INTEGRATING QUERY INTERFACES

• US 20160224642A1
• Filed: 07/31/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: ROBICHAUD, MARC V., BURKE, CORY, JAMES, ALEXANDER, LLOYD, JEFFREY THOMAS, MILLER, JESSE
• Granted Patent: US 10,203,842 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/235 Update request formulation
• CPC Class Codes: G06F 16/2372 Updates performed during offline database operations
• CPC Class Codes: G06F 16/2423 Interactive query statement specification based on a database schema
• CPC Class Codes: G06F 16/24524 Access plan code generation and invalidation; Reuse of access plans
• CPC Class Codes: G06F 16/24544 Join order optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/33 Querying
• CPC Class Codes: G06F 16/3334 Selection or weighting of terms from queries, including natural language queries
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 40/177 of tables; using ruled lines
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]

Abstract

A method includes receiving, in a first query interface, a query composed by the user by typing commands into a query box of the first query interface and based on the receiving of the query, causing events corresponding to query results of the query to be displayed in the first query interface with fields corresponding to the events. Based on the selection by the user of an option, a second query interface is displayed with a table that includes events that correspond to query results of a loaded query. The table includes columns corresponding to event attributes, rows corresponding to events. Cells are populated with the data items of event attributes, where one of the columns corresponds to a field of the fields displayed in the first query interface. The table also includes interactive regions selectable by the user to add one or more commands to the loaded query.

Claims

1. A computer-implemented method comprising:

receiving, in a first query interface, a query composed by the user by typing commands into a query box of the first query interface;

based on the receiving of the query, causing events corresponding to query results of the query to be displayed in the first query interface with fields corresponding to the events;

receiving, from the user, a selection of an option to load the query composed in the first query interface into a second query interface;

based on the selection by the user of the option, causing display of the second query interface and display of a table in the second query interface that comprises events that correspond to query results of the loaded query, the events comprising data items of event attributes, the displayed table comprising;

cells arranged in rows and columns, each column corresponding to an event attribute the event attributes, and each row corresponding to an event of the events, the cells of each column being populated with the data items that correspond to the event attribute of the column, wherein the event attribute that corresponds to a designated column of the columns is a field of the fields displayed in the first query interface; and

interactive regions of the table, each interactive region corresponding to at least one data item of the displayed data items and being selectable by the user to add one or more commands to the loaded query based on the selected interactive region.

2. The computer-implemented method of claim 1, further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select a subset of the fields;

wherein the display of the table includes a respective column in the columns of the table for each selected field in the subset of the fields based on the user selecting the subset of the fields, and the event attribute of the respective column is the selected field.

3. The computer-implemented method of claim 1, further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select a subset of the fields; and

causing at least one column to be added to the table such that the table includes a respective column in the columns of the displayed table for each selected field in the subset of the fields based on the user selecting the subset of the fields, the event attribute of the respective column being the selected field.

4. The computer-implemented method of claim 1, further comprising:

based on the selection by the user of the option, causing one or more commands to be automatically added to the query to result in the loaded query, the one or more commands causing at least one of the fields to be removed from the events that correspond to query results of the loaded query.

5. The computer-implemented method of claim 1, wherein the query box is a search bar and the query is a search query.

6. The computer-implemented method of claim 1, wherein the field is defined in the first query interface outside of the query by an extraction rule.

7. The computer-implemented method of claim 1, further comprising:

receiving, in the first query interface, a selection by the user of the field from the fields displayed with the events in the first query interface; and

in response to the selection of the field, causing values of the field to be displayed in association with the events, each value being displayed with a corresponding one of the events;

wherein the designated column is included in the table of the second query interface based on the selection of the field in the first query interface.

8. The computer-implemented method of claim 1, further comprising:

receiving, in the first query interface, a selection by the user of a designated field from the fields displayed with the events in the first query interface; and

in response to the selection of the designated field, causing values of the designated field to be removed from display in association with the events, each value displayed with a corresponding one of the events;

wherein the display of the table in the second query interface is caused to exclude a designated column for the designated field based on the selection by the user of the designated field.

9. The computer-implemented method of claim 1, further comprising:

based on the selection by the user of the option, causing display of a command entry list, at least one command entry in the command entry list representing the query composed in the first query interface.

10. The computer-implemented method of claim 1, wherein the option selected by the user is a button in the first query interface and the selection of the button causes the first query interface to transition to the second query interface.

11. The computer-implemented method of claim 1, further comprising causing an update to the query to include one or more commands based on the selection by the user of one or more of the interactive regions of the table in the second query interface;

causing the updated query to be saved in association with a query object;

receiving a selection of a pipeline entry representing the query object in a selection interface; and

in response to the selection of the pipeline entry, loading the updated query into the first query interface using the query object.

12. The computer-implemented method of claim 1, further comprising causing an update to the query to include one or more commands based on the selection by the user of one or more of the interactive regions of the table in the second query interface;

causing the updated query to be saved in association with a query object; and

loading the updated query into the first query interface using the query object, wherein at least a portion of the updated query is represented in the query box.

13. The computer-implemented method of claim 1, further comprising causing an update to the query to include one or more commands based on the selection by the user of one or more of the interactive regions of the table in the second query interface;

causing the updated query to be saved in association with a query object, the updated query comprising saved commands; and

loading the updated query into the first query interface using the query object, the updated query being loaded as an input query for a designated user, wherein the first query interface allows the user to add one or more commands to the saved commands of the updated query saved in association with the query object, and precludes the designated user from modifying the saved commands of the updated query saved in association with the query object.

