Back to results
US 10,853,399 B2Granted
User interface search tool for locating and summarizing data
AssigneeSplunk Inc.
InventorsJesse Miller, Jason Szeto, Jose Solis, Jindrich Dinga, David Marquardt
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed involving user interface (UI) search tools for locating data, including tools for summarizing indexed raw machine data that organize and present results to enable expansion and exploration of initial summarizations. The initial summarizations may be explored and refined to help users determine how to identify and best focus a search on data subsets of greater interest.
Claims29
A method, comprising:
- causing display of one or more first graphical controls of a graphical user interface on a display device, the one or more first graphical controls enabling a user to specify filter criteria to identify a set of data of a distributed data intake and query system to be summarized,
- wherein the set of data includes events, each event comprising a portion of raw machine data associated with a time stamp and generated by one or more components in an information technology (IT) environment, wherein the distributed data intake and query system uses the filter criteria provided in the one or more first graphical controls to obtain the set of data;
- causing display of one or more second graphical controls of the graphical user interface on the display device, the one or more second graphical controls enabling the user to specify:
- grouping criteria to generate a plurality of groups of data from the set of data based on at least one of a host, source, source type, and partition associated with the set of data, wherein the grouping criteria comprises a field identifier, and
- summarizing criteria to summarize the plurality of groups of data,
- wherein the one or more second graphical controls are distinct from and displayed concurrently with the one or more first graphical controls;
- generating, by a computer, the plurality of groups of data based at least in part on the field identifier and an inverted index, the inverted index comprising a plurality of entries, each entry of the plurality of entries comprising:
- a field value corresponding to the field identifier, and
- one or more event references, each event reference indicative of an event of the events that is associated with the field value;
- generating, by the computer, a summarization of the plurality of groups of data based at least in part on the summarizing criteria specified by the one or more second graphical controls;
- and
- causing display of the summarization.
9 more elements
A system, comprising:
- a memory;
- and
- a processing device coupled with the memory to:
- cause display of one or more first graphical controls of a graphical user interface on a display device, the one or more first graphical controls enabling a user to specify filter criteria to identify a set of data of a distributed data intake and query system to be summarized,
- wherein the set of data includes events, each event comprising a portion of raw machine data associated with a time stamp and generated by one or more components in an information technology (IT) environment, wherein the distributed data intake and query system uses the filter criteria provided in the one or more first graphical controls to obtain the set of data;
- cause display of one or more second graphical controls of the graphical user interface on the display device, the one or more second graphical controls enabling the user to specify:
- grouping criteria to generate a plurality of groups of data from the set of data based on at least one of a host, source, source type, and partition associated with the set of data, wherein the grouping criteria comprises a field identifier, and
- summarizing criteria to summarize the plurality of groups of data,
- wherein the one or more second graphical controls are distinct from and displayed concurrently with the one or more first graphical controls;
- generate the plurality of groups of data based at least in part on the field identifier and an inverted index, the inverted index comprising a plurality of entries, each entry of the plurality of entries comprising:
- a field value corresponding to the field identifier, and
- one or more event references, each event reference indicative of an event of the events that is associated with the field value;
- generate a summarization of the plurality of groups of data based at least in part on the summarizing criteria specified by the one or more second graphical controls;
- and
- cause display of the summarization.
12 more elements
A non-transitory computer-readable medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
- causing display of one or more first graphical controls of a graphical user interface on a display device, the one or more first graphical controls enabling a user to specify filter criteria to identify a set of data of a distributed data intake and query system to be summarized,
- wherein the set of data includes events, each event comprising a portion of raw machine data associated with a time stamp and generated by one or more components in an information technology (IT) environment, wherein the distributed data intake and query system uses the filter criteria provided in the one or more first graphical controls to obtain the set of data;
- causing display of one or more second graphical controls of the graphical user interface on the display device, the one or more second graphical controls enabling the user to specify:
- grouping criteria to generate a plurality of groups of data from the set of data based on at least one of a host, source, source type, and partition associated with the set of data, wherein the grouping criteria comprises a field identifier, and
- summarizing criteria to summarize the plurality of groups of data,
- wherein the one or more second graphical controls are distinct from and displayed concurrently with the one or more first graphical controls;
- generating the plurality of groups of data based at least in part on the field identifier and an inverted index, the inverted index comprising a plurality of entries, each entry of the plurality of entries comprising:
- a field value corresponding to the field identifier, and
- one or more event references, each event reference indicative of an event of the events that is associated with the field value;
- generating a summarization of the plurality of groups of data based at least in part on the summarizing criteria specified by the one or more second graphical controls;
- and
- causing display of the summarization.
9 more elements
Dependencies are inferred from the claim text.