INTERFACE TEMPLATES FOR QUERY COMMANDS

• US 20160225271A1
• Filed: 07/31/2015
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: ROBICHAUD, Marc V., MILLER, Jesse, BURKE, Cory, JAMES, Alexander, LLOYD, Jeffrey Thomas
• Granted Patent: US 9,836,501 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/235 Update request formulation
• CPC Class Codes: G06F 16/2372 Updates performed during offline database operations
• CPC Class Codes: G06F 16/2423 Interactive query statement specification based on a database schema
• CPC Class Codes: G06F 16/24524 Access plan code generation and invalidation; Reuse of access plans
• CPC Class Codes: G06F 16/24544 Join order optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/33 Querying
• CPC Class Codes: G06F 16/3334 Selection or weighting of terms from queries, including natural language queries
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 40/177 of tables; using ruled lines
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]

Abstract

A method includes causing display of events that correspond to search results of a search query in a table. The table includes rows representing events comprising data items of event attributes, columns forming cells with the row, the columns representing respective event attributes, and interactive regions corresponding to one or more data items of the displayed data items. The method also includes in response to the user selecting a designated interactive region, causing display of a list of options, each displayed option corresponding to an interface template for composing query commands, and based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

Claims

1. A computer-implemented method for composing queries in a query interface, the method comprising:

causing display of events that correspond to search results of a search query in a table, the table comprising;

a plurality of rows, each row representing an event of the events, the events comprising data items of event attributes;

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of the event attributes, the cells of the column displaying the data items of the respective event attribute; and

interactive regions of the table, each interactive region corresponding to one or more data items of the displayed data items and being selectable by a user to cause display of a list of options corresponding to the selected interactive region;

in response to the user selecting a designated interactive region of the interactive regions of the table, causing display of the list of options corresponding to the designated interactive region, each displayed option corresponding to an interface template for composing query commands; and

based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

2. The computer-implemented method of claim 1, wherein the one or more commands are composed based on input from the user into the one or more form elements of a form, the instructions of the interface template mapping the one or more form elements to one or more portions of the one or more commands.

3. The computer-implemented method of claim 1, further comprising:

based on the user selecting an option in the displayed list of options, causing display of a graphical user interface defined by the instructions of the interface template; and

composing the one or more commands from user input to the graphical user interface.

4. The computer-implemented method of claim 1, further comprising:

receiving a request from the user to modify the one or more commands added to the search query;

in response to the request, causing a form to be presented comprising one or more form elements defined by the instructions of the interface template; and

modifying the one or more commands in the search query based on input from the user to the one or more form elements, the instructions of the interface template mapping input to one or more portions of the one or more commands.

5. The computer-implemented method of claim 1, wherein the instructions of the interface template comprise:

extracting values of the one or more data items that corresponds to the designated interactive region;

determining a number of form elements to display to the user based on the extracted values;

causing display of each of the form elements to the user based on the user selecting an option in the displayed list of options; and

composing the one or more commands based on input from the user into one or more of the form elements.

6. The computer-implemented method of claim 1, wherein the one or more commands are composed and added to the search query based on input from the user into the one or more form elements defined by the instructions of the interface template, and the method further comprises:

adding one or more subsequent commands to the search query;

receiving a selection, by the user of a command entry representing the one or more commands of the search query; and

based on the selection, causing presentation of at least one of the one or more form elements to the user for modifying the one or more commands added to the search query, the at least one of the one or more form elements comprising the input from the user.

7. The computer-implemented method of claim 1, wherein the one or more commands are composed and added to the search query using a form defined by the instructions of the interface template, and the method further comprises:

adding one or more subsequent commands to the search query;

receiving a selection, by the user of a command entry representing the one or more commands of the search query; and

based on the selection, causing presentation of the form to the user for modifying the one or more commands added to the search query.

8. The computer-implemented method of claim 1, wherein the causing one or more commands to be added to the search query automatically causes the displayed events in the table to be updated to correspond to the search query comprising the one or more commands.

9. The computer-implemented method of claim 1, further comprising:

receiving a selection, by the user of a command entry representing one or more previously added commands of the search query; and

based on the selection, causing a displayed form defined by the instructions of the interface template for composing the one or more commands to be replaced with a form defined by instructions of another interface template for composing the one or more previously added commands.

10. The computer-implemented method of claim 1, further comprising:

receiving a selection, by the user of a command entry representing one or more previously added commands of the search query; and

based on the selection, causing one or more form elements defined by the instructions of the interface template for composing the one or more commands to be replaced in an interface panel with one or more form elements defined by instructions of another interface template for composing the one or more previously added commands.

11. The computer-implemented method of claim 1, further comprising:

causing display of an interface panel to the user, the interface panel being configured to display form elements for composing commands of the search query;

in response to a request from the user to hide the interface panel, hiding the displayed interface panel including the form elements; and

based on the user selecting the option in the displayed list of options, causing the hidden interface panel to be automatically unhidden, and causing the unhidden interface panel to include form elements defined by the instructions for composing the one or more commands.

12. The computer-implemented method of claim 1, wherein the instructions define that each command composed using the interface template identifies the one or more data items that corresponds to the designated interactive region in the command.

