INTERACTIVE DEVELOPMENT ENVIRONMENT FOR ITERATIVE QUERY VISUALIZATION AND EXPLORATION

• US 20180218046A1
• Filed: 01/31/2017
• Published: 08/02/2018
• Est. Priority Date: 01/31/2017
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Woo, Eric
• Granted Patent: US 10,387,423 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/248 Presentation of query results

Abstract

Embodiments of the present disclosure are directed to an interactive development environment (IDE) interface that provides historical visualization of queries and query result information iteratively and intuitively. According to an embodiment of the present disclosure, a process is provided to generate visualizations of queries and processed query result information in a single, persistent, integrated display. Each query and resultant search data information is presented iteratively in chronological order, thereby maintain a persistent, viewable history of a search data exploration session.

Claims

1. A computer-implemented method, comprising:

generating a first query directed toward a data set of raw data, the data set being stored on a data store accessible to one or more computing devices;

sending the first query to the one or more computing devices, wherein the first query is executed by at least one computing device of the one or more computing devices;

receiving a first set of query result information based on one or more events extracted from the data set that satisfy the first query;

causing display of a first graphical representation comprising a visualization of the first query and a visualization of the first query result information;

generating a second query directed toward the data set;

sending the second query to the one or more computing devices, wherein the second query is executed by at least one computing device of the one or more computing devices;

receiving a second set of query result information based on one or more events extracted from the data set that satisfy the second query; and

causing display of a second graphical representation comprising a visualization of the second query and a visualization of a combination of the first and second query result information.

2. The method of claim 1, wherein the raw data comprises raw data generated by one or more computing devices operating in an information technology (IT) environment.

3. The method of claim 1, wherein the raw data corresponds to activity performed by one or more computing devices operating in an information technology (IT) environment.

4. The method of claim 1, performed in an interactive development environment (IDE) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

5. The method of claim 1, performed in a read-eval-print loop (REPL) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

6. The method of claim 1, performed in a notebook interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

7. The method of claim 1, wherein the data set comprises a plurality of time-stamped events extracted from the raw data,

further wherein the raw data is machine generated data.

8. The method of claim 1, wherein the data set comprises a plurality of time-stamped events extracted from the raw data,

further wherein, the first set of query result information is generated using a late binding schema and comprises one or more events from the plurality of time-stamped events.

9. The method of claim 1, wherein the one or more events extracted from the data set are stored as a corresponding one or more event records in the data store.

10. The method of claim 1, wherein the second graphical representation comprises a dynamic reference to at least one of:

the first query; and

the first query result visualization.

11. The method of claim 1, wherein the second graphical representation comprises a dynamic reference to at least one of the first query and the first query result visualization,

further wherein the second graphical representation is automatically updated in response to detecting an update to the at least one of the first query and the first query result visualization.

12. The method of claim 1, further comprising:

receiving user input corresponding to a third query directed toward the data set of raw data;

generating a third query in response to the user input;

sending the third query to the one or more computing devices;

receiving third query result information based on one or more events extracted from the data set that satisfy the third query; and

causing display of a third graphical representation comprising a visualization of the third query and a visualization of a combination of the third query result information, the second query result information, and the first query result information,

wherein the third graphical representation is iteratively positioned in a corresponding discrete display region of the display relative to the first and second graphical representations

13. The method of claim 1, wherein the causing display of a first graphical representation comprises generating the visualization according to a first plurality of display parameters.

14. The method of claim 1, wherein the causing display of a first graphical representation comprises:

generating the visualization according to a first set of display parameters;

receiving user input corresponding to a second set of display parameters;

re-formatting the visualization based on the second set of display parameters; and

updating the display with the re-formatted visualization.

15. The method of claim 1, wherein the first query is executed by at least one computing device of the one or more computing devices using a late binding schema.

16. The method of claim 1, wherein the first graphical representation and the second graphical representation are comprised in a plurality of graphical representations of information corresponding to a plurality of queries, further wherein the plurality of graphical representations are rendered in a single integrated display panel.

