Time-based visualization of the number of events having various values for a field

• US 9,437,022 B2
• Filed: 01/27/2014
• Issued: 09/06/2016
• Est. Priority Date: 01/27/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Vander Broek, Philip John
• Primary Examiner(s): Wu, Xiao
• Assistant Examiner(s): Lhymn, Sarah
• Application Number:
  US14/165,232
• Publication Number:
  US 20150213631A1
• Time in Patent Office: 953 Days
• Field of Search: 345/418, 345/440, 345/530, 345/581, 345/589, 345/593, 345/594, 345/595, 345/598, 700/90, 700/95, 700/108, 700/109, 700/110, 700/111, 705/7.11, 705/7.12, 705/7.13, 705/7.14, 705/7.39, 705/7.41, 707/600, 707/601, 707/602, 707/603, 707/604, 707/607, 707/687, 707/688, 707/705, 707/708, 707/713, 707/736, 707/737, 707/738, 707/740, 707/741, 707/742, 707/747, 707/748, 707/749, 707/752, 707/753, 707/754, 707/758, 707/769, 707/790, 707/791, 707/792, 707/793, 707/798, 707/800, 707/801, 707/802, 707/803, 707/804, 707/805
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 3/0486 Drag-and-drop
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data
• CPC Class Codes: G06T 11/001 Texturing; Colouring; Generation of texture or colour inpainting G06T5/77
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs

Abstract

Systems and methods are provided for visualizing the number of events having different values for a field of interest over a selected time range. The events may be derived from machine data obtained from one or more data sources. User input received via a graphical user interface may specify the field of interest, a time range, and a time granularity for displaying counts of the number of events having various values during different time slots within the selected time range. Events including the specified field during the user-selected time range are identified and values for the field are extracted from the identified events. A visualization indicating a relation between a number of the events occurring within each of a plurality of time slots over the selected time range and each of the unique extracted values of the field is provided to the user via the graphical user interface.

Claims

1. A computer-implemented method comprising:

receiving a first user input via a graphical user interface, the input specifying a field and a time range;

identifying a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;

determining a set of unique values for the field from the identified set of events;

for each unique value in the set of unique values, identifying a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;

determining whether the set of unique values can be treated numerically;

in response to determining that the set of unique values can not be treated numerically, causing display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;

in response to determining that the set of unique values can be treated numerically, causing display of a scatter plot visualization.

2. The method of claim 1, wherein the events are derived at least in part from machine data.

3. The method of claim 1, wherein the events are derived at least in part from log files generated by one or more servers.

4. The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade.

5. The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a linear scale.

6. The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a logarithmic scale.

7. The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to an exponential scale.

8. The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a rank assigned to that intersection based on the corresponding number of events.

9. The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection using a scale based on a maximum event count and a minimum event count determined from (i) intersections within a row including the intersection for which the color or shade is being applied, (ii) intersections within a column including the intersection for which the color or shade is being applied, or (iii) all displayed intersections.

10. The method of claim 1, further comprising:

receiving input through a graphical control element that specifies a time granularity; and

determining a duration of time covered by each of the plurality of time slots based on the time granularity.

11. The method of claim 1, further comprising:

receiving user input indicative of a column to be used for sorting the set of rows; and

sorting the set of rows, wherein each row is positioned in ascending or descending order based on the number of events corresponding to the intersection of that row with the column indicated by the user input.

12. The method of claim 1, further comprising

displaying a statistic for each unique value in the set of unique values for the field, wherein the statistic for a given unique value includes a minimum event count corresponding to intersections in the row corresponding to the given unique value, a maximum event count corresponding to intersections in the row corresponding to the given unique value, an average of event counts corresponding to displayed intersections in the row corresponding to the given unique value, a total count of events in multiple displayed intersections in the row corresponding to the given unique value, or a percentage of the set of events that correspond to multiple displayed intersections in the row corresponding to the given unique value.

