# US 12,182,174 B1 · Exploratory data analysis system for generation of wildcards within log templates through log clustering and analysis thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,174 B1 - Document ID: US12182174B1 - Status: Granted - Kind: B1 - Application number: 18/147,639 - Filed: 2022-12-28 - Granted: 2024-12-31 - Earliest claimed: 2022-12-28 - Assignees: Splunk Inc. - Applicants: SPLUNK Inc. - Inventors: Francis Beckert; Kristal Curtis; Om Rajyaguru; Abraham Starosta; Poonam Yadav - Web page: https://patentgrep.com/patent/US12182174B1 ## CPC - G06F 16/285: {Clustering or classification} - G06F 16/248: Presentation of query results - G06F 16/9577: {Optimising the visualization of content, e.g. distillation of HTML documents} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A search assistant engine is described that integrates with a data intake and query system and provides an intuitive user interface to assist a user in searching and evaluating indexed event data. Additionally, the search assistant engine provides logic to intelligently provide data to the user through the user interface such as determining fields of events likely to be of interest based on determining a mutual information score for each field and determining groups of related fields based on determining a mutual information score for each field grouping. Some implementations utilize machine learning techniques in certain analyses such as when clustering events and determining an event templates for each cluster. Additionally, the search assistant engine may import terms or characters from user interaction into predetermined search query templates to generate tailored search query for the user. ## Claims ### Claim 1 A computerized method comprising: obtaining a plurality of events; generating a cluster assignment for each event of the plurality of events, wherein the generating of the cluster assignment includes assigning one or more events of the plurality of events to each of a plurality of clusters of events including a first cluster of events and a second cluster of events; generating an event template for each of the plurality of clusters, wherein the generating of the event template includes operations of: extracting a set of static terms and a set of wildcards within the one or more events of the event template, determining event fields that correspond to each of the set of wildcards, and populating the event template with the set of static terms and the event fields corresponding to each of the set of wildcards, wherein an ordering of the static terms and the event fields corresponds to an order of terms of the plurality of events; causing a first display of the event template for each of the plurality of clusters of events on a user interface rendered on a display screen of a network device; and responsive to selection of a first event template associated with the first cluster of events, generating a second display configured to render a visual measure for identifying a level or amount of information that a first event of the event fields associated with the first cluster of events provides about other event fields of the first cluster of events. ### Claim 2 (depends on 1) The computerized method of claim 1, wherein the obtaining of the plurality of events comprises: obtaining event data including at least the plurality of events; and determining the cluster assignment for each event of the event data, wherein each event of the plurality of events is assigned to one of the plurality of clusters of events. ### Claim 3 (depends on 1) The computerized method of claim 1, wherein the generating of the cluster assignment for each event of the plurality of events includes processing at least the plurality of events with a trained machine learning model configured to assign each event of the plurality of events to any of one or more clusters of events, wherein the one or more clusters of events includes the first cluster of events. ### Claim 4 (depends on 1) The computerized method of claim 1, wherein the generating of the cluster assignment for each event of the plurality of events is based on how lexically similar each event of the plurality of events is to other events of event data including the plurality of events. ### Claim 5 (depends on 1) The computerized method of claim 1, wherein each event of the plurality of events is a discrete portion of machine data that is associated with a timestamp and is comprised of an ordered set of terms and characters. ### Claim 6 (depends on 5) The computerized method of claim 5, wherein each static term of the set of static terms is a term or a character that repeats consistently across the plurality of events in a particular location within the ordered set of terms and characters and content associated with one or more events of the plurality of events are identical in value. ### Claim 7 (depends on 5) The computerized method of claim 5, wherein each wildcard of the set of wildcards is a term that repeats consistently across the plurality of events in a particular location within the ordered set of terms and characters and content associated with one or more events of the plurality of events differ in value. ### Claim 8 A computing device, comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including: obtaining a plurality of events; generating a cluster assignment for each event of the plurality of events, wherein the generating of the cluster assignment includes assigning one or more events of the plurality of events to each of a plurality of clusters of events including a first cluster of events and a second cluster of events; generating an event template for each of the plurality of clusters, wherein the generating of the event template includes operations of: extracting a set of static terms and a set of wildcards within the one or more events of the event template, determining event fields that correspond to