# US 10,768,786 B1 · Juxtaposing visualizations based on field name selections > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,768,786 B1 - Document ID: US10768786B1 - Status: Granted - Kind: B1 - Application number: 15/339,393 - Filed: 2016-10-31 - Granted: 2020-09-08 - Earliest claimed: 2016-09-26 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Michael Porath; Finlay Cannon; Thomas Allan Haggie - Web page: https://patentgrep.com/patent/US10768786B1 ## CPC - G06F 16/2477: {Temporal data queries} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/04845: for image manipulation, e.g. dragging, rotation, expansion or change of colour - G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials - G06F 3/0486: Drag-and-drop - G06F 16/2428: {Query predicate definition using graphical user interfaces, including menus and forms (G06F16/2423 takes precedence)} - G06F 16/2455: Query execution - G06F 16/248: Presentation of query results - G06F 16/26: Visual data mining; Browsing structured data - G06F 16/9038: Presentation of query results - G06T 11/26: Drawing of charts or graphs - G06T 11/60: Creating or editing images; Combining images with text - G06T 2200/24: involving graphical user interfaces [GUIs] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract Embodiments are disclosed for a data analysis tool for facilitating iterative and exploratory analysis of large sets of data. In some embodiments a data analysis tool includes a graphical user interface through which an interactive set of field identifiers is displayed. Each of the listed field identifiers may reference fields associated with a set of events returned in response to a search query, the set of events including machine data produced by components within an information technology (IT) environment that reflects activity in the IT environment. In response to user selections of field identifiers included in the displayed set, a data analysis tool may cause display of manipulable visualizations based on values included in fields referenced by the selected field identifiers. ## Claims ### Claim 1 A method comprising: receiving, by a computer system, a first selection and a second selection by a user of a first field identifier and a second field identifier from a set of field identifiers for a set of fields, wherein each field identifier references a corresponding field having at least one value that is present in a set of events, the set of events comprising a first set of values for a first field and a second set of values for a second field, wherein an event includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment; splitting, in response to receiving the first selection and the second selection, the first set of values for the first field according to the second set of values for the second field to create a set of groups of values; and generating a first visualization of the set of groups of values, the first visualization comprising a juxtaposition of a graphical representation of each group of values in the set of groups of values. ### Claim 2 (depends on 1) The method of claim 1, further comprising: causing display, by the computer system, of the first visualization. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating, prior to generating the first visualization, a second visualization of the set of groups of values, the second visualization comprising a layout of the set of groups as individual graphs in a single graphical user interface pane. ### Claim 4 (depends on 1) The method of claim 1, wherein the juxtaposition is a layout of the set of groups being displayed in overlapping plots on a graph of the first visualization. ### Claim 5 (depends on 4) The method of claim 4, wherein generating the first visualization comprises adjusting a scale of an axis on the graph to accommodate each plot of the overlapping plots. ### Claim 6 (depends on 1) The method of claim 1, wherein the juxtaposition is a layout of the set of groups being displayed as layers on a graph of the first visualization. ### Claim 7 (depends on 1) The method of claim 1, wherein the juxtaposition is a layout of the set of groups being displayed as a percentage of a total in a graph in the first visualization. ### Claim 8 (depends on 1) The method of claim 1, further comprising: causing display of a menu of juxtaposition options. ### Claim 9 (depends on 8) The method of claim 8, wherein, when the first visualization is a bar graph, each juxtaposition option in the menu of juxtaposition options is displayed as a bar graph image on a selectable button. ### Claim 10 (depends on 8) The method of claim 8, wherein, when the first visualization is a line graph, each juxtaposition option in the menu of juxtaposition options is displayed as a line graph image on a selectable button. ### Claim 11 (depends on 8) The method of claim 8, wherein the menu of juxtaposition options comprises an individual option, an overlapping option, a layered cumulative option, and a percentage option. ### Claim 12 (depends on 1) The method of claim 1, wherein the second selection is received after the first selection, and wherein the method further comprises: generating, in response to receiving the first selection, a second visualization of the first set of values; causing display, by the computer system, of the second visualization; and dynamically updating, in response to receiving the second selection, the first visualization based on the splitting of the first set of values for the first field according to the second set of values for the second field to create the first visualization. ### Claim 13 (depends on 12) The method of claim 12, further comprising: applying a function to the first set of values to generate an aggregated result, wherein generating the first visualization comprises generating a graphical representation of the aggregated result as the first visualization. ### Claim 14 (depends on 1) The method of claim 1, further comprising: matching