Data Model Selection and Application Based on Data Sources
First Claim
1. A method, comprising:
- selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models represent a view and/or perspective of the data associated with the specific data source, the data comprised of a plurality of time-stamped, searchable events, each event in the a plurality of time-stamped, searchable events including a portion of raw machine data reflecting activity in an information technology environment;
causing display, in a graphical user interface, of a representation of one or more objects that are included in the one or more data models;
receiving a selection of a representation of an object among the representation of the one or more objects via the graphical user interface;
based on the selected object representation, retrieving a query and a schema associated with the selected object representation;
retrieving a set of time-stamped, searchable events from the data using the query; and
extracting field values from one or more fields, identified by the object schema, in the portions of raw machine data in the set of time-stamped, searchable events;
wherein the method is performed by one or more computing devices.
1 Assignment
0 Petitions
Accused Products
Abstract
Embodiments include generating data models that may give semantic meaning for unstructured or structured data that may include data generated and/or received by search engines, including a time series engine. A method includes generating a data model for data stored in a repository. Generating the data model includes generating an initial query string, executing the initial query string on the data, generating an initial result set based on the initial query string being executed on the data, determining one or more candidate fields from one or results of the initial result set, generating a candidate data model based on the one or more candidate fields, iteratively modifying the candidate data model until the candidate data model models the data, and using the candidate data model as the data model.
33 Citations
30 Claims
-
1. A method, comprising:
-
selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models represent a view and/or perspective of the data associated with the specific data source, the data comprised of a plurality of time-stamped, searchable events, each event in the a plurality of time-stamped, searchable events including a portion of raw machine data reflecting activity in an information technology environment; causing display, in a graphical user interface, of a representation of one or more objects that are included in the one or more data models; receiving a selection of a representation of an object among the representation of the one or more objects via the graphical user interface; based on the selected object representation, retrieving a query and a schema associated with the selected object representation; retrieving a set of time-stamped, searchable events from the data using the query; and extracting field values from one or more fields, identified by the object schema, in the portions of raw machine data in the set of time-stamped, searchable events; wherein the method is performed by one or more computing devices. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
-
selecting one or more data models among a plurality of data models based on data being analyzed from a specific data source among a plurality of data sources, the one or more data models represent a view and/or perspective of the data associated with the specific data source, the data comprised of a plurality of time-stamped, searchable events, each event in the a plurality of time-stamped, searchable events including a portion of raw machine data reflecting activity in an information technology environment; causing display, in a graphical user interface, of a representation of one or more objects that are included in the one or more data models; receiving a selection of a representation of an object among the representation of the one or more objects via the graphical user interface; based on the selected object representation, retrieving a query and a schema associated with the selected object representation; retrieving a set of time-stamped, searchable events from the data using the query; and extracting field values from one or more fields, identified by the object schema, in the portions of raw machine data in the set of time-stamped, searchable events. - View Dependent Claims (20)
-
-
23. A non-transitory computer readable storage medium impressed with computer program instructions that, when executed on a processor, implement a method comprising:
-
receiving from a user a selection of an object among one or more objects included in a data model, the selection made through an object-selection interface; retrieving from computer memory a previously stored object definition that corresponds to the selected object, the previously stored object definition includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that locates the field in the raw machine data and can be used to extract a field value from the field location from the raw machine data in each event in a subset of the set of time stamped events, each extraction rule or regular expression operating on the raw machine data in an event without modifying the event'"'"'s raw machine data; and executing, against events in the data store that meet filtering criteria of the object query, a search query that references only field values that are extracted using the object schema and that produces a result based at least in part on the data reflecting the activity of the information technology environment. - View Dependent Claims (24, 25, 26)
-
-
27. A system including one or more processors coupled to memory, the memory loaded with computer instructions that, when executed on the processors, implement actions including:
-
receiving from a user a selection of an object among one or more objects included in a data model, the selection made through an object-selection interface; retrieving from computer memory a previously stored object definition that corresponds to the selected object, the previously stored object definition includes; an object query that, when executed, retrieves a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data reflecting activity in an information technology environment; and an object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that locates the field in the raw machine data and can be used to extract a field value from the field location from the raw machine data in each event in a subset of the set of time stamped events, each extraction rule or regular expression operating on the raw machine data in an event without modifying the event'"'"'s raw machine data; and executing, against events in the data store that meet filtering criteria of the object query, a search query that references only field values that are extracted using the object schema and that produces a result based at least in part on the data reflecting the activity of the information technology environment. - View Dependent Claims (28, 29, 30)
-
Specification