each of the set of wildcards, and populating the event template with the set of static terms and the event fields corresponding to each of the set of wildcards, wherein an ordering of the static terms and the event fields corresponds to an order of terms of the plurality of events; causing a first display of the event template for each of the plurality of clusters of events on a user interface rendered on a display screen of a network device; and responsive to selection of a first event template associated with the first cluster of events, generating a second display configured to render a visual measure for identifying a level or amount of information that a first event of the event fields associated with the first cluster of events provides about other event fields of the first cluster of events. ### Claim 9 (depends on 8) The computing device of claim 8, wherein the obtaining of the plurality of events comprises: obtaining event data including at least the plurality of events; and determining the cluster assignment for each event of the event data, wherein each event of the plurality of events is assigned to one of the plurality of clusters of events. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the generating of the cluster assignment for each event of the plurality of events is based on how lexically similar each event of the plurality of events is to other events of event data including the plurality of events. ### Claim 11 (depends on 8) The computing device of claim 8, wherein the generating of the cluster assignment for each event of the plurality of events includes processing at least the plurality of events event data with a trained machine learning model configured to assign each event of the plurality of events to any of one or more clusters of events, wherein the one or more clusters of events includes the first cluster of events. ### Claim 12 (depends on 8) The computing device of claim 8, wherein each event of the plurality of events is a discrete portion of machine data that is associated with a timestamp and is comprised of an ordered set of terms and characters. ### Claim 13 (depends on 12) The computing device of claim 12, wherein each static term of the set of static terms is a term or a character that repeats consistently across the plurality of events in a particular location within the ordered set of terms and characters. ### Claim 14 (depends on 12) The computing device of claim 12, wherein each wildcard of the set of wildcards is a term that repeats consistently across the plurality of events in a particular location within the ordered set of terms and characters and content associated with one or more events of the plurality of events are identical in value. ### Claim 15 A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including: obtaining a plurality of events; generating a cluster assignment for each event of the plurality of events, wherein the generating of the cluster assignment includes assigning one or more events of the plurality of events to each of a plurality of clusters of events including a first cluster of events and a second cluster of events; generating an event template for each of the plurality of clusters, wherein the generating of the event template includes operations of: extracting a set of static terms and a set of wildcards within the one or more events of the event template, determining event fields that correspond to each of the set of wildcards, and populating the event template with the set of static terms and the event fields corresponding to each of the set of wildcards, wherein an ordering of the static terms and the event fields corresponds to an order of terms of the plurality of events; causing a first display of the event template for each of the plurality of clusters of events on a user interface rendered on a display screen of a network device; and responsive to selection of a first event template associated with the first cluster of events, generating a second display configured to render a visual measure for identifying a level or amount of information that a first event of the event fields associated with the first cluster of events provides about other event fields of the first cluster of events. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the obtaining of the plurality of events comprises: obtaining event data including at least the plurality of events; and determining the cluster assignment for each event of the event data, wherein each event of the plurality of events is assigned to one of the plurality of clusters of events. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the generating of the cluster assignment for each event of the plurality of events is based on how lexically similar each event of the plurality of events is to other events of event data including the plurality of events. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the generating of the cluster assignment for each event of the plurality of events includes processing at least the plurality of events event data with a trained machine learning model configured to assign each event of the plurality of events to any of one or more clusters of events, wherein the one or more clusters of events includes the first cluster of events. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein each event of the plurality of events is a discrete portion of machine data that is associated with a timestamp and is comprised of an ordered set of terms and characters. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein each static term of the set of static terms is a term or a character that repeats consistently across the plurality of events in a particular location within the ordered set of terms and characters, and wherein each wildcard of the set of wildcards is a term that repeats consistently across the plurality of events in a particular location within the ordered set of terms and characters.