Real time searching and reporting
First Claim
1. A computer-implemented method, comprising:
- receiving, on a computing device, raw event data;
dividing the raw event data into one or more events, wherein dividing includes analyzing the raw event data and generating one or more rules for establishing boundaries between events;
associating a time stamp with each event;
indexing each event using the time stamps;
storing the indexed events in an event data store;
receiving a search query, wherein the search query is a hybrid search query, and wherein a hybrid search query is evaluated against both events in the data store and raw event data being received in real-time;
generating search results using the search query; and
generating a report using the search results.
1 Assignment
0 Petitions
Accused Products
Abstract
A system arranged to search machine data to generate reports in real time. A search query is provided that includes a plurality of search commands. The search query is parsed to form a main search query and a remote search query. Machine data is collected from remote data sources and evaluated against one of the main and remote search queries to generate a set of search results. The main search query is then evaluated against at least a partial set of the search result to generate at least one report regarding the collected machine data. Initially a search window is pre-populated with historical machine data related to the search query. Over time the historical machine data is replaced with the collected machine data.
-
Citations
24 Claims
-
1. A computer-implemented method, comprising:
-
receiving, on a computing device, raw event data; dividing the raw event data into one or more events, wherein dividing includes analyzing the raw event data and generating one or more rules for establishing boundaries between events; associating a time stamp with each event; indexing each event using the time stamps; storing the indexed events in an event data store; receiving a search query, wherein the search query is a hybrid search query, and wherein a hybrid search query is evaluated against both events in the data store and raw event data being received in real-time; generating search results using the search query; and generating a report using the search results. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A computer-implemented system, comprising:
-
one or more processors; one or more non-transitory computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including; receiving raw event data; dividing the raw event data into one or more events, wherein dividing includes analyzing the raw event data and generating one or more rules for establishing boundaries between events; associating a time stamp with each event; indexing each event using the time stamps; storing the indexed events in an event data store; receiving a search query, wherein the search query is a hybrid search query, and wherein a hybrid search query is evaluated against both events in the data store and raw event data being received in real-time; generating search results using the search query; and generating a report using the search results. - View Dependent Claims (10, 11, 12, 13, 14, 15, 16)
-
-
17. A computer-program product, tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to:
-
receive raw event data; divide the raw event data into one or more events, wherein dividing includes analyzing the raw event data and generating one or more rules for establishing boundaries between events; associate a time stamp with each event; index each event using the time stamps; store the indexed events in an event data store; receive a search query, wherein the search query is a hybrid search query, and wherein a hybrid search query is evaluated against both events in the data store and raw event data being received in real-time; generate search results using the search query; and generate a report using the search results. - View Dependent Claims (18, 19, 20, 21, 22, 23, 24)
-
Specification