Selecting parsing rules based on data analysis
DCFirst Claim
1. A method, comprising:
- selecting a portion of raw data from at least one data source;
analyzing at least the selected portion of raw data to find a match of a signature or pattern of a known data type, the match corresponding to a parsing rule in a plurality of stored parsing rules;
parsing the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule corresponding to the match, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data;
causing display of a preview of at least a portion of the set of searchable, time-stamped events in a graphical user interface; and
in response to user input received via the graphical user interface, processing raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data;
wherein the method is performed by one or more computing devices.
1 Assignment
Litigations
0 Petitions
Accused Products
Abstract
Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.
-
Citations
39 Claims
-
1. A method, comprising:
-
selecting a portion of raw data from at least one data source; analyzing at least the selected portion of raw data to find a match of a signature or pattern of a known data type, the match corresponding to a parsing rule in a plurality of stored parsing rules; parsing the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule corresponding to the match, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data; causing display of a preview of at least a portion of the set of searchable, time-stamped events in a graphical user interface; and in response to user input received via the graphical user interface, processing raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data; wherein the method is performed by one or more computing devices. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. An apparatus, comprising:
-
a subsystem, implemented at least partially in hardware, that selects a portion of raw data from at least one data source; a subsystem, implemented at least partially in hardware, that analyzes at least the selected portion of raw data to find a match of a signature or pattern of a known data type, the match corresponding to a parsing rule in a plurality of stored parsing rules; a parsing subsystem, implemented at least partially in hardware, that parses the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule corresponding to the match, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data; a subsystem, implemented at least partially in hardware, that causes display of a preview of at least a portion of the set of searchable, time-stamped events in a graphical user interface; and a subsystem, implemented at least partially in hardware, that, in response to user input received via the graphical user interface, processes raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:
-
selecting a portion of raw data from at least one data source; analyzing at least the selected portion of raw data to find a match of a signature or pattern of a known data type, the match corresponding to a parsing rule in a plurality of stored parsing rules; parsing the selected portion of raw data into a set of searchable, time-stamped events using the parsing rule corresponding to the match, each searchable, time-stamped event in the set of searchable, time-stamped events including raw data from the selected portion of raw data; causing display of a preview of at least a portion of the set of searchable, time-stamped events in a graphical user interface; and in response to user input received via the graphical user interface, processing raw data from the at least one data source using the parsing rule corresponding to the match, to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data. - View Dependent Claims (14, 15, 16, 17, 18)
-
-
19. A method, comprising:
-
selecting a portion of raw data from at least one data source; parsing the selected portion of raw data into a first set of searchable, time-stamped events using a first parsing rule, each event in the set of searchable events including raw data from the selected portion of raw data; causing display of a preview of at least a portion of the first set of searchable, time-stamped events in a graphical user interface; receiving a first user input via the graphical user interface, the first user input indicating a user preference not to use the first parsing rule in indexing raw data associated with the selected portion of raw data; after receiving the first user input, parsing the selected portion of raw data into a second set of searchable, time-stamped events using a second parsing rule that is different than the first parsing rule, each event in the second set of searchable events including raw data from the selected portion of raw data; causing display of a preview of at least a portion of the second set of searchable, time-stamped events in the graphical user interface; and in response to user input received via the graphical user interface, processing raw data from the at least one data source using the second parsing rule to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data; wherein the method is performed by one or more computing devices. - View Dependent Claims (20, 21, 22, 23, 24, 25)
-
-
26. An apparatus, comprising:
-
a subsystem, implemented at least partially in hardware, that selects a portion of raw data from at least one data source; a parsing subsystem, implemented at least partially in hardware, that parses the selected portion of raw data into a first set of searchable, time-stamped events using a first parsing rule, each event in the set of searchable events including raw data from the selected portion of raw data; a subsystem, implemented at least partially in hardware, that causes display of a preview of at least a portion of the first set of searchable, time-stamped events in a graphical user interface; a subsystem, implemented at least partially in hardware, that receives a first user input via the graphical user interface, the first user input indicating a user preference not to use the first parsing rule in indexing raw data associated with the selected portion of raw data; wherein, after receiving the first user input, the parsing subsystem parses the selected portion of raw data into a second set of searchable, time-stamped events using a second parsing rule that is different than the first parsing rule, each event in the second set of searchable events including raw data from the selected portion of raw data; a subsystem, implemented at least partially in hardware, that causes display of a preview of at least a portion of the second set of searchable, time-stamped events in the graphical user interface; and a subsystem, implemented at least partially in hardware, that in response to user input received via the graphical user interface, processes raw data from the at least one data source using the second parsing rule to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data. - View Dependent Claims (27, 28, 29, 30, 31, 32)
-
-
33. A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:
-
selecting a portion of raw data from at least one data source; parsing the selected portion of raw data into a first set of searchable, time-stamped events using a first parsing rule, each event in the set of searchable events including raw data from the selected portion of raw data; causing display of a preview of at least a portion of the first set of searchable, time-stamped events in a graphical user interface; receiving a first user input via the graphical user interface, the first user input indicating a user preference not to use the first parsing rule in indexing raw data associated with the selected portion of raw data; after receiving the first user input, parsing the selected portion of raw data into a second set of searchable, time-stamped events using a second parsing rule that is different than the first parsing rule, each event in the second set of searchable events including raw data from the selected portion of raw data; causing display of a preview of at least a portion of the second set of searchable, time-stamped events in the graphical user interface; and in response to user input received via the graphical user interface, processing raw data from the at least one data source using the second parsing rule to create searchable, time-stamped events, the processed raw data including at least some data not in the selected portion of raw data. - View Dependent Claims (34, 35, 36, 37, 38, 39)
-
Specification