13. The computer-implemented method of claim 1, wherein the instructions define that each command composed using the interface template is composed by determining an identifier of an event attribute of the one or more data items that corresponds to the designated interactive region, and including the identifier in the command.

14. The computer-implemented method of claim 1, wherein the instructions specify a command identifier to include in each command composed using the interface template.

15. The computer-implemented method of claim 1, wherein the search query is executed on event data that includes a plurality of events, each event including a timestamp associated with raw data.

16. The computer implemented method of claim 1, further comprising executing the search query, wherein the executing returns the search results comprising a plurality of events, the executing performing an extraction of values from the plurality of events using a common extraction rule, the extraction defined by the second query.

17. The computer implemented method of claim 1, further comprising executing the search query, wherein the executing returns the search results comprising a plurality of events, the executing performing an extraction of values from the plurality of events using a regular expression, the extraction defined by the second query.

18. The computer implemented method of claim 1, further comprising executing the search query, wherein the executing returns query results comprising a plurality of events, the executing applying a late-binding schema to the plurality of events.

19. The computer implemented method of claim 1, wherein the search query represented in a pipeline query language and the one or more commands are written in the pipelined query language.

20. The computer-implemented method of claim 1, further comprising:

executing the search query comprising the one or more commands added to the search query; and

causing the displayed events in the table to be updated to correspond to the search query comprising the one or more commands.

21. The computer-implemented method of claim 1, further comprising:

receiving a request to modify the one or more commands added to the search query;

based on the request, modifying the one or more commands according to instructions of the interface template of the selected option;

executing the search query comprising the modified one or more commands; and

causing the displayed events in the table to be updated to correspond to the search query comprising the modified one or more commands.

22. One or more computer-readable media having instructions stored thereon, the instructions, when executed by a processor of a computing device, to cause the computing device to perform a method comprising:

causing display of events that correspond to search results of a search query in a table, the table comprising;

a plurality of rows, each row representing an event of the events, the events comprising data items of event attributes;

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of the event attributes, the cells of the column displaying the data items of the respective event attribute; and

interactive regions of the table, each interactive region corresponding to one or more data items of the displayed data items and being selectable by a user to cause display of a list of options corresponding to the selected interactive region;

in response to the user selecting the designated interactive region in the table, causing display of the list of options corresponding to a designated interactive region of the interactive regions, each displayed option corresponding to an interface template for composing query commands; and

based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

23. The one or more computer-readable media of claim 22, wherein the one or more commands are composed based on input from the user into the one or more form elements of a form, the instructions of the interface template mapping the one or more form elements to one or more portions of the one or more commands.

24. The one or more computer-readable media of claim 22, the method further comprising:

based on the user selecting an option in the displayed list of options, causing display of a graphical user interface defined by the instructions of the interface template; and

composing the one or more commands from user input to the graphical user interface.

25. The one or more computer-readable media of claim 22, the method further comprising:

receiving a request from the user to modify the one or more commands added to the search query;

in response to the request, causing a form to be presented comprising one or more form elements defined by the instructions of the interface template; and

modifying the one or more commands in the search query based on input from the user to the one or more form elements, the instructions of the interface template mapping input to one or more portions of the one or more commands.

26. The one or more computer-readable media of claim 22, wherein the instructions of the interface template comprise:

extracting values of the one or more data items that corresponds to the designated interactive region;

determining a number of form elements to display to the user based on the extracted values;

causing display of each of the form elements to the user based on the user selecting an option in the displayed list of options; and

composing the one or more commands based on input from the user into one or more of the form elements.

27. A system comprising:

one or more processors; and

memory having instructions stored thereon, the instructions, when executed by the one or more processors, to cause the system to perform a method comprising;

causing display of events that correspond to search results of a search query in a table, the table comprising;

a plurality of rows, each row representing an event of the events, the events comprising data items of event attributes;

a plurality of columns forming cells with the plurality of rows, each column representing a respective event attribute of the event attributes, the cells of the column displaying the data items of the respective event attribute; and

interactive regions of the table, each interactive region corresponding to one or more data items of the displayed data items and being selectable by a user to cause display of a list of options corresponding to the selected interactive region;

in response to the user selecting the designated interactive region in the table, causing display of the list of options corresponding to a designated interactive region of the interactive regions, each displayed option corresponding to an interface template for composing query commands; and

based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

28. The system of claim 27, wherein the one or more commands are composed based on input from the user into the one or more form elements of a form, the instructions of the interface template mapping the one or more form elements to one or more portions of the one or more commands.

29. The system of claim 27, the method further comprising:

based on the user selecting an option in the displayed list of options, causing display of a graphical user interface defined by the instructions of the interface template; and

composing the one or more commands from user input to the graphical user interface.

30. The system of claim 27, the method further comprising:

receiving a request from the user to modify the one or more commands added to the search query;

in response to the request, causing a form to be presented comprising one or more form elements defined by the instructions of the interface template; and

modifying the one or more commands in the search query based on input from the user to the one or more form elements, the instructions of the interface template mapping input to one or more portions of the one or more commands.