GENERATION OF A DATA MODEL FOR SEARCHING MACHINE DATA

• US 20140074889A1
• Filed: 10/30/2013
• Published: 03/13/2014
• Est. Priority Date: 09/07/2012
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Neels, Alice Emily, Robichaud, Marc Vincent, Sorkin, Stephen Phillip, Zhang, Steve Yu, Ganapathi, Archana Sulochana
• Granted Patent: US 8,983,994 B2
• Time in Patent Office: Days
• US Class Current: 707/779
• CPC Class Codes: G06F 16/2425 Iterative querying; Query formulation based on the results of a preceding query
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 40/186 Templates

Abstract

Embodiments include generating data models that may give semantic meaning for unstructured or structured data that may include data generated and/or received by search engines, including a time series engine. A method includes generating a data model for data stored in a repository. Generating the data model includes generating an initial query string, executing the initial query string on the data, generating an initial result set based on the initial query string being executed on the data, determining one or more candidate fields from one or results of the initial result set, generating a candidate data model based on the one or more candidate fields, iteratively modifying the candidate data model until the candidate data model models the data, and using the candidate data model as the data model. The method further includes generating a new query string using the data model, executing the new query string on the data, and generating a new result set based on the new query string being executed on the data.

Claims

1. A method, comprising:

generating a data model for computer data stored in a repository, wherein generating the data model includes;

generating an initial query string,

executing the initial query string on the data,

generating an initial result set based on the initial query string being executed on the data,

determining one or more candidate fields from one or more results of the initial result set,

generating a candidate data model based on the one or more candidate fields,

iteratively modifying the candidate data model until the candidate data model models the data, and

using the candidate data model as the data model;

generating a new query string using the data model;

executing the new query string on the data; and

generating a new result set based on the new query string being executed on the data.

2. The method of claim 1, wherein the candidate data model includes one or more candidate data model objects.

3. The method of claim 1, wherein the data stored in the repository includes unstructured data.

4. The method of claim 1, wherein the data stored in the repository includes unstructured data, and wherein the initial result set is generated from the unstructured data.

5. The method of claim 1, further comprising:

displaying the candidate data model in a graphical interface, wherein the candidate data model is editable in the graphical interface.

6. A system, comprising:

a processor; and

a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including;

generating a data model for computer data stored in a repository, wherein generating the data model includes;

generating an initial query string,

executing the initial query string on the data,

generating an initial result set based on the initial query string being executed on the data,

determining one or more candidate fields from one or results of the initial result set,

generating a candidate data model based on the one or more candidate fields,

iteratively modifying the candidate data model until the candidate data model models the data, and

using the candidate data model as the data model;

generating a new query string using the data model;

executing the new query string on the data; and

generating a new result set based on the new query string being executed on the data.

7. The system of claim 6, wherein the candidate data model includes one or more candidate data model objects.

8. The system of claim 6, wherein the data stored in the repository includes unstructured data.

9. The system of claim 6, wherein the data stored in the repository includes unstructured data, and wherein the initial result set is generated from the unstructured data.

10. The system of claim 6, wherein the non-transitory computer-readable storage medium contains further instructions configured to cause the processor to perform operations including:

displaying the candidate data model in a graphical interface, wherein the candidate data model is editable in the graphical interface.

11. A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:

generate a data model for computer data stored in a repository, wherein generating the data model includes;

generate an initial query string,

execute the initial query string on the data,

generate an initial result set based on the initial query string being executed on the data,

determine one or more candidate fields from one or results of the initial result set,

generate a candidate data model based on the one or more candidate fields,

iteratively modify the candidate data model until the candidate data model models the data, and

use the candidate data model as the data model;

generate a new query string using the data model;

execute the new query string on the data; and

generate a new result set based on the new query string being executed on the data.

12. The computer-program product of claim 11, wherein the candidate data model includes one or more candidate data model objects.

13. The computer-program product of claim 11, wherein the data stored in the repository includes unstructured data.

14. The computer-program product of claim 11, wherein the data stored in the repository includes unstructured data, and wherein the initial result set is generated from the unstructured data.

15. The computer-program product of claim 11, further including instructions configured to cause the data processing apparatus to:

display the candidate data model in a graphical interface, wherein the candidate data model is editable in the graphical interface.