a color of each group in the set of groups to a unique value in the first set of values. ### Claim 15 (depends on 1) The method of claim 1, wherein the first set of values are split into the set of groups according to the second set of values in response to receiving the second selection of the second field identifier after receiving the first selection of the first field identifier. ### Claim 16 (depends on 1) The method of claim 1, further comprising: applying logic accounting for a resultant number of groups to make a determination to split the first set of values into a first set of groups according to the second set of values, wherein the first set of values are split into the set of groups according to the second set of values in response to the determination. ### Claim 17 (depends on 1) The method of claim 1, further comprising: selecting to display a bar graph based on the first selection lacking time series information. ### Claim 18 (depends on 17) The method of claim 17, further comprising: receiving a selection of a time dimension subsequent to causing display of the bar graph; automatically selecting an aggregation span in response to the selection of the time dimension; partitioning, according to the aggregation span, each group in the set of groups into a set of time-based groups; and independently applying a function to each time-based group in the set of time-based groups to generate an aggregated result for each time-based group in the set of time-based groups, wherein the graphical representation is of the aggregated result for each time-based group in the set of time-based groups. ### Claim 19 (depends on 18) The method of claim 18, wherein the graphical representation is a line graph. ### Claim 20 (depends on 1) The method of claim 1, further comprising: selecting to display a line graph based on the first selection comprising time series information. ### Claim 21 (depends on 1) The method of claim 1, wherein the set of events was previously returned in response to a search query received from the user. ### Claim 22 (depends on 1) The method of claim 1, comprising: receiving, by the computer system, a third selection by the user of a third field identifier from the set of field identifiers, the third field identifier referencing a third field having a third set of values; dynamically updating, in response to receiving the third selection, the first visualization based on splitting the first set of values and the second set of values according to the third set of values to create a second visualization; and causing display, by the computer system and to the user, of the second visualization. ### Claim 23 (depends on 1) The method of claim 1, further comprising: causing display, by the computer system to the user, of a list of unique values in the second set of values, wherein each unique value is related to a number events having the unique value. ### Claim 24 (depends on 23) The method of claim 23, further comprising: receiving a deselection of a particular unique value in the list of unique values; and in response to receiving the deselection, removing, from the first visualization, a group matching the particular unique value. ### Claim 25 (depends on 23) The method of claim 23, wherein each unique value in the list of unique values matches in color with a corresponding group in the first visualization. ### Claim 26 (depends on 1) The method of claim 1, wherein the first field is of a first type of fields, and the second field is of a second type of fields different than the first type of fields. ### Claim 27 (depends on 26) The method of claim 26, wherein the first type of fields includes measured fields, and the second type of fields includes categorical fields. ### Claim 28 A computer system comprising: a processing unit; and a storage device having instructions stored thereon, which when executed by the processing unit cause the computer system to: receive a first selection and a second selection by a user of a first field identifier and a second field identifier from a set of field identifiers for a set of fields, wherein each field identifier references a corresponding field that is present in a set of events, the set of events comprising a first set of values for a first field and a second set of values for a second field, wherein an event includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment; split, in response to receiving the first selection and the second selection, the first set of values for the first field according to the second set of values for the second field to create a set of groups of values; and generate a visualization of the set of groups of values, the visualization comprising a juxtaposition of a graphical representation of each group of values in the set of groups of values. ### Claim 29 (depends on 28) The system of claim 28, wherein the instructions further cause the computer system to: cause display of a menu of juxtaposition options. ### Claim 30 A non-transitory computer-readable medium containing instructions, execution of which in a computer system causes the computer system to: receive a first selection and a second selection by a user of a first field identifier and a second field identifier from a set of field identifiers for a set of fields, wherein each field identifier references a corresponding field that is present in a set of events, the set of events comprising a first set of values for a first field and a second set of values for a second field, wherein an event includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment; split, in response to receiving the first selection and the second selection, the first set of values in the first field according to the second set of values to create a set of groups of values; and generate a visualization of the set of groups of values, the visualization comprising a juxtaposition of a graphical representation of each group of values in the sets of groups of values.