Back to results
US 10,885,049 B2Granted
User interface to identify one or more pivot identifiers and one or more step identifiers to process events
AssigneeSplunk Inc.
InventorsJoerg Beringer, Isabelle Park, Joshua Walters, Eric Tschetter, Simon Fishel
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for generating a user interface to enable identification of one or more pivot identifiers and one or more step identifiers. The system executes a query on events having raw machine data associated with a timestamp and obtains fields associated with the events. The system further populates a graphical user interface with field identifiers associated with the obtained fields and enables identification of one or more fields as one or more pivot identifiers and one or more step identifiers.
Claims23
A method comprising:
- executing a query to search events in a computer system, each event including raw machine data associated with a time stamp;
- obtaining fields from a plurality of events that are identified by the query;
- populating a graphical user interface with field identifiers for a subset of the fields obtained from the plurality of events;
- enabling, via the graphical user interface, concurrent:
- identification of a first field of the subset of the fields as a step identifier field, wherein event field values for the step identifier field are used to categorize the plurality of events into a plurality of step instances, wherein each of the plurality of step instances is associated with a step of a plurality of steps, and
- identification of a second field of the subset of the fields as a pivot identifier field, wherein event field values for the pivot identifier field are used to group the plurality of step instances into a plurality of journey instances;
- and
- responsive to identification of the first field as the step identifier field and identification of the second field as the pivot identifier field:
- categorizing the plurality of events into the plurality of step instances, wherein at least two step instances of the plurality of step instances include a same event field value for the step identifier field and are associated with a same step of the plurality of steps,
- generating the plurality of journey instances, wherein a journey instance includes a set of step instances, and
- causing display of a particular journey instance of the plurality of journey instances, wherein a step instance display object is displayed for each step instance of the particular journey instance, wherein the particular journey instance includes at least two time-ordered step instances that include a same event field value for the pivot identifier field, wherein the at least two time-ordered step instances are time ordered based on a time field associated with each of the at least two time-ordered step instances, and wherein each of the at least two time-ordered step instances correspond to an event of the plurality of events, respectively.
8 more elements
A computing system, comprising:
- one or more processing devices configured to:
- execute a query to search events in a computer system, each event including raw machine data associated with a time stamp;
- obtain fields from a plurality of events that are identified by the query;
- populate a graphical user interface with field identifiers for a subset of the fields obtained from the plurality of events;
- enable, via the graphical user interface, concurrent:
- identification of a first field of the subset of the fields as a step identifier field, wherein event field values for the step identifier field are used to categorize the plurality of events into a plurality of step instances, wherein each of the plurality of step instances is associated with a step of a plurality of steps, and
- identification of a second filed of the subset of the fields as a pivot identifiers field, wherein event field values for the pivot identifier field are used to group the plurality of step instances into a plurality of journey instances;
- and
- responsive to identification of the first field as the step identifier field and identification of the second field as the pivot identifier field:
- categorize the plurality of events into the plurality of step instances, wherein at least two step instances of the plurality of step instances include a same event field value for the step identifier field and are associated with a same step of the plurality of steps,
- generate the plurality of journey instances, wherein a journey instance includes a set of step instances, and
- cause display of a particular journey instance of the plurality of journey instances, wherein a step instance display object is displayed for each step instance of the particular journey instance, wherein the particular journey instance includes at least two time-ordered step instances that include a same event field value for the pivot identifier field, wherein the at least two time-ordered step instances are time ordered based on a time field associated with each of the at least two time-ordered step instances, and wherein each of the at least two time-ordered step instances correspond to an event of the plurality of events, respectively.
9 more elements
Non-transitory computer readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:
- execute a query to search events in a computer system, each event including raw machine data associated with a time stamp;
- obtain fields from a plurality of events that are identified by the query;
- populate a graphical user interface with field identifiers for a subset of the fields obtained from the plurality of events;
- enable, via the graphical user interface, concurrent:
- identification of a first field of the subset of the fields as a step identifier field, wherein event field values for the step identifier field are used to categorize the plurality of events into a plurality of step instances, wherein each of the plurality of step instances is associated with a step of a plurality of steps, and
- identification of a second field of the subset of the fields as a pivot identifiers field, wherein event field values for the pivot identifier field are used to group the plurality of step instances into a plurality of journey instances;
- and
- responsive to identification of the first field as the step identifier field and identification of the second field as the pivot identifier field:
- categorizing the plurality of events into the plurality of step instances, wherein at least two step instances of the plurality of step instances include a same event field value for the step identifier field and are associated with a same step of the plurality of steps,
- generating the plurality of journey instances, wherein a journey instance includes a set of step instances, and
- causing display of a particular journey instance of the plurality of journey instances, wherein a step instance display object is displayed for each step instance of the particular journey instance, wherein the particular journey instance includes at least two time-ordered step instances that include a same event field value for the pivot identifier field, wherein the at least two time-ordered step instances are time ordered based on a time field associated with each of the at least two time-ordered step instances, and wherein each of the at least two time-ordered step instances correspond to an event of the plurality of events, respectively.
8 more elements
Dependencies are inferred from the claim text.