SUPPLEMENTAL EVENT ATTRIBUTES IN A TABLE FORMAT

• US 20160224613A1
• Filed: 07/31/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: MILLER, JESSE, ROBICHAUD, MARC V., BURKE, CORY, JAMES, ALEXANDER, LLOYD, JEFFREY THOMAS
• Granted Patent: US 10,204,132 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/235 Update request formulation
• CPC Class Codes: G06F 16/2372 Updates performed during offline database operations
• CPC Class Codes: G06F 16/2423 Interactive query statement specification based on a database schema
• CPC Class Codes: G06F 16/24524 Access plan code generation and invalidation; Reuse of access plans
• CPC Class Codes: G06F 16/24544 Join order optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/33 Querying
• CPC Class Codes: G06F 16/3334 Selection or weighting of terms from queries, including natural language queries
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 40/177 of tables; using ruled lines
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]

Abstract

A method includes displaying events that correspond to search results of a search query, the events comprising data items of event attributes, the events displayed in a table. The table includes columns corresponding to an event attribute, rows corresponding events, cells populated data items, and interactive regions corresponding to at least one data item and selectable to add one or more commands to the search query. A reference event attribute is determined based on an analysis of a data object. A supplemental column corresponding to a supplemental event attribute is added to the table based on the reference event attribute. Supplemental interactive regions are added to the table and correspond to supplemental data items.

Claims

1. A computer-implemented method comprising:

causing display of events that correspond to search results of a search query, the events comprising data items of event attributes, the events displayed in a table comprising;

cells arranged in rows and columns, each column corresponding to an event attribute the event attributes, and each row corresponding to an event of the events, the cells of each column being populated with the data items that correspond to the event attribute of the column; and

interactive regions of the table, each interactive region corresponding to at least one data item of the displayed data items and being selectable by a user to add one or more commands to the search query based on the selected interactive region;

determining a reference event attribute of the event attributes in the displayed table for adding a supplemental event attribute to the event attributes displayed in the table based on an analysis of a data object that defines the supplemental event attribute;

based on the user selecting an option, performing the adding comprising;

causing a supplemental column corresponding to the supplemental event attribute to be added to the displayed table, cells of the supplemental column being populated with supplemental data items, each supplemental data item being mapped to a respective event for the supplemental column using a data item of the reference event attribute of the respective event and being displayed in the row corresponding to the respective event; and

causing supplemental interactive regions to be added to the interactive regions of the displayed table, each supplemental interactive region corresponding to at least one of the supplemental data items and being selectable by the user to add one or more commands to the search query based on the selected supplemental interactive region.

2. The computer-implemented method of claim 1, wherein the performing the adding further comprises causing the search query to be updated to include one or more commands, the updated search query being executable to return search results comprising events having data items of the event attributes and the supplemental event attribute.

3. The computer-implemented method of claim 1, wherein the reference event attribute is of a plurality of reference event attributes identified based on the analysis of the data object, the method further comprising:

causing presentation of the plurality of identified reference event attributes to the user as options for the adding of the supplemental column, where the option selected by the user is included in the options.

4. The computer-implemented method of claim 1, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using a common combination type assigned to the adding.

5. The computer-implemented method of claim 1, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using a join combination type identified for the adding.

6. The computer-implemented method of claim 1, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using a lookup combination type identified for the adding.

7. The computer-implemented method of claim 1, further comprising:

identifying a combination type preconfigured for the data object by another user; and

based on the identifying of the combination type, using the combination type for the adding, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using the combination type identified for the adding.

8. The computer-implemented method of claim 1, wherein each supplemental data item is extracted from data a relational database identified by the data object.

9. The computer-implemented method of claim 1, wherein each supplemental data item is extracted from a lookup table identified by the data object.

10. The computer-implemented method of claim 1, wherein each supplemental data item is extracted from search results of a supplemental search query identified by the data object.

11. The computer-implemented method of claim 1, wherein the adding further comprises executing a supplemental search query associated with the data object and each supplemental data item is extracted from search results of the supplemental search query.

12. The computer-implemented method of claim 1, wherein each supplemental data item of the supplemental event attribute is extracted from at least one data source external to the search query.

13. The computer-implemented method of claim 1, wherein the data object defines a plurality of supplemental event attributes including the supplemental event attribute and an additional supplemental event attribute, and the performing the adding further comprises:

causing an additional supplemental column corresponding to the additional supplemental event attribute to be added to the displayed table, cells of the additional supplemental column being populated with additional supplemental data items, each additional supplemental data item being mapped to a respective event for the additional supplemental column using a data item of the reference event attribute of the respective event and being displayed in the row corresponding to the respective event; and

causing additional supplemental interactive regions to be added to the interactive regions of the displayed table, each additional supplemental interactive region corresponding to at least one of the additional supplemental data items and being selectable by the user to add one or more commands to the search query based on the selected additional supplemental interactive region.

14. The computer-implemented method of claim 1, wherein the data object defines a plurality of supplemental event attributes, the method further comprising:

causing presentation of the plurality of supplemental event attributes to the user based on the determining of the reference event attribute;

receiving, from the user, a selection of a subset of the presented plurality of supplemental event attributes for the adding, the subset including the supplemental event attribute; and

based on the selection of the subset, performing the adding wherein a supplemental column and corresponding supplemental data items is added to the displayed table for each supplemental event attribute in the subset.

