# US 11,442,924 B2 · Selective filtered summary graph

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,442,924 B2
- Document ID: US11442924B2
- Status: Granted
- Kind: B2
- Application number: 16/260,985
- Filed: 2019-01-29
- Published: 2019-05-23
- Granted: 2022-09-13
- Earliest claimed: 2015-01-30
- Assignees: Splunk Inc.
- Applicants: Splunk Inc.
- Inventors: Jesse Miller; Marc V. Robichaud; Cory Burke; Jeffrey Thomas Lloyd; Alexander James; Andrew Robbins
- Web page: https://patentgrep.com/patent/US11442924B2

## CPC

- G06F 16/2372: {Updates performed during offline database operations}
- G06F 3/0482: Interaction with lists of selectable items, e.g. menus
- G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
- G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence)
- G06F 16/00: Information retrieval; Database structures therefor; File system structures therefor
- G06F 16/23: Updating
- G06F 16/235: {Update request formulation}
- G06F 16/2423: {Interactive query statement specification based on a database schema}
- G06F 16/24544: {Join order optimisation}
- G06F 16/24564: {Applying rules; Deductive queries}
- G06F 16/2477: {Temporal data queries}
- G06F 16/26: Visual data mining; Browsing structured data
- G06F 16/33: Querying
- G06F 16/3334: {Selection or weighting of terms from queries, including natural language queries}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 40/174: Form filling; Merging
- G06F 40/177: of tables; using ruled lines
- G06F 40/186: Templates
- G06Q 10/00: Administration; Management
- G06T 11/26: Drawing of charts or graphs
- G06Q 10/10: Office automation; Time management
- G06T 2200/24: involving graphical user interfaces [GUIs]
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL

## Abstract

In some embodiments, a method may include display of a data summary view of a set of events that correspond to query results of a query. Each event of the set of events may include data items of a plurality of event attributes. In embodiments, the data summary view can include various summary reports. Each summary report can include summary entries and a summary graph that each present a summary of data items of a selected event attribute, of the plurality of event attributes. At least one summary report can include summary entries that are selectable by a user. The method may further include filtering the set of event, in response to, and based on, selection of one or more of the selectable summary entries by the user and updating of at least the first and second summary graphs to correspond to the filtered set of events.

## Claims

### Claim 1

A computer-implemented method, comprising:
causing display of a data summary view of events that correspond to query results of a query, the displayed data summary view including a summary report having a summary graph that plots changes over time of a measure of how frequently one or more values of an event attribute associated with the events appeared in the events, the summary report further having one or more summary entries that represent the one or more values of the event attribute and are selectable; and
in response to detecting a click or a tap on one of the summary entries that represents a particular value of the one or more values:
determining a filtered set of the events that have the particular value within the event attribute; and
updating the summary graph to plot changes over time of the measure of how frequently a set of the one or more values appeared in the filtered set of the events.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the displayed data summary view further includes an additional summary report having an additional summary graph that plots changes over time of the measure of how frequently additional values of an additional event attribute associated with the events appeared in the events, wherein the click or the tap further causes the additional summary graph to correspond to the filtered set of the events.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein determining the filtered set of the events comprises using a filter that is based on the particular value.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the summary entry includes a textual representation of the particular value, the method further comprising highlighting the textual representation of the particular value in the summary entry in response to a pointer rolling over the textual representation, wherein the click or the tap is on the textual representation of the particular value while the highlighting is present.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising, upon detecting the click or the tap on the summary entry, emphasizing the summary entry in the summary report.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the one or more values represented by the summary graph comprise statistically derived values comprising one or more of a maximum value, a minimum value, a standard deviation value, or an average value.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein the summary graph is interactive to enable selection of the particular value.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, wherein the summary entries identify one or more of the one or more values that occur above an upper occurrence threshold.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein the summary entries identify one or more of the one or more values that occur below a lower occurrence threshold.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1, wherein the summary entries identify one or more of the one or more values that are beyond a threshold of similarity from others of the one or more values.

### Claim 11 (depends on 1)

The computer-implemented method of claim 1, wherein the summary entries include summary statistics based on a data type of the summary entries, and wherein the summary statistics for a numeric data type include one or more of: a maximum value, a minimum value, a mean value, a median value, a mode value, or a standard deviation.

### Claim 12 (depends on 1)

The computer-implemented method of claim 1, further comprising causing a filter that was used to generate the set of the events to be saved, and causing filtering of a different set of events using the filter.

### Claim 13 (depends on 1)

The computer-implemented method of claim 1, further comprising:
causing a filter that was used to generate the set of the events to be saved as metadata associated with the query; and
causing filtering of an updated set of events using the metadata.

