INTERACTIVE DEVELOPMENT ENVIRONMENT FOR VISUALIZATION OF QUERIES AND QUERY RESULT INFORMATION

• US 20190332599A1
• Filed: 06/24/2019
• Published: 10/31/2019
• Est. Priority Date: 01/31/2017
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Woo, Eric
• Granted Patent: US 11,314,744 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/248 Presentation of query results

Abstract

Embodiments of the present disclosure are directed to an interactive development environment (IDE) interface that provides historical visualization of queries and query result information iteratively and intuitively. According to an embodiment of the present disclosure, a process is provided to generate visualizations of queries and processed query result information in a single, persistent, integrated display. Each query and resultant search data information is presented iteratively in chronological order, and maintain a persistent, viewable history of a search data exploration session.

Claims

1. A computer-implemented method, comprising:

generating a first query directed toward a data set of raw data, the data set being stored on a data store accessible to one or more computing devices, wherein the data set comprises a plurality of time-stamped events extracted from the raw data, wherein the raw data is machine generated data;

sending the first query to the one or more computing devices, wherein the first query is executed by at least one computing device of the one or more computing devices;

receiving a first set of query result information based on one or more events extracted from the data set in response to executing the first query, and wherein the one or more events extracted from the data set are stored as a corresponding one or more event records in the data store;

displaying a first graphical representation comprising a visualization of the first query and a visualization of the first query result information;

generating a second query directed toward the data set;

sending the second query to the one or more computing devices, wherein the second query is executed by at least one computing device of the one or more computing devices;

receiving a second set of query result information based on one or more events extracted from the data set in response to executing the second query; and

displaying a second graphical representation comprising a visualization of the second query and a visualization of a combination of the first and second query result information.

2. The method of claim 1, wherein the raw data comprises raw data generated by one or more computing devices operating in an information technology (IT) environment.

3. The method of claim 1, wherein the raw data corresponds to activity performed by one or more computing devices operating in an information technology (IT) environment.

4. The method of claim 1, performed in an interactive development environment (IDE) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

5. The method of claim 1, performed in a read-eval-print loop (REPL) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

6. The method of claim 1, performed in a notebook interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

7. The method of claim 1, wherein the first query comprises a dynamic reference to at least one prior query with a value that is subject to change, and further wherein changes to a result of the at least one prior query automatically triggers corresponding changes in the visualization of the first query result information.

8. The method of claim 1, wherein the first set of query result information is generated using a late binding schema and comprises one or more events from the plurality of time-stamped events.

9. The method of claim 1, wherein the first graphical representation comprises a representation of the first query result information presented chronologically in-line and adjacent to a display of the first query used to generate the first query result information.

10. The method of claim 1, wherein the second graphical representation comprises a dynamic reference to at least one of:

the first query; and

the first query result visualization.

11. The method of claim 1, wherein the second graphical representation comprises a dynamic reference to at least one of the first query and the first query result visualization,

further wherein the second graphical representation is automatically updated in response to detecting an update to the at least one of the first query and the first query result visualization.

12. The method of claim 1, further comprising:

receiving user input corresponding to a third query directed toward the data set of raw data;

generating a third query in response to the user input;

sending the third query to the one or more computing devices;

receiving third query result information based on one or more events extracted from the data set that satisfy the third query; and

displaying a third graphical representation comprising a visualization of the third query and a visualization of a combination of the third query result information, the second query result information, and the first query result information,

wherein the third graphical representation is iteratively positioned in a corresponding discrete display region of the display relative to the first and second graphical representations

13. The method of claim 1, wherein the displaying of a first graphical representation comprises generating the visualization according to a first plurality of display parameters.

14. The method of claim 1, wherein the displaying of a first graphical representation comprises:

generating the visualization according to a first set of display parameters;

receiving user input corresponding to a second set of display parameters;

re-formatting the visualization based on the second set of display parameters; and

updating the display with the re-formatted visualization.

15. The method of claim 1, wherein the first query is executed by at least one computing device of the one or more computing devices using a late binding schema.

16. The method of claim 1, wherein the first graphical representation and the second graphical representation are comprised in a plurality of graphical representations of information corresponding to a plurality of queries, further wherein the plurality of graphical representations are rendered in a single integrated display panel.

