Parsing events using a selected field delimiter option
AssigneeSplunk Inc.
InventorJesse Miller
Life of this patent
Estimating the term…
Abstract
A graphical user interface allows a customer to specify delimiters and/or patterns that occur in event data and indicate the presence of a particular field. The graphical user interface applies a customer's delimiter specifications directly to event data and displays the resulting event data in real time. Delimiter specifications may be saved as configuration settings and systems in a distributed setting may use the delimiter specifications to extract field values as the systems process raw data into event data. Extracted field values are used to accelerate search queries that a system receives.
Claims30
A method, comprising:
- obtaining one or more events from a data store;
- causing display of a graphical user interface that displays one or more field delimiter options specifying one or more delimiters, wherein a delimiter indicates a boundary of a field for which to identify a field value;
- in response to a selection of a field delimiter option of the one or more field delimiter options, parsing at least one of the one or more events to identify one or more field values using the selected field delimiter option based on a particular delimiter, corresponding with the selected field delimiter option, preceding or subsequent to the one or more field values thereby indicating boundaries of the fields for which to identify the one or more field values;
- causing display of the one or more field values identified in the at least one of the one or more events as the parsing occurs.
A non-transitory computer readable storage medium, storing software instructions, which when executed by one or more processors cause performance of:
- obtaining one or more events from a data store;
- causing display of a graphical user interface that displays one or more field delimiter options specifying one or more delimiters, wherein a delimiter indicates a boundary of a field for which to identify a field value;
- in response to a selection of a field delimiter option of the one or more field delimiter options, parsing at least one of the one or more events to identify one or more field values using the selected field delimiter option based on a particular delimiter, corresponding with the selected field delimiter option, preceding or subsequent to the one or more field values thereby indicating boundaries of the fields for which to identify the one or more field values;
- causing display of the one or more field values identified in the at least one of the one or more events as the parsing occurs.
An apparatus, comprising:
- a data retrieving subsystem, implemented at least partially in hardware, that obtains one or more events from a data store;
- a subsystem, implemented at least partially in hardware, that causes display of a graphical user interface that displays one or more field delimiter options specifying one or more delimiters, wherein a delimiter indicates a boundary of a field for which to identify a field value;
- a parser subsystem, implemented at least partially in hardware, that, in response to a selection of a field delimiter option of the one or more field delimiter options, parses at least one of the one or more events to identify one or more field values using the selected field delimiter option based on a particular delimiter, corresponding with the selected field delimiter option, preceding or subsequent to the field values thereby indicating boundaries of the fields for which to identify the one or more field values, and
- causes display of the one or more field values identified in the at least one of the one or more events as the parsing occurs.
Dependencies are inferred from the claim text.