US 12,111,874 B1 · Exploratory data analysis system for automated generation of search queries using machine learning techniques to identify certain log fields and correlation thereof

Abstract

Implementations of this disclosure provide a search assistant engine that integrates with a data intake and query system and provides an intuitive user interface to assist a user in searching and evaluating indexed event data. Additionally, the search assistant engine provides logic to intelligently provide data to the user through the user interface such as determining fields of events likely to be of interest based on determining a mutual information score for each field and determining groups of related fields based on determining a mutual information score for each field grouping. Some implementations utilize machine learning techniques in certain analyses such as when clustering events and determining an event templates for each cluster. Additionally, the search assistant engine may import terms or characters from user interaction into predetermined search query templates to generate tailored search query for the user.

Claims20

Dependent claims

A computerized method comprising:

obtaining event data including a plurality of events;
determining a set of fields present in events comprising the plurality of events;
determining a mutual information score for a plurality of fields included within the set of fields, wherein the mutual information score for the plurality of fields identifies a level of diversity between values included in the plurality of fields;
causing display of a user interface that illustrates at least a portion of the mutual information score for the plurality of fields;
receiving user input through the user interface indicating selection of a first field of the plurality of fields of the set of fields;
and
importing the selected first field into a predetermined search query template thereby generating a tailored search query.

4 more elements

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations comprising:

obtaining event data including a plurality of events;
determining a set of fields present in events comprising the plurality of events;
determining a mutual information score for a plurality of fields included within the set of fields, wherein the mutual information score for the plurality of fields identifies a level of diversity between values included in the plurality of fields;
causing display of a user interface that illustrates at least a portion of the mutual information score for the plurality of fields;
receiving user input though the user interface indicating selection of a first field of the plurality of fields of the set of fields;
and
importing the selected first field into a predetermined search query template thereby generating a tailored search query.

4 more elements

Dependencies are inferred from the claim text.

Exploratory data analysis system for automated generation of search queries using machine learning techniques to identify certain log fields and correlation thereof

Life of this patent

Exploratory data analysis system for automated generation of search queries using machine learning techniques to identify certain log fields and correlation thereof

Life of this patent

Abstract

Claims20