14. The computer-implemented method of claim 1, further comprising:

based on the selection by the user of the option, automatically modifying the query such that the loaded query removes one or more of the fields displayed in the first query interface from the query results of the loaded query.

15. The computer-implemented method of claim 1, wherein the query is executed on event data that includes a plurality of events, each event including a timestamp associated with raw data.

16. The computer-implemented method of claim 1, wherein the query defines an extraction of values from a plurality of events using a common extraction rule, the values corresponding to the data items in the cells for at least one of the columns in the table.

17. The computer-implemented method of claim 1, wherein the query defines an extraction of values from a plurality of events using a regular expression, the values corresponding to the data items in the cells for at least one of the columns in the table.

18. The computer-implemented method of claim 1, wherein the loaded query applies a late-binding schema to the events that correspond to the query results of the loaded query.

19. The computer-implemented method of claim 1, wherein the loaded query is represented in a pipelined query language and each interactive region is selectable by the user to add one or more pipelined commands to the loaded query based on the selected interactive region.

20. The computer-implemented method of claim 1, further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select the fields;

wherein the display of the table includes a respective column in the columns of the table for each selected field in the fields based on the user selecting the fields, and the event attribute of the respective column is the selected field.

21. The computer-implemented method of claim 1, wherein based on the selection by the user of the option, the display of the table includes a respective column in the columns of the table for each field in the fields, and the event attribute of the respective column is the selected field.

22. One or more computer-readable media having instructions stored thereon, the instructions, when executed by a processor of a computing device, to cause the computing device to perform a method comprising:

receiving, in a first query interface, a query composed by the user by typing commands into a query box of the first query interface;

based on the receiving of the query, causing events corresponding to query results of the query to be displayed in the first query interface with fields corresponding to the events;

receiving, from the user, a selection of an option to load the query composed in the first query interface into a second query interface;

based on the selection by the user of the option, causing display of the second interface and display of a table in the second interface that comprises events that correspond to query results of the loaded query, the events comprising data items of event attributes, the displayed table comprising;

cells arranged in rows and columns, each column corresponding to an event attribute the event attributes, and each row corresponding to an event of the events, the cells of each column being populated with the data items that correspond to the event attribute of the column, wherein the event attribute that corresponds to a designated column of the columns is a field of the fields displayed in the first query interface;

interactive regions of the table, each interactive region corresponding to at least one data item of the displayed data items and being selectable by the user to add one or more commands to the loaded query based on the selected interactive region.

23. The one or more computer-readable media of claim 22, the method further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select a subset of the fields;

wherein the display of the table includes a respective column in the columns of the table for each selected field in the subset of the fields based on the user selecting the subset of the fields, and the event attribute of the respective column is the selected field.

24. The one or more computer-readable media of claim 22, the method further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select a subset of the fields; and

causing at least one column to be added to the table such that the table includes a respective column in the columns of the displayed table for each selected field in the subset of the fields based on the user selecting the subset of the fields, the event attribute of the respective column being the selected field.

25. The one or more computer-readable media of claim 22, the method further comprising:

based on the selection by the user of the option, causing one or more commands to be automatically added to the query to result in the loaded query, the one or more commands causing at least one of the fields to be removed from the events that correspond to query results of the loaded query.

26. The one or more computer-readable media of claim 22, wherein the field is defined in the first query interface outside of the query by an extraction rule.

27. A system comprising:

one or more processors; and

memory having instructions stored thereon, the instructions, when executed by the one or more processors, to cause the system to perform a method comprising;

receiving, in a first query interface, a query composed by the user by typing commands into a query box of the first query interface;

based on the receiving of the query, causing events corresponding to query results of the query to be displayed in the first query interface with fields corresponding to the events;

receiving, from the user, a selection of an option to load the query composed in the first query interface into a second query interface;

based on the selection by the user of the option, causing display of the second interface and display of a table in the second interface that comprises events that correspond to query results of the loaded query, the events comprising data items of event attributes, the displayed table comprising;

cells arranged in rows and columns, each column corresponding to an event attribute the event attributes, and each row corresponding to an event of the events, the cells of each column being populated with the data items that correspond to the event attribute of the column, wherein the event attribute that corresponds to a designated column of the columns is a field of the fields displayed in the first query interface;

interactive regions of the table, each interactive region corresponding to at least one data item of the displayed data items and being selectable by the user to add one or more commands to the loaded query based on the selected interactive region.

28. The system of claim 27, the method further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select a subset of the fields;

wherein the display of the table includes a respective column in the columns of the table for each selected field in the subset of the fields based on the user selecting the subset of the fields, and the event attribute of the respective column is the selected field.

29. The system of claim 27, the method further comprising:

based on the selection by the user of the option, causing display of one or more form elements, each form element corresponding to at least one of the fields, the form elements allowing the user to select a subset of the fields; and

causing at least one column to be added to the table such that the table includes a respective column in the columns of the displayed table for each selected field in the subset of the fields based on the user selecting the subset of the fields, the event attribute of the respective column being the selected field.

30. The system of claim 27, the method further comprising:

based on the selection by the user of the option, causing one or more commands to be automatically added to the query to result in the loaded query, the one or more commands causing at least one of the fields to be removed from the events that correspond to query results of the loaded query.