15. The computer-implemented method of claim 1, wherein the determining the reference event attribute of the event attributes in the displayed table comprises:

identifying a potential event attribute defined by the data object, the potential event attribute having a plurality of values;

calculating a level of similarity between one or more values of the plurality of values of the potential event attribute and one or more of the data items of a particular event attribute of the event attributes displayed in the table based on an analysis of the one or more values; and

selecting the particular event attribute as the reference event attribute based on the calculated level of similarity;

wherein the potential event attribute is used as the supplemental event attribute.

16. The computer-implemented method of claim 1, wherein the determining the reference event attribute of the event attributes in the displayed table comprises:

identifying a potential event attribute defined by the data object, the potential event attribute having an attribute label;

comparing the attribute label of the potential event attribute to an attribute label of a particular event attribute of the event attributes displayed in the table; and

selecting the particular event attribute as the reference event attribute based on the comparing;

wherein the potential event attribute is used as the supplemental event attribute.

17. The computer-implemented method of claim 1, wherein the search query is executed on event data that includes a plurality of events, each event including a timestamp associated with raw data.

18. The computer-implemented method of claim 1, wherein the search query defines an extraction of values from a plurality of events using a common extraction rule, the reference event attributes comprising the extracted values.

19. The computer-implemented method of claim 1, wherein the search query defines an extraction of values from a plurality of events using a regular expression, the reference event attributes comprising the extracted values.

20. The computer-implemented method of claim 1, wherein the search query applies a late-binding schema to the events.

21. The computer-implemented method of claim 1, wherein the search query is represented in a pipeline query language and the performing the adding further comprises adding one or more pipelined commands to the search query, the updated search query being executable to return search results comprising events having data items of the event attributes and the supplemental event attribute.

22. One or more computer-readable media having instructions stored thereon, the instructions, when executed by a processor of a computing device, to cause the computing device to perform a method comprising:

causing display of events that correspond to search results of a search query, the events comprising data items of event attributes, the events displayed in a table comprising;

cells arranged in rows and columns, each column corresponding to an event attribute the event attributes, and each row corresponding to an event of the events, the cells of each column being populated with the data items that correspond to the event attribute of the column;

interactive regions of the table, each interactive region corresponding to at least one data item of the displayed data items and being selectable by a user to add one or more commands to the search query based on the selected interactive region;

determining a reference event attribute of the event attributes in the displayed table for adding a supplemental event attribute to the event attributes displayed in the table based on an analysis of a data object that defines the supplemental event attribute;

based on the user selecting an option, performing the adding comprising;

causing a supplemental column corresponding to the supplemental event attribute to be added to the displayed table, cells of the supplemental column being populated with supplemental data items, each supplemental data item being mapped to a respective event for the supplemental column using a data item of the reference event attribute of the respective event and being displayed in the row corresponding to the respective event; and

causing supplemental interactive regions to be added to the interactive regions of the displayed table, each supplemental interactive region corresponding to at least one of the supplemental data items and being selectable by the user to add one or more commands to the search query based on the selected supplemental interactive region.

23. The one or more computer-readable media of claim 22, wherein the performing the adding further comprises causing the search query to be updated to include one or more commands, the updated search query being executable to return search results comprising events having data items of the event attributes and the supplemental event attribute.

24. The one or more computer-readable media of claim 22, wherein the reference event attribute if of a plurality of reference event attributes identified based on the analysis of the data object, the method further comprising:

causing presentation of the plurality of identified reference event attributes to the user as options for the adding of the supplemental column, where the option selected by the user is included in the options.

25. The one or more computer-readable media of claim 22, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using a common combination type assigned to the adding.

26. The one or more computer-readable media of claim 22, the method further comprising:

identifying a combination type preconfigured for the data object by another user; and

based on the identifying of the combination type, using the combination type for the adding, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using the combination type identified for the adding.

27. A system comprising:

one or more processors; and

memory having instructions stored thereon, the instructions, when executed by the one or more processors, to cause the system to perform a method comprising;

causing display of events that correspond to search results of a search query, the events comprising data items of event attributes, the events displayed in a table comprising;

cells arranged in rows and columns, each column corresponding to an event attribute the event attributes, and each row corresponding to an event of the events, the cells of each column being populated with the data items that correspond to the event attribute of the column;

interactive regions of the table, each interactive region corresponding to at least one data item of the displayed data items and being selectable by a user to add one or more commands to the search query based on the selected interactive region;

determining a reference event attribute of the event attributes in the displayed table for adding a supplemental event attribute to the event attributes displayed in the table based on an analysis of a data object that defines the supplemental event attribute;

based on the user selecting an option, performing the adding comprising;

causing a supplemental column corresponding to the supplemental event attribute to be added to the displayed table, cells of the supplemental column being populated with supplemental data items, each supplemental data item being mapped to a respective event for the supplemental column using a data item of the reference event attribute of the respective event and being displayed in the row corresponding to the respective event; and

causing supplemental interactive regions to be added to the interactive regions of the displayed table, each supplemental interactive region corresponding to at least one of the supplemental data items and being selectable by the user to add one or more commands to the search query based on the selected supplemental interactive region.

28. The system of claim 27, wherein the performing the adding further comprises causing the search query to be updated to include one or more commands, the updated search query being executable to return search results comprising events having data items of the event attributes and the supplemental event attribute.

29. The system of claim 27, wherein the reference event attribute if of a plurality of reference event attributes identified based on the analysis of the data object, the method further comprising:

causing presentation of the plurality of identified reference event attributes to the user as options for the adding of the supplemental column, where the option selected by the user is included in the options.

30. The system of claim 27, wherein each supplemental data item that is mapped to the respective event for the supplemental column is determined from the data object using a common combination type assigned to the adding.