13. The method of claim 1, further comprising:

displaying for each row a number representing a maximum count of events corresponding to intersections in the row or a number representing a minimum count of events corresponding to intersections in the row;

receiving input indicative of selection of the number; and

highlighting or visually distinguishing the intersection in the row that corresponds to the number.

14. The method of claim 1, further comprising reordering the set of rows based on a drag and drop gesture received from a user input device.

15. The method of claim 1, wherein the extraction rule is a regular expression.

16. The method of claim 1, wherein the extraction rule is applied as a late binding schema.

17. A non-transitory computer readable medium storing instructions that, when executed by a computer, cause the computer to perform functions to:

receiving a first user input via a graphical user interface, the input specifying a field and a time range;

identifying a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;

determining a set of unique values for the field from the identified set of events;

for each unique value in the set of unique values, identifying a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;

determining whether the set of unique values can be treated numerically;

in response to determining that the set of unique values can not be treated numerically, causing display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;

in response to determining that the set of unique values can be treated numerically, causing display of a scatter plot visualization.

18. The non-transitory computer readable medium of claim 17, wherein the events are derived at least in part from machine data.

19. The non-transitory computer readable medium of claim 17, wherein the extraction rule is a regular expression.

20. The non-transitory computer readable medium of claim 17, wherein the extraction rule is applied as a late binding schema.

21. A system comprising:

a memory having processor-readable instructions stored therein; and

a processor configured to access the memory and execute the processor-readable instructions, which when executed by the processor, configures the processor to perform a plurality of functions, including functions to;

receive a first user input via a graphical user interface, the input specifying a field and a time range;

identify a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;

determine a set of unique values for the field from the identified set of events;

for each unique value in the set of unique values, identify a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;

determine whether the set of unique values can be treated numerically;

in response to determining that the set of unique values can not be treated numerically, cause display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;

in response to determining that the set of unique values can be treated numerically, cause display of a scatter plot visualization.

22. The system of claim 21, wherein the events are derived at least in part from machine data.

23. The system of claim 21, wherein the events are derived at least in part from log files generated by one or more servers.

24. The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade.

25. The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a linear scale.

26. The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a logarithmic scale.

27. The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to an exponential scale.

28. The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a rank assigned to that intersection based on the corresponding number of events.

29. The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection using a scale based on a maximum event count and a minimum event count determined from (i) intersections within a row including the intersection for which the color or shade is being applied, (ii) intersections within a column including the intersection for which the color or shade is being applied, or (iii) all displayed intersections.

30. The system of claim 21, wherein the processor is further configured to perform functions to:

receive input through a graphical control element that specifies a time granularity; and

determine a duration of time covered by each of the plurality of time slots based on the time granularity.

31. The system of claim 21, wherein the processor is further configured to perform functions to:

receive user input indicative of a column to be used for sorting the set of rows; and

sort the set of rows, wherein each row is positioned in ascending or descending order based on the number of events corresponding to the intersection of that row with the column indicated by the user input.

32. The system of claim 21, wherein the processor is further configured to perform functions to display a statistic for each unique value in the set of unique values for the field, and wherein the statistic for a given unique value includes a minimum event count corresponding to intersections in the row corresponding to the given unique value, a maximum event count corresponding to intersections in the row corresponding to the given unique value, an average of event counts corresponding to displayed intersections in the row corresponding to the given unique value, a total count of events in multiple displayed intersections in the row corresponding to the given unique value, or a percentage of the set of events that correspond to multiple displayed intersections in the row corresponding to the given unique value.

33. The system of claim 21, wherein the processor is further configured to perform functions to:

display for each row a number representing a maximum count of events corresponding to intersections in the row or a number representing a minimum count of events corresponding to intersections in the row;

receive input indicative of selection of the number; and

highlight or visually distinguish the intersection in the row that corresponds to the number.

34. The system of claim 21, wherein the processor is further configured to perform functions to reorder the set of rows based on a drag and drop gesture received from a user input device.

35. The system of claim 21, wherein the extraction rule is a regular expression.

36. The system of claim 21, wherein the extraction rule is applied as a late binding schema.