Events sets in a visually distinct display format

• US 9,922,084 B2
• Filed: 01/30/2015
• Issued: 03/20/2018
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Robichaud, Marc Vincent
• Primary Examiner(s): Bullock, Joshua
• Application Number:
  US14/610,710
• Publication Number:
  US 20160224625A1
• Time in Patent Office: 1,145 Days
• Field of Search: 707715
• CPC Class Codes: G06F 16/2379 Updates performed during online database operations; commit processing
• CPC Class Codes: G06F 16/24534 Query rewriting; Transformation
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/313 Selection or weighting of terms for indexing
• CPC Class Codes: G06F 16/322 Trees
• CPC Class Codes: G06F 16/338 Presentation of query results
• CPC Class Codes: G06F 16/447 Temporal browsing, e.g. timeline
• CPC Class Codes: G06F 16/9537 Spatial or temporal dependent retrieval, e.g. spatiotemporal queries

Abstract

A request is received to display at least a portion of a first events set and at least a portion of a second events set in an interleaved and visually distinct display format, where, in the interleaved and visually distinct display format, the at least a portion of the first events set is displayed in a visually distinct manner from the at least a portion of the second events set, and data from the at least a portion of the first events set is interleaved with data from the at least a portion of the second events set. In response to receiving the request, display is caused, on a user interface, of the at least a portion of the first events set and the at least a portion of the second events set in the interleaved and visually distinct display format.

Claims

1. A computer-implemented method, comprising:

receiving a request to display a first time-stamped events set and of a second time-stamped events set in a display format, wherein, in the display format, each of a first group of data portions from the first time-stamped events set is displayed in a first presentation format that is visually distinct from a second presentation format used to display each of a second group of data portions from the second time-stamped events set, further wherein, in the display format, the first group of data portions are interleaved with the second group of data portions using at least an event attribute associated with the first group of data portions and the second group of data portions; and

in response to receiving the request, causing display, on a user interface, of the first time-stamped events set and the second time-stamped events set in the display format;

wherein a first source for the first time-stamped events set represents a first participant associated with the first presentation format in the display format, and further wherein a second source for the second time-stamped events set represents a second participant associated with the second presentation format in the display format, further wherein the first time-stamped events set and the second time-stamped events set are determined by executing at least one search query.

2. The computer-implemented method of claim 1, wherein the first presentation format displays the data portions from first time-stamped events set in a first color, the second presentation format displays the data portions from second time-stamped events set in a second color, and the second color is different from the first color.

3. The computer-implemented method of claim 1, wherein the first presentation format displays the data portions from first time-stamped events set in a left aligned format, the second presentation format displays the data portions from second time-stamped events set in a right aligned format.

4. The computer-implemented method of claim 1, wherein each data portion from the first time-stamped events set, and each data portion from the second time-stamped events set represent a respective event.

5. The computer-implemented method of claim 1, wherein the first time-stamped events set represents data from a first system, and wherein the second time-stamped events set represents data from a second system.

6. The computer-implemented method of claim 1, wherein the first time-stamped events set represents raw log data from a first system, and wherein the second time-stamped events set represents raw log data from a second system.

7. The computer-implemented method of claim 1, wherein the first time-stamped events set comprises a first subset of a time-stamped events set, wherein the second time-stamped events set comprises a second subset of the time-stamped events set, wherein each time-stamped event of the first time-stamped events set has a first field value for a particular field, wherein each time-stamped event of the second time-stamped events set has a second field value for the particular field, and wherein the first field value is different from the second field value.

8. The computer-implemented method of claim 1, wherein the first time-stamped events set comprises a first subset of a time-stamped events set, wherein the second time-stamped events set comprises a second subset of the time-stamped events set, wherein each time-stamped event of the first time-stamped events set has a first field value for a particular field, wherein each time-stamped event of the second time-stamped events set has a second field value for the particular field, wherein the first field value is different from the second field value, and wherein the particular field is a host field, a source field, a source type field, a timestamp field, or any other field.

9. The computer-implemented method of claim 1, wherein data portions from the first time-stamped events set are interleaved with the data portions from the second time-stamped events set using timestamps of corresponding events from the first time-stamped events set and timestamps of corresponding events from the second time-stamped events set, wherein data portions are presented in chronological order based on the timestamps.

10. The computer-implemented method of claim 1, wherein the first time-stamped events set represents a result of a first search query applying a late-binding schema to source data, and wherein the second time-stamped events set represents a result of a second search query applying the late-binding schema to the source data.

11. The computer-implemented method of claim 1, wherein the first time-stamped events set represents output of a first data processing pipeline, and wherein the second time-stamped events set represents output of a second data processing pipeline.

12. The computer-implemented method of claim 1, wherein the first time-stamped events set represents a column of data from a first data table, and wherein the second time-stamped events set represents a column of data from a second data table or another column of data from the first data table.

13. The computer-implemented method of claim 1, comprising:

receiving a first request to represent the first time-stamped events set as a first tab on the user interface; and

receiving a second request to represent the second time-stamped events set as a second tab on the user interface;

wherein the request is to join data represented by the first and second tabs in the display format.