17. The method of claim 1, wherein the data set comprises a continuously updated data set.

18. A non-transitory computer readable medium having instructions stored thereon which, when executed by a processing device, causes the processing device to implement an interface for iterative exploration of search data, the instructions comprising:

instructions to generate a first query directed toward a data set of raw data, the data set being stored on a data store accessible to one or more computing devices;

instructions to send the first query to the one or more computing devices, wherein the first query is executed by at least one computing device of the one or more computing devices;

instructions to receive a first set of query result information based on one or more events extracted from the data set that satisfy the first query;

instructions to cause display of a first graphical representation comprising a graphical representation of the first query result information and includes a dynamic reference comprising a visualization of the first query and a visualization of the first query result information;

instructions to generate a second query directed toward the data set;

instructions to send the second query to the one or more computing devices, wherein the second query is executed by at least one computing device of the one or more computing devices;

instructions to receive a second set of query result information based on one or more events extracted from the data set that satisfy the second query; and

instructions to cause display of display of a second graphical representation comprising a visualization of the second query and a visualization of a combination of the first and second query result information.

19. The computer readable medium of claim 18, wherein the interface comprises an interactive development environment (IDE) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

20. The computer readable medium of claim 18, wherein the interface comprises a read-eval-print loop (REPL) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

21. The computer readable medium of claim 18, wherein the interface comprises a notebook interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

22. The computer readable medium of claim 18, wherein the instructions further comprise:

instructions to receive user input corresponding to a third query directed toward the data set of raw data;

instructions to generate a third query in response to the user input;

instructions to send the third query to the one or more computing devices;

instructions to receive third query result information based on one or more events extracted from the data set that satisfy the third query; and

instructions to cause display of a third graphical representation comprising a visualization of the third query and a visualization of a combination of the third query result information, the second query result information, and the first query result information,

wherein the third graphical representation is iteratively positioned in a corresponding discrete display region of the display relative to the first and second graphical representations.

23. The computer readable medium of claim 18, wherein the second graphical representation comprises a dynamic reference to at least one of:

the first query; and

the first query result visualization.

24. The computer readable medium of claim 18, wherein the second graphical representation comprises a dynamic reference to at least one of the first query and the first query result visualization,

further wherein the second graphical representation is automatically updated in response to detecting an update to the at least one of the first query and the first query result visualization.

25. The computer readable medium of claim 18, wherein the first query is executed by at least one computing device of the one or more computing devices using a late binding schema.

26. A computer system comprising:

a storage device having data and instructions stored thereon to implement an interface for iterative exploration of search data; and

a processing unit communicatively coupled to the storage device and configured to execute the instructions to perform a plurality of operations including;

generating a first query directed toward a data set of raw data, the data set being stored on a data store accessible to one or more computing devices;

sending the first query to the one or more computing devices, wherein the first query is executed by at least one computing device of the one or more computing devices;

receiving a first set of query result information based on one or more events extracted from the data set that satisfy the first query;

causing display of a first graphical representation comprising a visualization of the first query and a visualization of the first query result information;

generating a second query directed toward the data set;

sending the second query to the one or more computing devices, wherein the second query is executed by at least one computing device of the one or more computing devices;

receiving a second set of query result information based on one or more events extracted from the data set that satisfy the second query; and

causing display of a second graphical representation comprising a visualization of the second query and a visualization of a combination of the first and second query result information

27. The computer system of claim 26, wherein the interface is implemented as an interactive development environment (IDE) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

28. The computer system of claim 26, wherein the interface is implemented as a read-eval-print loop (REPL) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

29. The computer system of claim 26, wherein the interface is implemented as a notebook interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

30. The computer system of claim 26, wherein the plurality of operations further include:

receiving user input corresponding to a third query directed toward the data set of raw data;

generating a third query in response to the user input;

sending the third query to the one or more computing devices;

receiving third query result information based on one or more events extracted from the data set that satisfy the third query; and

causing display of a third graphical representation comprising a visualization of the third query and a visualization of a combination of the third query result information, the second query result information, and the first query result information,

wherein the third graphical representation is iteratively positioned in a corresponding discrete display region of the display relative to the first and second graphical representations.