GENERATION OF A DATA MODEL APPLIED TO OBJECT QUERIES
First Claim
1. A computer-implemented method, comprising:
- receiving from a user a selection of an object included in a data model, the selection made through an object-selection interface;
based on receiving the user selection of the object, retrieving from computer memory a previously stored object definition that corresponds to the selected object and that includes;
an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data reflecting activity in an information technology environment; and
an object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that can be used to extract a value for the field from each event in a subset of the set of time stamped events, each extraction operating on the raw machine data in an event without modifying the event'"'"'s raw machine data; and
executing, against events in the data store that meet filtering criteria of the object query, a search query that uses only fields that are included in the object schema and that produces a result based at least in part on the data reflecting the activity of the information technology environment.
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments include generating data models that may give semantic meaning for unstructured or structured data that may include data generated and/or received by search engines, including a time series engine. A method includes generating a data model for data stored in a repository. Generating the data model includes generating an initial query string, executing the initial query string on the data, generating an initial result set based on the initial query string being executed on the data, determining one or more candidate fields from one or results of the initial result set, generating a candidate data model based on the one or more candidate fields, iteratively modifying the candidate data model until the candidate data model models the data, and using the candidate data model as the data model.
51 Citations
30 Claims
-
1. A computer-implemented method, comprising:
-
receiving from a user a selection of an object included in a data model, the selection made through an object-selection interface; based on receiving the user selection of the object, retrieving from computer memory a previously stored object definition that corresponds to the selected object and that includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that can be used to extract a value for the field from each event in a subset of the set of time stamped events, each extraction operating on the raw machine data in an event without modifying the event'"'"'s raw machine data; and executing, against events in the data store that meet filtering criteria of the object query, a search query that uses only fields that are included in the object schema and that produces a result based at least in part on the data reflecting the activity of the information technology environment. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22)
-
-
23. A non-transitory computer readable storage medium impressed with computer program instructions that, when executed on a processor, implement a method comprising:
-
receiving from a user a selection of an object included in a data model, the selection made through an object-selection interface; based on receiving the user selection of the object, retrieving from computer memory a previously stored object definition that corresponds to the selected object and that includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that can be used to extract a value for the field from each event in a subset of the set of time stamped events, each extraction operating on the raw machine data in an event without modifying the event'"'"'s raw machine data; and executing, against events in the data store that meet filtering criteria of the object query, a search query that uses only fields that are included in the object schema and that produces a result based at least in part on the data reflecting the activity of the information technology environment. - View Dependent Claims (24, 25, 26)
-
-
27. A system including one or more processors coupled to memory, the memory loaded with computer instructions that, when executed on the processors, implement actions including:
-
receiving from a user a selection of an object included in a data model, the selection made through an object-selection interface; based on receiving the user selection of the object, retrieving from computer memory a previously stored object definition that corresponds to the selected object and that includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that can be used to extract a value for the field from each event in a subset of the set of time stamped events, each extraction operating on the raw machine data in an event without modifying the event'"'"'s raw machine data; and executing, against events in the data store that meet filtering criteria of the object query, a search query that uses only fields that are included in the object schema and that produces a result based at least in part on the data reflecting the activity of the information technology environment. - View Dependent Claims (28, 29, 30)
-
Specification