a remainder of the table format is still visible.

8. The computer-implemented method of claim 1,

wherein each of the plurality of columns is selectable by a user,

wherein the request to display a data summary view includes an identifier of a column of the plurality of columns that has been selected by the user, and

wherein the selected event attribute is the respective event attribute represented by the identified column.

9. The computer-implemented method of claim 1, wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:

in response to receiving a selection of a summary entry, updating the search query based on the selected summary entry.

10. The computer-implemented method of claim 1, wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:

in response to receiving a selection of a summary entry;

causing display of a list of options corresponding to the selected summary entry; and

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

11. The computer-implemented method of claim 1, wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:

in response to receiving a selection of a summary entry;

causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute; and

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

12. The computer-implemented method of claim 1, wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:

in response to receiving a selection of a summary entry;

causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute, wherein the data type of the selected summary entry is a time data type, numeric data type, a categorical data type, or a user defined data type; and

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

13. The computer-implemented method of claim 1, wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:

in response to receiving a selection of a summary entry;

causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute;

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options; and

automatically updating the search results and the summary report to correspond with the updated search query.

14. The computer-implemented method of claim 1, wherein the data summary view is interactive such that the summary entries are user selectable, the method further comprising:

in response to receiving a selection of a summary entry;

causing display of a list of options corresponding to the selected summary entry, the list of options based on a data type of the selected event attribute;

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options; and

automatically updating the search results and the summary report to correspond with the updated search query, wherein updating the search results comprises;

applying a late binding schema to the set of events, the late binding schema associated with one or more extraction rules that are based on the updated search query.

15. The computer-implemented method of claim 1, wherein the summary graph is interactive to enable selection, by the user, of values of data items of an event attribute within the summary graph, the method further comprising:

in response to receiving a selection of a value within the summary graph by the user;

causing display of a list of options corresponding to the selected value; and

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

16. The computer-implemented method of claim 1, wherein the summary graph is interactive to enable selection, by the user, of a range of values of data items of an event attribute within the summary graph, the method further comprising:

in response to receiving a selection of a range of values within the summary graph by the user;

causing display of a list of options corresponding to the selected range of values; and

updating the search query by causing one or more commands to be added to the search query, the one or more commands being based, at least in part, on an option that is selected from the list of options.

17. The computer-implemented method of claim 1, wherein a format of the summary entries and the summary graph are based on a data type associated with the selected event attribute.

18. The computer-implemented method of claim 1, wherein the summary entries identify one or more values within the data items of the selected event attribute that occur above an upper occurrence threshold.

19. The computer-implemented method of claim 1, wherein the summary entries identify one or more values within the data items of the selected event attribute that occur below a lower occurrence threshold.

20. The computer-implemented method of claim 1, wherein the summary entries identify one or more values within the data items of the selected event attribute that are beyond a threshold of similarity from other values within the data items of the selected event attribute.

21. The computer-implemented method of claim 1, wherein the summary entries are based on a data type of the selected event attribute, wherein summary entries for a numeric data type include one or more of:

a maximum value, a minimum value, a mean value, a median value, a mode value, and a standard deviation.

22. The computer-implemented method of claim 1, wherein the summary graph depicts the distribution of values of the subset of the data items of the selected event attribute over a period of time, and wherein the distribution of values includes one or more of a maximum value, a minimum value, a standard deviation, and an average value.

23. The computer-implemented method of claim 1, wherein the summary entries include summary statistics.

24. The computer-implemented method of claim 1, wherein the summary entries include summary statistics based on a data type of the first summary entries, wherein summary statistics for a numeric data type include one or more of:

a maximum value, a minimum value, a mean value, a median value, a mode value, and a standard deviation.

26. The one or more computer-readable media of claim 1, wherein the data summary view includes an additional summary report for each of one or more additional event attributes of the plurality of event attributes, each additional summary report including summary entries and a summary graph of data items of a respective one of the one or more additional event attributes.

27. The one or more computer-readable media of claim 1, wherein the data summary view includes additional summary reports such that the respective event attributes represented by the columns of the table format are each represented by a respective summary report, each of the additional summary reports including summary entries and a summary graph of data items for the respective event attribute.

28. The one or more computer-readable media of claim 1, wherein causing display of the data summary view includes causing the data summary view to overlay the table format.

29. The one or more computer-readable media of claim 1, wherein causing display of the data summary view includes causing the data summary view to overlay the table format, the method further comprising enabling a user to switch from the data summary view to the table format from within the data summary view and switch from the table format to the data summary view from within the table format.

25. One or more computer-readable media having instructions stored thereon, the instructions, when executed by a processor of a computing device, to cause the computing device to perform the method comprising:

receiving a request to display a data summary view of search results of a search query, the request being received while the search results are displayed in a table format within a search screen, the table format including;

a plurality of rows, each row representing an event of a set of events, the set of events satisfying the search query; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

in response to receiving the request, causing display of the data summary view, the data summary view including a summary report for a selected event attribute of the plurality of event attributes that includes summary entries that present a summary of data items of the selected event attribute and a summary graph of the data items, the summary graph depicting a distribution of at least a subset of the data items of the selected event attribute over a period of time.

30. A system comprising:

one or more processors; and

memory having instructions stored thereon, the instructions, when executed by the one or more processors, to cause the system to perform the method comprising;

receiving a request to display a data summary view of search results of a search query, the request being received while the search results are displayed in a table format within a search screen, the table format including;

a plurality of rows, each row representing an event of a set of events, the set of events satisfying the search query; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

in response to receiving the request, causing display of the data summary view, the data summary view including a summary report for a selected event attribute of the plurality of event attributes that includes summary entries that present a summary of data items of the selected event attribute and a summary graph of the data items, the summary graph depicting a distribution of at least a subset of the data items of the selected event attribute over a period of time.