# US 11,030,229 B2 · Automatic rule modification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,229 B2 - Document ID: US11030229B2 - Status: Granted - Kind: B2 - Application number: 15/582,670 - Filed: 2017-04-29 - Published: 2017-09-21 - Granted: 2021-06-08 - Earliest claimed: 2013-01-23 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: R. David Carasso; Micah James Delfino; Johnvey Hwang - Web page: https://patentgrep.com/patent/US11030229B2 ## CPC - G06F 16/34: Browsing; Visualisation therefor (browsing or visualisation for clustering or classification G06F16/358) - G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range - G06F 16/242: Query formulation - G06F 16/2423: {Interactive query statement specification based on a database schema} - G06F 16/2477: {Temporal data queries} - G06F 40/166: Editing, e.g. inserting or deleting - G06F 40/174: Form filling; Merging - G06F 40/40: Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30) - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving raw machine data; generating, using one or more processors, a set of events, wherein each event in the set of events includes a portion of the raw machine data; associating a time with each event in the set of events, the time for each event extracted from the raw machine data included in that event; storing the set of events in a data store such that they are searchable at least by their associated times; causing display of an extraction rule, wherein the extraction rule specifies how to extract a value for a field from raw machine data included in an event; causing display of a subset of events of the set of events; visually emphasizing in the displayed subset of events a value for the field that would be extracted from each of the events in the subset of events by applying the extraction rule; receiving input indicating that the emphasized value in a given event in the subset of events should not be the value extracted for the field for the given event; based on the input indicating that the emphasized value should not be the value for the field for the given event, automatically modifying the extraction rule so that it would extract a different value as a value for the field for the given event when applied to the given event; and modifying the displayed given event to visually emphasize the different value for the field for the given event. ### Claim 2 (depends on 1) The method of claim 1, wherein the extraction rule includes a regular expression. ### Claim 3 (depends on 1) The method of claim 1, wherein the raw machine data includes log data. ### Claim 4 (depends on 1) The method of claim 1, further comprising displaying the modified extraction rule. ### Claim 5 (depends on 1) The method of claim 1, wherein the extraction rule is received from a user through manual keyboard input. ### Claim 6 (depends on 1) The method of claim 1, wherein the extraction rule is automatically generated to extract as the value for the field for a displayed event text that a user has selected in the event. ### Claim 7 (depends on 1) The method of claim 1, further comprising modifying a second event in the displayed subset of events to emphasize a value that would be extracted for the field for the second event by applying the modified extraction rule to the second event. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving a label for the field corresponding to the extraction rule; and using the label for the field to search for an event via the field. ### Claim 9 (depends on 1) The method of claim 1, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and displaying one or more unique field values in the set of unique field values. ### Claim 10 (depends on 1) The method of claim 1, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and displaying a statistic for one or more unique field values in the set of unique field values. ### Claim 11 (depends on 1) The method of claim 1, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and displaying a statistic for one or more unique field values in the set of unique field values, wherein the statistic includes a count of events in which the unique field value appears as the value for the field or a percentage of events in which the unique field value appears as the value for the field. ### Claim 12 (depends on 1) The method of claim 1, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; receiving a selection of a unique field value in the set of unique field values; and displaying only events in the subset of events for which the extraction rule would extract the selected unique filed value when applied to the events. ### Claim 13 A system comprising: at least one network device, comprising: a processor; and a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including: receiving raw machine data; generating, using one or more processors, a set of events, wherein each event in the set of events includes a portion of the raw machine data; associating a time with each event in the set of events, the time for each event extracted from the raw machine data included in that event; storing the set of events in a data store such that they are searchable at least by their associated times; causing display of an extraction rule, wherein the extraction rule specifies how to extract a value for a field from raw machine data included in an event; causing display of a subset of events of the set of events; visually emphasizing in the displayed subset of events a value for the field that would be extracted from each of the events in the subset of events by applying the extraction rule; receiving input indicating that the emphasized value in a given event in the subset of events should not be the value extracted for the field for the given event; based on the input indicating that the emphasized value should not be the value for the field for the given event, automatically modifying the extraction rule so that it would extract a different value as a value for the field for the given event when applied to the given event; and modifying the displayed given event to visually emphasize the different value for the field for the given event. ### Claim 14 (depends on 13) The system of claim 13, wherein the extraction rule includes a regular expression. ### Claim 15 (depends on 13) The system of claim 13, wherein the raw machine data includes log data. ### Claim 16 (depends on 13) The system of claim 13, further comprising displaying the modified extraction rule. ### Claim 17 (depends on 13) The system of claim 13, wherein the extraction rule is received from a user through manual keyboard input. ### Claim 18 (depends on 13) The system of claim 13, wherein the extraction rule is automatically generated to extract as the value for the field for a displayed event text that a user has selected in the event. ### Claim 19 (depends on 13) The system of claim 13, further comprising modifying a second event in the displayed subset of events to emphasize a value that would be extracted for the field for the second event by applying the modified extraction rule to the second event. ### Claim 20 (depends on 13) The system of claim 13, further comprising: receiving a label for the field corresponding to the extraction rule; and using the label for the field to search for an event via the field. ### Claim 21 (depends on 13) The system of claim 13, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and displaying one or more unique field values in the set of unique field values. ### Claim 22 (depends on 13) The system of claim 13, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and displaying a statistic for one or more unique field values in the set of unique field values. ### Claim 23 (depends on 13) The system of claim 13, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and displaying a statistic for one or more unique field values in the set of unique field values, wherein the statistic includes a count of events in which the unique field value appears as the value for the field or a percentage of events in which the unique field value appears as the value for the field. ### Claim 24 (depends on 13) The system of claim 13, further comprising: identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; receiving a selection of a unique field value in the set of unique field values; and displaying only events in the subset of events for which the extraction rule would extract the selected unique filed value when applied to the events. ### Claim 25 A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to: receive raw machine data; generate, using one or more processors, a set of events, wherein each event in the set of events includes a portion of the raw machine data; associate a time with each event in the set of events, the time for each event extracted from the raw machine data included in that event; store the set of events in a data store such that they are searchable at least by their associated times; cause display of an extraction rule, wherein the extraction rule specifies how to extract a value for a field from raw machine data included in an event; cause display of a subset of events of the set of events; visually emphasize in the displayed subset of events a value for the field that would be extracted from each of the events in the subset of events by applying the extraction rule; receive input indicating that the emphasized value in a given event in the subset of events should not be the value extracted for the field for the given event; based on the input indicating that the emphasized value should not be the value for the field for the given event, automatically modify the extraction rule so that it would extract a different value as a value for the field for the given event when applied to the given event; and modify the displayed given event to visually emphasize the different value for the field for the given event. ### Claim 26 (depends on 25) The computer-program product of claim 25, wherein the extraction rule includes a regular expression. ### Claim 27 (depends on 25) The computer-program product of claim 25, wherein the raw machine data includes log data. ### Claim 28 (depends on 25) The computer-program product of claim 25, further comprising displaying the modified extraction rule. ### Claim 29 (depends on 25) The computer-program product of claim 25, wherein the extraction rule is received from a user through manual keyboard input. ### Claim 30 (depends on 25) The computer-program product of claim 25, wherein the extraction rule is automatically generated to extract as the value for the field for a displayed event text that a user has selected in the event.