Technique for context updating and query processing for evaluating qualitative search terms
AssigneeSplunk Inc.
InventorsMichael E. Cormier, William E. Thackrey, Earl D. Cox
Life of this patent
Estimating the term…
Abstract
The disclosed embodiments relate to a system that updates a context that facilitates evaluating qualitative search terms for an attribute during query processing. During operation, the system extracts a value for the attribute from each data item in a set of data items. Next, the system updates the context based on the extracted attribute values, wherein the context includes a concept-mapping for one or more qualitative search terms applied to the attribute, and wherein each concept-mapping associates a given attribute value with a numerical compatibility index that indicates a compatibility between the given attribute value and a corresponding qualitative search term.
Claims31
A computer-implemented method for managing a concept-mapping function that facilitates evaluating a qualitative search term applied to an attribute during query processing, the method comprising:
- extracting a numerical value for the attribute from each data item in a set of data items;
- updating the concept-mapping function based on the extracted numerical attribute values,
- wherein the concept-mapping function associates a given numerical value for the attribute with a numerical compatibility index that indicates a compatibility between the given numerical value and the qualitative search term as applied to the attribute,
- wherein the qualitative search term comprises one or more words that is a qualitative measurement of the numerical attribute value;
- wherein updating the concept-mapping function comprises,
- determining boundaries for the concept-mapping function based on the extracted numerical attribute values, the boundaries corresponding to a start point and an end point of a range of the extracted numerical attribute values associated with the concept mapping function, and
- within the determined boundaries, using a pre-specified distribution to update the concept-mapping function;
- receiving a query on a set of stored events, the query comprising the qualitative search term;
- for at least a subset of events in the set of stored events:
- applying the concept-mapping function to a numerical attribute value in the event to obtain the numerical compatibility index for the event and qualitative search term, and
- determining whether to include the event in a set of query results based on the numerical compatibility index;
- and
- responding to the query using the set of query results.
A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for managing a concept-mapping function that facilitates evaluating a qualitative search term applied to an attribute during query processing, the method comprising:
- extracting a numerical value for the attribute from each data item in a set of data items;
- updating the concept-mapping function based on the extracted numerical attribute values,
- wherein the concept-mapping function associates a given numerical value for the attribute with a numerical compatibility index that indicates a compatibility between the given numerical value and the qualitative search term as applied to the attribute,
- wherein the qualitative search term comprises one or more words that is a qualitative measurement of the numerical attribute value;
- wherein updating the concept-mapping function comprises,
- determining boundaries for the concept-mapping function based the extracted numerical attribute values, the boundaries corresponding to a start point and an end point of a range of the extracted numerical attribute values associated with the concept mapping function, and
- within the determined boundaries, using a pre-specified distribution to update the concept-mapping function;
- receiving a query on a set of stored events, the query comprising the qualitative search term;
- for at least a subset of events in the set of stored events:
- applying the concept-mapping function to a numerical attribute value in the event to obtain the numerical compatibility index for the event and qualitative search term, and
- determining whether to include the event in a set of query results based on the numerical compatibility index;
- and
- responding to the query using the set of query results.
A system for managing a concept-mapping function that facilitates evaluating a qualitative search term applied to an attribute during query processing, comprising:
- at least one processor and at least one associated memory;
- and
- an updating mechanism that executes on the at least one processor and during operation:
- extracts a numerical value for the attribute from each data item in a set of data items;
- updates the concept-mapping function based on the extracted numerical attribute values,
- wherein the concept-mapping function associates a given numerical value for the attribute with a numerical compatibility index that indicates a compatibility between the given numerical value and the qualitative search term as applied to the attribute,
- wherein the qualitative search term comprises one or more words that is a qualitative measurement of the numerical attribute value;
- wherein while updating the concept-mapping function, the updating mechanism,
- determines boundaries for the concept-mapping function based the extracted numerical attribute values, the boundaries corresponding to a start point and an end point of a range of the extracted numerical attribute values associated with the concept mapping function, and
- within the determined boundaries, uses a pre-specified distribution to update the concept-mapping function;
- receive a query on a set of stored events, the query comprising the qualitative search term;
- for at least a subset of events in the set of stored events:
- apply the concept-mapping function to a numerical attribute value in the event to obtain the numerical compatibility index for the event and qualitative search term, and
- determine whether to include the event in a set of query results based on the numerical compatibility index;
- and
- respond to the query using the set of query results.
Dependencies are inferred from the claim text.