14. The computer-implemented method of claim 1, wherein:

the request is further to display data portions from a third time-stamped events set in the display format in a third presentation format that is visually distinct from the first and second presentation formats; and

the causing display, on the user interface, is further of the third time-stamped events set in the display format;

further wherein a third source for the third time-stamped events set represents a third participant associated with the third presentation format in the display format.

15. The computer-implemented method of claim 1, wherein the first time-stamped events set represents raw log data from a first system, and wherein each time-stamped event of the second time-stamped events set has a first field value for a particular field.

16. The computer-implemented method of claim 1, wherein the data portions from the first time-stamped events set changes based upon time, and wherein the data portions from the second time-stamped events set changes based upon time.

17. The computer-implemented method of claim 1, wherein the first presentation format of data portions from the first time-stamped events set changes based upon time, and wherein the second presentation format of the data portions from the second time-stamped events set changes based upon time.

18. The computer-implemented method of claim 1, wherein the first source of the first time-stamped events set changes based upon a first event threshold value, and wherein the second sources of the second time-stamped events set changes based upon a second event threshold value.

19. The computer-implemented method of claim 1, wherein the first presentation format of the first time-stamped events set changes based upon a first event threshold value, and wherein the second presentation format of the second time-stamped events set changes based upon a second event threshold value.

20. The computer-implemented method of claim 1, wherein the event attribute is a metadata field of the first time-stamped events set and the-second time-stamped events set.

21. The computer-implemented method of claim 1, wherein the data portions from the first time-stamped events set and the second time-stamped events set comprise statistics, aggregates, or calculations based on an event or a value in the event.

22. The computer-implemented method of claim 1, wherein the data portions each comprise a portion of raw machine data of a respective event.

23. The computer-implemented method of claim 1, wherein the first time-stamped events set comprises a first subset of a time-stamped events set, wherein the second time-stamped events set comprises a second subset of the time-stamped events set, wherein each time-stamped event of the first time-stamped events set has a first metadata field value for a particular metadata field, wherein each time-stamped event of the second time-stamped events set has a second metadata field value for the particular field metadata field, and wherein the first metadata field value is different from the second metadata field value.

24. The computer-implemented method of claim 1, wherein the first time-stamped events set comprises a first subset of a time-stamped events set, wherein the second time-stamped events set comprises a second subset of the time-stamped events set, wherein each time-stamped event of the first time-stamped events set has a first field value for a particular field, wherein each time-stamped event of the second time-stamped events set has a second field value for the particular field, wherein the particular field is defined by one or more extraction rules, and wherein the first field value is different from the second field value.

25. A system for searching data, the system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

receiving a request to display a first time-stamped events set and a second time-stamped events set in a display format, wherein, in the display format, each of a first group of data portions from the first time-stamped events set is displayed in a first presentation format that is visually distinct from a second presentation format used to display each of a second group of data portions from the second time-stamped events set, further wherein, in the display format, the first group of data portions are interleaved with the second group of data portions using at least an event attribute associated with the first group of data portions and the second group of data portions; and

in response to receiving the request, causing display, on a user interface, of the first time-stamped events set and the second time-stamped events set in the display format;

wherein a first source for the first time-stamped events set represents a first participant associated with the first presentation format in the display format, and further wherein a second source for the second time-stamped events set represents a second participant associated with the second presentation format in the display format, further wherein the first time-stamped events set and the second time-stamped events set are determined by executing at least one search query.

26. The system of claim 25, wherein the first presentation format displays the data portions from first time-stamped events set in a first color, the second presentation format displays the data portions from second time-stamped events set in a second color, and the second color is different from the first color.

27. The system of claim 25, wherein the first presentation format displays the data portions from first time-stamped events set in a left aligned format, the second presentation format displays the data portions from second time-stamped events set in a right aligned format.

28. One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by a computing device, perform a method, the method comprising:

receiving a request to display a first time-stamped events set and a second time-stamped events set in a display format, wherein, in the display format, each of a first group of data portions from the first time-stamped events set is displayed in a first presentation format that is visually distinct from a second presentation format used to display each of a second group of data portions from the second time-stamped events set, further wherein, in the display format, the first group of data portions are interleaved with the second group of data portions using at least an event attribute associated with the first group of data portions and the second group of data portions; and

in response to receiving the request, causing display, on a user interface, of the first time-stamped events set and the second time-stamped events set in the display format;

wherein a first source for the first time-stamped events set represents a first participant associated with the first presentation format in the display format, and further wherein a second source for the second time-stamped events set represents a second participant associated with the second presentation format in the display format, further wherein the first time-stamped events set and the second time-stamped events set are determined by executing at least one search query.

29. The one or more computer-storage media of claim 28, wherein the first presentation format displays the data portions from first time-stamped events set in a first color, the second presentation format displays the data portions from second time-stamped events set in a second color, and the second color is different from the first color.

30. The one or more computer-storage media of claim 28, wherein the first presentation format displays data portions from first time-stamped events set in a left aligned format, the second presentation format displays the data portions from second time-stamped events set in a right aligned format.