# US 11,907,244 B2 · Modifying field definitions to include post-processing instructions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,244 B2 - Document ID: US11907244B2 - Status: Granted - Kind: B2 - Application number: 17/809,837 - Filed: 2022-06-29 - Published: 2022-10-13 - Granted: 2024-02-20 - Earliest claimed: 2013-07-31 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Michael Kinsely; Alex Raitz; John Robert Coates; Shirley Wu - Web page: https://patentgrep.com/patent/US11907244B2 ## CPC - G06F 16/254: {Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A field extraction template simplifies the creation of field extraction rules by providing a user with a set of field names commonly assigned to a certain type of data, as well as guidance on how to extract values for those fields. These field extraction rules, in turn, facilitate access to certain “chunks” of the data, or to information derived from those chunks, through named fields. A field extraction template comprises at least a set of field names and ordering data for the field names. The ordering data indicates index positions that are associated with at least some of the field names. A delimiter is specified for splitting data items into arrays of chunks. The chunk of a data item that belongs to a given field name is the chunk whose position within the item's array of chunks is equivalent to the index position associated with the given field name. ## Claims ### Claim 1 A method comprising: causing a user interface to be displayed that displays a list of a plurality of templates, each template of the plurality of templates including a set of rules for parsing fields from log files, each of the log files including raw data corresponding to a data item of a set of data items; receiving a selection of a particular template from the list of the plurality of templates; identifying at least one sample data item; causing display of a preview of a set of field values with associated field names, the preview graphically depicting a segmentation of the set of field values with the associated field names, the set of field values and the associated field names parsed from the at least one sample data item using index positions and delimiters corresponding to respective associated field names included in a respective set of rules of the particular template; causing display of a post-processing control; receiving an input, via the post-processing control, to define a post-processing instruction in association with a particular field corresponding with a field value of the set of field values; based on receiving the input, updating the particular template to create an updated rule from among the respective set of rules that is associated with the particular field corresponding with the field value, the updated rule including the post-processing instruction. ### Claim 2 (depends on 1) The method of claim 1, further comprising: extracting field values from the set of data items using the respective set of rules for parsing fields from log files included in the updated particular template; and executing a search across the extracted field values. ### Claim 3 (depends on 1) The method of claim 1, further comprising: extracting field values from the set of data items using the respective set of rules for parsing fields from log files included in the updated particular template; executing a search across the extracted field values to obtain a search result; and causing display of information relating to the search result. ### Claim 4 (depends on 1) The method of claim 1, wherein the displayed associated field names are determined based on an analysis of the log files. ### Claim 5 (depends on 1) The method of claim 1, wherein the segmentation is based on the delimiters corresponding to the respective associated field names included in the respective set of rules of the particular template for segmenting the set of data items into ordered sets of data chunks. ### Claim 6 (depends on 1) The method of claim 1, wherein the post-processing rule includes at least one of removing one or more leading characters or removing one or more trailing characters. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of templates are selected to be displayed based on a source of the set of data items. ### Claim 8 (depends on 1) The method of claim 1, wherein the set of data items are time-stamped events. ### Claim 9 (depends on 1) The method of claim 1, further comprising: causing display of a graphical control for reordering one or more of the associated field names; receiving an input that reassigns at least one associated field name of the respective associated field names to at least one different field value of the set of field values, the input received using the graphical control; and based on the receiving the input, updating the particular template to create an updated rule among the respective set of rules that is associated with the at least one reassigned associated field name, the updated rule including an updated index position and an updated delimiter corresponding to the at least one different field value, the updated rule being applied to the set of data items when a search query is executed that references the at least one reassigned associated field name. ### Claim 10 (depends on 1) The method of claim 1, wherein the updated rule includes removing of one or more characters associated with the particular field. ### Claim 11 (depends on 1) The method of claim 1, wherein the updated rule includes at least one of concatenating two fields into one field or separating one field into two fields. ### Claim 12 (depends on 1) The method of claim 1, wherein the post-processing control is displayed based on selection of the particular field. ### Claim 13 (depends on 1) The method of claim 1, wherein the post-processing control includes a character input control used to input a number of characters to remove. ### Claim 14 (depends on 1) The method of claim 1, wherein the post-processing control includes a character input control used to input a number of characters to remove, wherein the character input control includes a character input field having number of characters to remove is pre-populated with an expected value. ### Claim 15 (depends on 1) The method of claim 1, wherein the post-processing control includes a character input control used to input a number of characters to remove, wherein the character input control includes a character input field having the number of characters to remove being populated based on received input indicating one or more of characters in the particular field. ### Claim 16 (depends on 1) The method of claim 1, wherein the post-processing control includes a character input control used to indicate a number of characters to remove and a leading/trailing input used to indicate whether the number of characters to remove are in the leading portion of the trailing portion. ### Claim 17 One or more non-transitory computer-readable medium, storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform: causing a user interface to be displayed that displays a list of a plurality of templates, each template of the plurality of templates including a set of rules for parsing fields from log files, each of the log files including raw data corresponding to a data item of a set of data items; receiving a selection of a particular template from the list of the plurality of templates; identifying at least one sample data item; causing display of a preview of a set of field values with associated field names, the preview graphically depicting a segmentation of the set of field values with the associated field names, the set of field values and the associated field names parsed from the at least one sample data item using index positions and delimiters corresponding to respective associated field names included in a respective set of rules of the particular template; causing display of a post-processing control; receiving an input, via the post-processing control, to define a post-processing instruction in association with a particular field corresponding with a field value of the set of field values; based on receiving the input, updating the particular template to create an updated rule from among the respective set of rules that is associated with the particular field corresponding with the field value, the updated rule including the post-processing instruction. ### Claim 18 (depends on 17) The one or more non-transitory computer-readable medium of claim 17, wherein the post-processing control includes a character input control used to indicate a number of characters to remove and a leading/trailing input used to indicate whether the number of characters to remove are in the leading portion of the trailing portion. ### Claim 19 An apparatus, comprising: one or more processors; and one or more memory devices storing instructions, which when executed by the one or more processors, cause the one or more processors to: cause a user interface to be displayed that displays a list of a plurality of templates, each template of the plurality of templates including a set of rules for parsing fields from log files, each of the log files including raw data corresponding to a data item of a set of data items; receive a selection of a particular template from the list of the plurality of templates; identify at least one sample data item; cause display of a preview of a set of field values with associated field names, the preview graphically depicting a segmentation of the set of field values with the associated field names, the set of field values and the associated field names parsed from the at least one sample data item using index positions and delimiters corresponding to respective associated field names included in a respective set of rules of the particular template; cause display of a post-processing control; receive an input, via the post-processing control, to define a post-processing instruction in association with a particular field corresponding with a field value of the set of field values; based on receiving the input, update the particular template to create an updated rule from among the respective set of rules that is associated with the particular field corresponding with the field value, the updated rule including the post-processing instruction. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the updated rule includes removing of one or more characters associated with the particular field.