Back to results
US 11,238,033 B1Granted
Interactive location queries for raw machine data
AssigneeSplunk Inc.
InventorsMichael Porath, Siegfried Puchbauer-Schnabel
Life of this patent
Estimating the term…
Abstract
A data intake and query system may store raw machine data that includes location information. A client system may include a user interface for searching the data intake and query system. The user interface allows a user to define a field search query and to define one or more ad-hoc boundary regions on a map. A combined query is transmitted to the data intake and query system, the combined query including both the field search query and location search information that is based on the ad-hoc boundary regions. The data intake and query system runs the combined query and returns responsive results, which are displayed at the client user interface.
Claims27
A computer-implemented method for providing a user interface for an interactive data query, comprising:
- receiving a set of results from a data query system, wherein the received results are responsive to a combined query based on a field search query for searching raw machine data and location search information designating a boundary region for searching the raw machine data, and wherein individual results within the set of results identify a value from the raw machine data and a timestamp corresponding to the value;
- displaying a visualization of the set of results as an ordering of the set of results over a time range, wherein the visualization comprises a plurality of horizontally divided bars, each horizontally divided bar being horizontally divided to include a plurality of portions vertically arranged with respect to one another and corresponding to a different subrange of the time range and representing results, within the set of results, associated with the subrange of the horizontally divided bar, wherein a first vertically arranged portion of each horizontally divided bar indicates results that are associated with the boundary region, wherein a second vertically arranged portion of each horizontally divided bar indicates results not associated with the boundary region, wherein the ordering is determined based at least in part on the timestamps identified within the results, and wherein a portion of the visualization is selectable to indicate an individual subrange of the time range;
- obtaining a selection of the portion of the visualization;
- and
- displaying a subset, of the set of results, that identify a timestamp within the individual subrange.
2 more elements
A system comprising:
- a physical data store including instructions executable by a processor;
- and
- a processor configured to execute the instructions to:
- receive a set of results from a data query system, wherein the received results are responsive to a combined query based on a field search query for searching raw machine data and location search information designating a boundary region for searching the raw machine data, and wherein individual results within the set of results identify a value from the raw machine data and a timestamp corresponding to the value;
- display a visualization of the set of results as an ordering of the set of results over a time range, wherein the visualization comprises a plurality of horizontally divided bars, each horizontally divided bar being horizontally divided to include a plurality of portions vertically arranged with respect to one another and corresponding to a different subrange of the time range and representing results, within the set of results, associated with the subrange of the horizontally divided bar, wherein a first vertically arranged portion of each horizontally divided bar indicates results that are associated with the boundary region, wherein a second vertically arranged portion of each horizontally divided bar indicates results not associated with the boundary region, wherein the ordering is determined based at least in part on the timestamps identified within the results, and wherein a portion of the visualization is selectable to indicate an individual subrange of the time range;
- obtain a selection of the portion of the visualization;
- and
- display a subset, of the set of results, that identify a timestamp within the individual subrange of the time range.
5 more elements
Non-transitory computer-readable media comprising instructions executable by a computing system to:
- receive a set of results from a data query system, wherein the received results are responsive to a combined query based on a field search query for searching raw machine data and location search information designating a boundary region for searching the raw machine data, and wherein individual results within the set of results identify a value from the raw machine data and a timestamp corresponding to the value;
- display a visualization of the set of results as an ordering of the set of results over a time range, wherein the visualization comprises a plurality of horizontally divided bars, each horizontally divided bar being horizontally divided to include a plurality of portions vertically arranged with respect to one another and corresponding to a different subrange of the time range and representing results, within the set of results, associated with the subrange of the horizontally divided bar, wherein a first vertically arranged portion of each horizontally divided bar indicates results that are associated with the boundary region, wherein a second vertically arranged portion of each horizontally divided bar indicates results not associated with the boundary region, wherein the ordering is determined based at least in part on the timestamps identified within the results, and wherein a portion of the visualization is selectable to indicate an individual subrange of the time range;
- obtain a selection of the portion of the visualization;
- and
- display a subset, of the set of results, that identify a timestamp within the individual subrange of the time range.
2 more elements
Dependencies are inferred from the claim text.