Back to results
US 11,106,713 B2Granted
Sampling data using inverted indexes in response to grouping selection
AssigneeSplunk Inc.
InventorsJesse Miller, Jason Szeto, Jose Solis, Jindrich Dinga, David Marquardt
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for sampling a set of data using inverted indexes in response to a user interaction with a user interface. Based on the user interaction with a displayed grouping of a summarization of a set of data, the system uses filter criteria corresponding to the grouping to review one or more inverted indexes and identify a sample of events for analysis. The system then accesses the sample of events and provides the results for display to a user.
Claims26
A method, comprising:
- in response to executing a query that includes first filter criteria and categorization criteria, causing display of a plurality of interactive, categorized groupings based on the first filter criteria and the categorization criteria, wherein the first filter criteria identifies a set of data processed as part of the query and the categorization criteria identifies a manner of categorizing the set of data as part of the query, wherein each of the plurality of groupings includes a plurality of events that share a common at least two of host, source, source type or partition of the categorization criteria, and wherein the plurality of events of each of the plurality of groupings satisfy first filter criteria;
- in response to an interaction with a display object associated with a particular grouping of the plurality of groupings, reviewing a plurality of inverted indexes to identify event references corresponding to events that satisfy the first filter criteria and second filter criteria, wherein the second filter criteria is based on the particular grouping, and wherein the event references correspond to a subset of the set of data processed as part of the query;
- identifying a subset of events of the events corresponding to a subset of the event references for processing;
- accessing the subset of events;
- processing the subset of events;
- and
- providing results of the processing of the subset of events for display to a user.
4 more elements
A system comprising:
- a memory;
- and
- a processing device communicatively coupled with the memory and configured to:
- in response to executing a query that includes first filter criteria and categorization criteria, cause display of a plurality of interactive, categorized groupings based on the first filter criteria and the categorization criteria, wherein the first filter criteria identifies a set of data processed as part of the query and the categorization criteria identifies a manner of categorizing the set of data as part of the query, wherein each of the plurality of groupings includes a plurality of events that share a common at least two of host, source, source type or partition of the categorization criteria, and wherein the plurality of events of each of the plurality of groupings satisfy first filter criteria;
- in response to an interaction with a display object associated with a particular grouping of the plurality of groupings, review a plurality of inverted indexes to identify event references corresponding to events that satisfy the first filter criteria and second filter criteria, wherein the second filter criteria is based on the particular grouping, and wherein the event references correspond to a subset of the set of data processed as part of the query;
- identify a subset of events of the events corresponding to a subset of the event references for processing;
- access the subset of events;
- process the subset of events;
- and
- provide results of the processing of the subset of events for display to a user.
7 more elements
A non-transitory computer-readable medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
- in response to executing a query that includes first filter criteria and categorization criteria, causing display of a plurality of interactive, categorized groupings based on the first filter criteria and the categorization criteria, wherein the first filter criteria identifies a set of data processed as part of the query and the categorization criteria identifies a manner of categorizing the set of data as part of the query, wherein each of the plurality of groupings includes a plurality of events that share a common at least two of host, source, source type or partition of the categorization criteria, and wherein the plurality of events of each of the plurality of groupings satisfy first filter criteria;
- in response to an interaction with a display object associated with a particular grouping of the plurality of groupings, reviewing a plurality of inverted indexes to identify event references corresponding to events that satisfy the first filter criteria and second filter criteria, wherein the second filter criteria is based on the particular groupings and wherein the event references correspond to a subset of the set of data processed as part of the query;
- identifying a subset of events of the events corresponding to a subset of the event references for processing;
- accessing the subset of events;
- processing the subset of events;
- and
- providing results of the processing of the subset of events for display to a user.
4 more elements
Dependencies are inferred from the claim text.