COLUMN-BASED TABLE MANINPULATION OF EVENT DATA

• US 20160224626A1
• Filed: 01/30/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: ROBICHAUD, MARC VINCENT, BURKE, CORY EUGENE, LLOYD, JEFFREY THOMAS
• Granted Patent: US 9,977,803 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 16/2455 Query execution

Abstract

A search interface is displayed in a table format that includes a plurality of columns, each column including data items of an event attribute, the data items being of a set of events, each column being selectable by a user, and a plurality of rows forming cells with the one or more columns, each cell comprising one or more of the data items of the event attribute of a corresponding column. Based on the user selecting one or more of the columns, a list of options is displayed corresponding to the selected one or more columns, and one or more commands are added to a search query that corresponds to the set of events. The one or more commands are based on at least an option that is selected from the list of options and the event attribute of each of the selected one or more columns.

Claims

1. A computer-implemented method comprising:

executing with a search system on one or more computing devices, the executing comprising;

causing display of a search interface in a table format that includes;

a plurality of columns, each column comprising data items of an event attribute, the data items being of a set of events, each column being selectable by a user; and

a plurality of rows forming cells with the one or more columns, each cell comprising one or more of the data items of the event attribute of a corresponding column;

based on the user selecting one or more of the columns of the plurality of columns in the table format;

causing display of a list of options corresponding to the selected one or more columns; and

causing one or more commands to be added to a search query that corresponds to the set of events, the one or more commands being based on at least an option that is selected from the list of options and the event attribute of each of the selected one or more columns.

2. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that at least one of the cells of at least one of the selected one or more of the columns is an empty cell.

3. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that at least one of the selected one or more of the columns represents data items of a numeric data type.

4. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that at least one of the selected one or more of the columns represents data items of a categorical data type.

5. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that at least one of the selected one or more of the columns represents event raw data of the set of events.

6. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that at least one of the selected one or more of the columns represents data items comprising timestamps.

7. The computer-implemented method of claim 1, wherein the plurality of columns in the table format are individually selectable by the user.

8. The computer-implemented method of claim 1, wherein the selected one or more columns is an individually selected column.

9. The computer-implemented method of claim 1, wherein the selected one or more columns comprises at least a first selected column and a second selected column.

10. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a determination that at least one of the selected one or more of the columns represents data items comprising statistical values generated by one or more statistical functions performed on values of data items of at least some of the set of events.

11. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on detection of at least one field-label value pair in the selected one or more columns.

12. The computer-implemented method of claim 1, further comprising causing the selected option to be generated at least partially based on detection of at least one field-label value pair in the selected one or more columns.

13. The computer-implemented method of claim 1, wherein the data items of the event attribute of at least one of the selected one or more columns comprise values extracted from the set of events using a common extraction rule.

14. The computer-implemented method of claim 1, further comprising causing the selected option to be generated at least partially based on detection of at least one field label-value pair in the selected one or more columns.

15. The computer-implemented method of claim 1, further comprising:

causing a field label of a field-label value pair to be detected in the selected one or more columns; and

causing the field label to be displayed in an option in the displayed list of options.

16. The computer-implemented method of claim 1, comprising receiving one or more command elements of the one or more commands entered into a form by the user, the option being displayed in the list of options as the form.

17. The computer-implemented method of claim 1, wherein one or more command elements of the one or more commands include at least one value of the data items for each of the selected one or more columns.

18. The computer-implemented method of claim 1, further based on the user selecting the one or more of the columns of the plurality of columns in the table format:

causing the event attribute for each of the data items of each of the selected one or more columns to be included as one or more command elements of the one or more commands.

19. The computer-implemented method of claim 1, comprising:

further based on the user selecting the one or more of the columns of the plurality of columns in the table format;

causing the search query comprising the one or more commands to be automatically executed;

causing the set of events to be updated to correspond to the executed search query; and

causing the displayed search interface to be updated to correspond to the updated set of events.

20. The computer-implemented method of claim 1, comprising:

further based on the user selecting the one or more of the columns of the plurality of columns in the table format, further comprising causing a displayed representation of the search query in the user interface to be automatically updated to include a representation of the added one or more commands.

21. The computer-implemented method of claim 1, comprising:

further based on the user selecting the one or more of the columns of the plurality of columns in the table format, causing the search query comprising the added one or more commands to be executed, the executing applying a late binding schema to events, the late binding schema associated with one or more extraction rules defining one or more fields for the set of events.

22. The computer-implemented method of claim 1, wherein the one or more commands are operable by the search system to extract one or more field label-values pairs from at least the data items of each of the selected one or more columns and assign the field label-value pairs to at least one event of the set of events.

23. The computer-implemented method of claim 1, further comprising causing display of the option as a form in the displayed list of options, the form comprising at least one form element operable to enter one or more command elements into the one or more commands;

and

further based on the user selecting the one or more of the columns of the plurality of columns in the table format, causing the form to be automatically reproduced in the search interface, the reproduced form being operable by the user to modify the one or more commands added in the search query.

24. The computer-implemented method of claim 1, comprising:

further based on the user selecting the one or more of the columns of the plurality of columns in the table format, causing a command entry that represents the one or more commands to be automatically added to a displayed list of command entries in the search interface, each of the command entries respectively representing one or more commands of a plurality of commands of the search query, the list of command entries being displayed in a sequence corresponding to the plurality of commands of the search query.

25. The computer-implemented method of claim 1, wherein the one or more commands are of a pipelined search language.

26. The computer-implemented method of claim 1, further comprising causing the plurality of columns of the table format to be reordered in the displayed search interface based on a user interaction with the table format.

27. The computer-implemented method of claim 1, further comprising causing the selected option to be included in the displayed list of options based on a data type assigned to the event attribute of at least one of the one or more of the data items of at least one of the selected one or more cells.

28. A system for searching data, the system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

causing display of a search interface in a table format that includes;

a plurality of columns, each column comprising data items of an event attribute, the data items being of a set of events, each column being selectable by a user; and

a plurality of rows forming cells with the one or more columns, each cell comprising one or more of the data items of the event attribute of a corresponding column;

based on the user selecting one or more of the columns of the plurality of columns in the table format;

causing display of a list of options corresponding to the selected one or more columns; and

causing one or more commands to be added to a search query that corresponds to the set of events, the one or more commands being based on at least an option that is selected from the list of options and the event attribute of each of the selected one or more columns.

29. The system of claim 28, wherein the operations comprise:

further based on the user selecting the one or more of the columns of the plurality of columns in the table format;

causing the search query comprising the one or more commands to be executed;

causing the set of events to be updated to correspond to the executed search query; and

causing the displayed search interface to be updated to correspond to the updated set of events.

30. One or more computer-storage media storing computer-useable instructions that, when executed by a computing device, perform a method, the method comprising:

causing display of a search interface in a table format that includes;

a plurality of columns, each column comprising data items of an event attribute, the data items being of a set of events, each column being selectable by a user; and

a plurality of rows forming cells with the one or more columns, each cell comprising one or more of the data items of the event attribute of a corresponding column;

based on the user selecting one or more of the columns of the plurality of columns in the table format;

causing display of a list of options corresponding to the selected one or more columns; and

causing one or more commands to be added to a search query that corresponds to the set of events, the one or more commands being based on at least an option that is selected from the list of options and the event attribute of each of the selected one or more columns.