Advanced field extractor

• US 10,318,537 B2
• Filed: 04/28/2017
• Issued: 06/11/2019
• Est. Priority Date: 01/22/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Carasso, R. David, Delfino, Micah James
• Primary Examiner(s): Saeed, Usmaan
• Assistant Examiner(s): Weinrich, Brian E.
• Application Number:
  US15/582,599
• Publication Number:
  US 20170270219A1
• Time in Patent Office: 774 Days
• Field of Search: 707811, 707999006, 707757
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/9014 hash tables
• CPC Class Codes: G06F 40/284 Lexical analysis, e.g. tokenisation or collocates

Abstract

Embodiments are directed towards a graphical user interface identify locations within event records with splittable timestamp information. A display of event records is provided using any of a variety of formats. A splittable timestamp selector allows a user to select one or more locations within event records as having time related information that may be split across the one or more locations, including, information based on date, time of day, day of the week, or other time information. Any of a plurality of mechanisms is used to associate the selected locations with the split timestamp information, including tags, labels, or header information within the event records. In other embodiments, a separate table, list, index, or the like may be generated that associates the selected locations with the split timestamp information. The split timestamp information may be used within extraction rules for selecting subsets or the event records.

Claims

1. A computer-implemented method, comprising:

generating a graphical interface on a computing device, wherein the graphical interface displays;

a plurality of event records, wherein one or more locations within an event record includes time information; and

a timestamp selection tool, wherein the timestamp selection tool is configured to select the one or more locations within the event record by dragging the timestamp selection tool over locations having time information to indicate fields of the time information;

receiving input corresponding to a selection of the one or more locations split across the event record, wherein the selection is made using the timestamp selection tool and each of the one or more locations correspond to a field that defines a location of a category of time information across multiple event records;

associating the one or more selected locations with timestamp information;

storing the association between the one or more selected locations and the timestamp information, wherein the stored association is used in an extraction rule;

using the extraction rule to extract the time information from the one or more selected locations split across the event record and to extract time information from the multiple event records; and

creating a timestamp for the event record and for each of the multiple event records using the corresponding time information extracted using the extraction rule.

2. The method of claim 1, wherein receiving input corresponding to the selection of the one or more locations comprises selection of the plurality of locations.

3. The method of claim 2, wherein at least one of the one or more of the locations that include time information are not selected as time information for stamping the event record.

4. The method of claim 1, wherein at least one of the plurality of event records includes unstructured data.

5. The method of claim 1, wherein at least one of the plurality of event records includes unstructured machine data.

6. The method of claim 1, wherein associating the one or more selected locations with the timestamp information further includes using a tag, a label, or a header to create the association.

7. The method of claim 1, wherein associating the one or more selected locations with the timestamp information further includes using a table, a list, or an index to create the association.

8. The method of claim 1, wherein the time information includes a year, a month, day, a time of day, or a day of week information.

9. The method of claim 1, wherein a splittable timestamp selection resulting from the selection of the one or more locations within the event record is configured to select multiple locations within the displayed event records as having time information.

10. A system for managing resources, comprising:

at least one network device, comprising;

a processor, and

a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including;

generating a graphical interface, wherein the graphical interface displays;

a plurality of event records, wherein one or more locations within an event record includes time information; and

a timestamp selection tool, wherein the timestamp selection tool is configured to select the one or more locations within the event record by dragging the timestamp selection tool over locations having time information to indicate fields of the time information;

receiving input corresponding to a selection of the one or more locations split across the event record, wherein the selection is made using the timestamp selection tool and each of the one or more locations correspond to a field that defines a location of a category of time information across multiple event records;

associating the one or more selected locations with timestamp information;

storing the association between the one or more selected locations and the timestamp information, herein the stored association is used in an extraction rule;

using the extraction rule to extract the time information from the one or more selected locations within the event record and to extract time information from the multiple event records; and

creating a timestamp for the event record and for each of the multiple event records using the corresponding time information extracted using the extraction rule.

11. The system of claim 10, wherein receiving input corresponding to the selection of the one or more locations comprises selection of the plurality of locations.

12. The system of claim 11, wherein at least one of the one or more of the locations that include time information are not selected as time information for stamping the event record.

13. The system of claim 10, wherein at least one of the plurality of event records includes unstructured data.

14. The system of claim 10, wherein at least one of the plurality of event records includes unstructured machine data.

15. The system of claim 10, wherein associating the one or more selected locations with the timestamp information further includes using a tag, a label, or a header to create the association.

16. The system of claim 10, wherein associating the one or more selected locations with the timestamp information further includes using a table, a list, or an index to create the association.

17. The system of claim 10, wherein the time information includes a year, a month, day, a time of day, or a day of week information.

18. A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:

generate a graphical interface, wherein the graphical interface displays;

a plurality of event records, wherein one or more locations within an event record includes time information; and

a timestamp selection tool, wherein the timestamp selection tool is configured to select the one or more locations within the event record by dragging the timestamp selection tool over locations having time information to indicate fields of the time information;

receive input corresponding to a selection of the one or more locations split across the event record, wherein the selection is made using the timestamp selection tool and each of the one or more locations correspond to a field that defines a location of a category of time information across multiple event records;

associate the one or more selected locations with timestamp information;

store the association between the one or more selected locations and the timestamp information, herein the stored association is used in an extraction rule;

using the extraction rule to extract the time information from the one or more selected locations split across the event record and to extract time information from the multiple event records; and

create a timestamp for the event record and for each of the multiple event records using the corresponding time information extracted using the extraction rule.

19. The computer-program product of claim 18, wherein receiving input corresponding to the selection of the one or more locations comprises selection of the plurality of locations.

20. The computer-program product of claim 19, wherein at least one of the one or more of the locations that include time information are not selected as time information for stamping the event record.

21. The computer-program product of claim 18, wherein at least one of the plurality of event records includes unstructured data.

22. The computer-program product of claim 18, wherein at least one of the plurality of event records includes unstructured machine data.

23. The computer-program product of claim 18, wherein associating the one or more selected locations with the timestamp information further includes using a tag, a label, or a header to create the association.

24. The computer-program product of claim 18, wherein associating the one or more selected locations with the timestamp information further includes using a table, a list, or an index to create the association.

25. The computer-program product of claim 18, wherein the time information includes a year, a month, a day, a time of day, or a day of week information.