17. The method of claim 1, wherein the data set comprises a continuously updated data set.

18. A non-transitory computer readable medium having instructions stored thereon which, when executed by a processing device, causes the processing device to implement an interface for iterative exploration of search data, the instructions comprising:

instructions to generate a first query directed toward a data set of raw data, the data set being stored on a data store accessible to one or more computing devices, wherein the data set comprises a plurality of time-stamped events extracted from the raw data, and wherein the raw data is machine generated data;

instructions to send the first query to the one or more computing devices, wherein the first query is executed by at least one computing device of the one or more computing devices;

instructions to receive a first set of query result information based on one or more events extracted from the data set in response to executing the first query, and wherein the one or more events extracted from the data set are stored as a corresponding one or more event records in the data store;

instructions to display a first graphical representation comprising a graphical representation of the first query result information and includes a dynamic reference comprising a visualization of the first query and a visualization of the first query result information;

instructions to generate a second query directed toward the data set;

instructions to send the second query to the one or more computing devices, wherein the second query is executed by at least one computing device of the one or more computing devices;

instructions to receive a second set of query result information based on one or more events extracted from the data set in response to executing the second query; and

instructions to display a second graphical representation comprising a visualization of the second query and a visualization of a combination of the first and second query result information.

19. The computer readable medium of claim 18, wherein the interface comprises an interactive development environment (IDE) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

20. The computer readable medium of claim 18, wherein the interface comprises a read-eval-print loop (REPL) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

21. The computer readable medium of claim 18, wherein the interface comprises a notebook interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

22. The computer readable medium of claim 18, wherein the instructions further comprise:

instructions to receive user input corresponding to a third query directed toward the data set of raw data;

instructions to generate a third query in response to the user input;

instructions to send the third query to the one or more computing devices;

instructions to receive third query result information based on one or more events extracted from the data set in response to executing the third query; and

instructions to display a third graphical representation comprising a visualization of the third query and a visualization of a combination of the third query result information, the second query result information, and the first query result information,

wherein the third graphical representation is iteratively positioned in a corresponding discrete display region of the display relative to the first and second graphical representations.

23. The computer readable medium of claim 18, wherein the second graphical representation comprises a dynamic reference to at least one of:

the first query; and

the first query result visualization.

24. The computer readable medium of claim 18, wherein the second graphical representation comprises a dynamic reference to at least one of the first query and the first query result visualization, and wherein the second graphical representation is automatically updated in response to detecting an update to the at least one of the first query and the first query result visualization.

25. The computer readable medium of claim 18, wherein the first query is executed by at least one computing device of the one or more computing devices using a late binding schema.

26. A computer system comprising:

a storage device having data and instructions stored thereon to implement an interface for iterative exploration of search data; and

a processing unit communicatively coupled to the storage device and configured to execute the instructions to perform a plurality of operations including;

generating a first query directed toward a data set of raw data, the data set being stored on a data store accessible to one or more computing devices, wherein the data set comprises a plurality of time-stamped events extracted from the raw data, and wherein the raw data is machine generated data;

sending the first query to the one or more computing devices, wherein the first query is executed by at least one computing device of the one or more computing devices;

receiving a first set of query result information based on one or more events extracted from the data set in response to executing the first query;

displaying a first graphical representation comprising a visualization of the first query and a visualization of the first query result information;

generating a second query directed toward the data set;

sending the second query to the one or more computing devices, wherein the second query is executed by at least one computing device of the one or more computing devices;

receiving a second set of query result information based on one or more events extracted from the data set in response to executing the second query, and wherein the one or more events extracted from the data set are stored as a corresponding one or more event records in the data store; and

displaying a second graphical representation comprising a visualization of the second query and a visualization of a combination of the first and second query result information

27. The computer system of claim 26, wherein the interface is implemented as an interactive development environment (IDE) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

28. The computer system of claim 26, wherein the interface is implemented as a read-eval-print loop (REPL) interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

29. The computer system of claim 26, wherein the interface is implemented as a notebook interface configured to interactively evaluate search expressions syntactically conforming to a search language corresponding to a search system.

30. The computer system of claim 26, wherein the plurality of operations further include:

receiving user input corresponding to a third query directed toward the data set of raw data;

generating a third query in response to the user input;

sending the third query to the one or more computing devices;

receiving third query result information based on one or more events extracted from the data set in response to executing the third query; and

displaying a third graphical representation comprising a visualization of the third query and a visualization of a combination of the third query result information, the second query result information, and the first query result information,

wherein the third graphical representation is iteratively positioned in a corresponding discrete display region of the display relative to the first and second graphical representations.