# US 2014/0208218 A1 · Real time display of statistics and values for selected regular expressions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0208218 A1
- Document ID: US20140208218A1
- Status: Published application
- Kind: A1
- Application number: 13/748,360
- