DATA SUMMARY VIEW WITH FILTERING

• US 20160224676A1
• Filed: 07/31/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Miller, Jesse, Robichaud, Marc V., Burke, Cory, James, Alexander, Robbins, Andrew, Lloyd, Jeffrey Thomas
• Granted Patent: US 10,204,093 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/235 Update request formulation
• CPC Class Codes: G06F 16/2372 Updates performed during offline database operations
• CPC Class Codes: G06F 16/2423 Interactive query statement specification based on a database schema
• CPC Class Codes: G06F 16/24524 Access plan code generation and invalidation; Reuse of access plans
• CPC Class Codes: G06F 16/24544 Join order optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/33 Querying
• CPC Class Codes: G06F 16/3334 Selection or weighting of terms from queries, including natural language queries
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 40/177 of tables; using ruled lines
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]

Abstract

In some embodiments, a method may include display of a data summary view of a set of events that correspond to query results of a query. Each event of the set of events may include data items of a plurality of event attributes. In embodiments, the data summary view can include various summary reports. Each summary report can include summary entries and a summary graph that each present a summary of data items of a selected event attribute, of the plurality of event attributes. At least one summary report can include summary entries that are selectable by a user. The method may further include filtering the set of event, in response to, and based on, selection of one or more of the selectable summary entries by the user and updating of at least the first and second summary graphs to correspond to the filtered set of events.

Claims

1. A computer-implemented method comprising:

causing display of a data summary view of a set of events that correspond to query results of a query, each event of the set of events comprising data items of a plurality of event attributes, the data summary view including;

a first summary report having first summary entries and a first summary graph that each present a summary of data items of a first event attribute of the plurality of event attributes, wherein each of the first summary entries are selectable by a user; and

a second summary report that includes second summary entries and a second summary graph that each present a summary of data items for a second event attribute of the plurality of event attributes; and

in response to selection of one or more of the first summary entries by the user;

filtering the set of events utilizing a filter that is based on the selection of the one or more of the first summary entries; and

causing an update of at least the first and second summary graphs to correspond to the filtered set of events.

2. The computer-implemented method of claim 1, wherein causing the update of at least the first and second summary graphs includes causing an update of the second summary entries to reflect the filtered set of events.

3. The computer-implemented method of claim 1, wherein causing an update of at least the first and second summary graphs further comprises causing the first summary entries to remain static to enable further selection of the first summary entries by the user.

4. The computer-implemented method of claim 1, wherein the first summary graph depicts a distribution of values of the data items for the first summary entries over time and the second summary graph depicts a distribution of values of at least a subset of the data items for the second summary entries over time.

5. The computer-implemented method of claim 1, wherein the first summary graph depicts a distribution of values of the data items for the first summary entries over time and the second summary graph depicts a distribution of values of at least a subset of the data items for the second summary entries over time, and wherein the distribution of values includes one or more of a maximum value, a minimum value, a standard deviation, and an average value.

6. The computer-implemented method of claim 1, wherein the second summary entries are selectable by the user, the method further comprising:

in response to selection of one or more of the second summary entries by the user;

updating the filter based on the selection of the one or more of the second summary entries;

refiltering the set of events utilizing the updated filter; and

causing an update of at least the first and second summary graphs to reflect the refiltered set of events.

7. The computer-implemented method of claim 1, wherein the first graph is interactive to enable selection, by the user, of values of data items of the first event attribute within the first summary graph, the method further comprising:

in response to selection of a value within the first summary graph by the user;

updating the filter based on the selected value;

refiltering the set of events utilizing the updated filter; and

causing an update of at least the first and second summary graphs to reflect the refiltered set of events.

8. The computer-implemented method of claim 1, wherein the first graph is interactive to enable selection, by the user, of ranges of values within the first summary graph, the method further comprising:

in response to selection of a range of values within the first graph by the user;

updating the filter based on the selected range of values;

refiltering the set of events utilizing the updated filter; and

causing an update of at least the first and second summary graphs to reflect the refiltered set of events.

9. The computer-implemented method of claim 1, wherein the first summary entries identify one or more values within the data items of the first event attribute that occur above an upper occurrence threshold.

10. The computer-implemented method of claim 1, wherein the first summary entries identify one or more values within the data items of the first event attribute that occur below a lower occurrence threshold.

11. The computer-implemented method of claim 1, wherein the first summary entries identify one or more values within the data items of the first event attribute that are beyond a threshold of similarity from other values within the data items of the first event attribute.

12. The computer-implemented method of claim 1, wherein the first summary entries include summary statistics.

13. The computer-implemented method of claim 1, wherein the first summary entries include summary statistics based on a data type of the first summary entries, wherein summary statistics for a numeric data type include one or more of:

a maximum value, a minimum value, a mean value, a median value, a mode value, and a standard deviation.

14. The computer-implemented method of claim 1, further comprising enabling the filter to be saved.

15. The computer-implemented method of claim 1, further comprising:

enabling the filter to be saved; and

enabling filtering of a different set of events utilizing the saved filter.

16. The computer-implemented method of claim 1, further comprising:

enabling the filter to be saved as metadata associated with the query; and

enabling filtering of an updated set of events utilizing the metadata.

17. The computer-implemented method of claim 1, wherein causing the update of at least the first and second summary graphs to correspond to the filtered set of events further comprises:

adding one or more commands to a command entry list, the command entry list defining the query.

18. The computer-implemented method of claim 1, wherein causing the update of at least the first and second summary graphs to correspond to the filtered set of events further comprises:

in response to user selection to update the query to correspond to the filter, adding one or more commands to a command entry list, the command entry list defining the query.

19. The computer-implemented method of claim 1, wherein causing display of a data summary view is in response to receiving a request to display the data summary view of the query results, the request being received while the query results are displayed in a table format within a user interface, the table format including:

a plurality of rows, each row representing an event of the set of events; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells.

20. The computer-implemented method of claim 1, wherein causing display of a data summary view is in response to receiving a request to display the data summary view of the query results, the request being received while the query results are displayed in a table format within a user interface, and wherein causing display of the data summary view includes causing the data summary view to overlay the table format, the table format including:

a plurality of rows, each row representing an event of the filtered set of events; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the filtered set of events and including data items of the respective event attribute populating ones of the cells.

21. The computer-implemented method of claim 1, wherein causing display of a data summary view is in response to receiving a request to display the data summary view of the query results, the request being received while the query results are displayed in a table format within a user interface, the table format including:

a plurality of rows, each row representing an event of the set of events; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

wherein causing display of the data summary view includes causing the data summary view to overlay a subset of the plurality of columns such that the subset of columns display the data summary view for the respective columns, and remaining columns display the respective event attributes of each of the remaining columns.

22. The computer-implemented method of claim 1, wherein causing display of a data summary view is in response to receiving a request to display the data summary view of the query results, the request being received while the query results are displayed in a table format within a user interface, the table format including:

a plurality of rows, each row representing an event of the set of events; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

wherein causing display of the data summary view includes causing the data summary view to overlay a subset of the plurality of columns such that the subset of columns display the data summary view for the respective columns, and the remaining columns display the respective event attributes of each of the remaining columns, wherein the plurality of columns are individually selectable by the user and the subset of columns are defined by user selection of individual columns.

23. The computer-implemented method of claim 1, wherein causing display of a data summary view is in response to receiving a request to display the data summary view of the query results, the request being received while the query results are displayed in a table format within a user interface, the table format including:

a plurality of rows, each row representing an event of the set of events; and

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of a plurality of event attributes of the set of events and including data items of the respective event attribute populating ones of the cells; and

wherein causing display of the data summary view includes causing the data summary view to overlay the table format, the method further comprising enabling a user to switch from the data summary view to the table format from within the data summary view and switch from the table format to the data summary view from within the table format.

24. The computer-implemented method of claim 1, wherein filtering the set of events is based on a respective data type of each of the one or more of the first summary entries.

25. The computer-implemented method of claim 1, wherein filtering the set of events is based on a respective data type of each of the one or more of the first summary entries, the respective data type of each of the one or more of the first summary entries being a time data type, a numeric data type, a categorical data type, or a user defined data type.

26. The computer-implemented method of claim 1, further comprising:

in response to selection of the one or more of the first summary entries by the user;

causing display of user selectable filter options for selection by the user, the filter options based on a respective data type of each of the one or more of the first summary entries, wherein the filter is further based on the user selectable filter options that are selected by the user.

27. The computer-implemented method of claim 1, further comprising:

in response to selection of the one or more of the first summary entries by the user;

causing display of user selectable filter options for selection by the user, the filter options based on a respective data type of each of the one or more of the first summary entries, wherein the filter is further based the user selectable filter options that are selected by the user, and wherein the user selectable filter options for a numeric data type are relational operators that include less than, greater than, equal to, not equal to, less than or equal to, and/or greater than or equal to.

28. The computer-implemented method of claim 1, wherein filtering the set of events comprises:

applying a late binding schema to the set of events, the late binding schema associated with one or more extraction rules that are based on the filter.

29. One or more computer-readable media having instructions stored thereon, the instructions to cause a computing device, in response to execution of the instructions by the computing device, to:

display of a data summary view of a set of events that correspond to query results of a query, each event of the set of events comprising data items of a plurality of event attributes, the data summary view including;

a first summary report having first summary entries and a first summary graph that each present a summary of data items of a first event attribute of the plurality of event attributes, wherein each of the first summary entries are selectable by a user; and

a second summary report that includes second summary entries and a second summary graph that each present a summary of data items for a second event attribute of the plurality of event attributes; and

in response to selection of one or more of the first summary entries by the user;

filter the set of events utilizing a filter that is based on the selection of the one or more of the first summary entries; and

update at least the first and second summary graphs to correspond to the filtered set of events.

30. A computing device comprising:

one or more processors, and

one or more computer-readable media coupled with the one or more processors, the one or more computer readable media having instructions stored thereon, the instructions to cause the computing device, in response to execution of the instructions by the one or more processors, to;

display of a data summary view of a set of events that correspond to query results of a query, each event of the set of events comprising data items of a plurality of event attributes, the data summary view including;

a first summary report having first summary entries and a first summary graph that each present a summary of data items of a first event attribute of the plurality of event attributes, wherein each of the first summary entries are selectable by a user; and

a second summary report that includes second summary entries and a second summary graph that each present a summary of data items for a second event attribute of the plurality of event attributes; and

in response to selection of one or more of the first summary entries by the user;

filter the set of events utilizing a filter that is based on the selection of the one or more of the first summary entries; and

update at least the first and second summary graphs to correspond to the filtered set of events.