US 10,896,175 B2Granted

Extending data processing pipelines using dependent queries

AssigneeSplunk Inc.

InventorMarc Vincent Robichaud

Life of this patent

Estimating the term…

Loading patent…

Abstract

A dependency is created between a first search query and a second search query. The first search query defines a first data processing pipeline and the second search query defines a second data processing pipeline that extends the first data processing pipeline. A modification is detected to the first data processing pipeline defined by the first search query. Based on the modification to the first data processing pipeline being detected, the dependency is enforced such that the second data processing pipeline is modified to extend the modified first data processing pipeline. The modification to the first data processing pipeline can include a first set of pipelined commands corresponding to the first search query being modified, and the dependency can be enforced by causing a second set of pipelined commands corresponding to the second search query to be modified to include the modified first set of pipelined commands.

Claims30

Dependent claims

A computer-implemented method, comprising:

receiving, in a first user interface, a user selection of at least a first graphical interface element in a list of selectable saved queries, the user selection specifying a first query of the saved queries as an input query to a second query, the user selection causing creation of a stored dependency between the first query and the second query;
in response to the user selection, causing, in a second user interface, presentation of a display of events from an output of a first data processing pipeline of the first query;
receiving user input to at least a second graphical interface element of the second user interface, the user input specifying one or more query commands that define a second data processing pipeline of the second query;
executing the second query, wherein based on detecting the stored dependency between the first query and the second query, the second data processing pipeline of the second query receives the events from the output of the first data processing pipeline defined by the first query as an input to thereby extend the first data processing pipeline defined by the first query;
and
in response to the executing of the second query, causing an update to the display of the events to correspond to an output of the second data processing pipeline of the second query.

3 more elements

A computer-implemented system, comprising:

one or more data processors;
and
one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform a method including:
receiving, in a first user interface, a user selection of at least a first graphical interface element in a list of selectable saved queries, the user selection specifying a first query of the saved queries as an input query to a second query, the user selection causing creation of a stored dependency between the first query and the second query;
in response to the user selection, causing, in a second user interface, presentation of a display of events from an output of a first data processing pipeline of the first query;
receiving user input to at least a second graphical interface element of the second user interface, the user input specifying one or more query commands that define a second data processing pipeline of the second query;
executing the second query, wherein based on detecting the stored dependency between the first query and the second query, the second data processing pipeline of the second query receives the events from the output of the first data processing pipeline defined by the first query as an input to thereby extend the first data processing pipeline defined by the first query;
and
in response to the executing of the second query, causing an update to the display of the events to correspond to an output of the second data processing pipeline of the second query.

6 more elements

One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by at least one computing device, cause the at least one computing device to perform a method, the method comprising:

receiving, in a first user interface, a user selection of at least a first graphical interface element in a list of selectable saved queries, the user selection specifying a first query of the saved queries as an input query to a second query, the user selection causing creation of a stored dependency between the first query and the second query;
in response to the user selection, causing, in a second user interface, presentation of a display of events from an output of a first data processing pipeline of the first query;
receiving user input to at least a second graphical interface element of the second user interface, the user input specifying one or more query commands that define a second data processing pipeline of the second query;
executing the second query, wherein based on detecting the stored dependency between the first query and the second query, the second data processing pipeline of the second query receives the events from the output of the first data processing pipeline defined by the first query as an input to thereby extend the first data processing pipeline defined by the first query;
and
in response to the executing of the second query, causing an update to the display of the events to correspond to an output of the second data processing pipeline of the second query.

3 more elements

Dependencies are inferred from the claim text.