### Claim 14 (depends on 1)

The computer-implemented method of claim 1, further comprising causing, in response to selection of at least one of the summary entries, one or more commands to be added to a command entry list, the command entry list defining the query.

### Claim 15 (depends on 1)

The computer-implemented method of claim 1, wherein the causing of the display of the data summary view is in response to receiving a request to display the data summary view of the query results, the request being received while the query results are displayed in a table format within a user interface, the table format including:
rows, each row representing one of the query results corresponding to one of the events; and
columns forming cells with the rows, each column representing a respective event attribute associated with the events and including data items of the respective event attribute populating ones of the cells.

### Claim 16 (depends on 1)

The computer-implemented method of claim 1, further comprising, in response to detecting the click or the tap on the summary entry:
causing display of selectable filter options, the selectable filter options based on a respective data type of the summary entry, wherein the set of the events are filtered in accordance with a selected one of the selectable filter options.

### Claim 17

One or more non-transitory computer-readable media having instructions stored thereon, the instructions to cause a computing device, in response to execution of the instructions by the computing device, to perform a method comprising:
causing display of a data summary view of events that correspond to query results of a query, the displayed data summary view including a summary report having a summary graph that plots changes over time of a measure of how frequently one or more values of an event attribute associated with the events appeared in the events, the summary report further having one or more summary entries that represent the one or more values of the event attribute and are selectable; and
in response to detecting a click or a tap on one of the summary entries that represents a particular value of the one or more values:
determining a filtered set of the events that have the particular value within the event attribute; and
updating the summary graph to plot changes over time of the measure of how frequently a set of the one or more values appeared in the filtered set of the events.

### Claim 18 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein the displayed data summary view further includes an additional summary report having an additional summary graph that plots changes over time of the measure of how frequently additional values of an additional event attribute associated with the events appeared in the events, wherein the click or the tap further causes the additional summary graph to correspond to the filtered set of the events.

### Claim 19 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein determining the filtered set of the events comprises using a filter that is based on the particular value.

### Claim 20 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein the summary entry includes a textual representation of the particular value, the method further comprising highlighting the textual representation of the particular value in the summary entry in response to a pointer rolling over the textual representation, wherein the click or the tap is on the textual representation of the particular value while the highlighting is present.

### Claim 21 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, the method further comprising, upon detecting the click or the tap on the summary entry, emphasizing the summary entry in the summary report.

### Claim 22 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein the one or more values represented by the summary graph comprise statistically derived values comprising one or more of a maximum value, a minimum value, a standard deviation value, or an average value.

### Claim 23 (depends on 17)

The one or more non-transitory computer-readable media of claim 17, wherein the summary graph is interactive to enable selection of the particular value.

### Claim 24

A computing device comprising:
one or more processors, and
one or more computer-readable media coupled with the one or more processors, the one or more non-transitory computer readable media having instructions stored thereon, the instructions to cause the computing device, in response to execution of the instructions by the one or more processors, to perform a method comprising:
causing display of a data summary view of events that correspond to query results of a query, the displayed data summary view including a summary report having a summary graph that plots changes over time of a measure of how frequently one or more values of an event attribute associated with the events appeared in the events, the summary report further having one or more summary entries that represent the one or more values of the event attribute and are selectable; and
in response to detecting a click or a tap on one of the summary entries that represents a particular value of the one or more values:
determining a filtered set of the events that have the particular value within the event attribute; and
updating the summary graph to plot changes over time of the measure of how frequently a set of the one or more values appeared in the filtered set of the events.

### Claim 25 (depends on 24)

The computing device of claim 24, wherein the displayed data summary view further includes an additional summary report having an additional summary graph that plots changes over time of the measure of how frequently additional values of an additional event attribute associated with the events appeared in the events, wherein the click or the tap further causes the additional summary graph to correspond to the filtered set of the events.

### Claim 26 (depends on 24)

The computing device of claim 24, wherein determining the filtered set of the events comprises using a filter that is based on the particular value.

### Claim 27 (depends on 24)

The computing device of claim 24, wherein the summary entry includes a textual representation of the particular value, the method further comprising highlighting the textual representation of the particular value in the summary entry in response to a pointer rolling over the textual representation, wherein the click or the tap is on the textual representation of the particular value while the highlighting is present.

### Claim 28 (depends on 24)

The computing device of claim 24, the method further comprising, upon detecting the click or the tap on the summary entry, emphasizing the summary entry in the summary report.

### Claim 29 (depends on 24)

The computing device of claim 24, wherein the one or more values represented by the summary graph comprise statistically derived values comprising one or more of a maximum value, a minimum value, a standard deviation value, or an average value.

### Claim 30 (depends on 24)

The computing device of claim 24, wherein the summary graph is interactive to enable selection of the particular value.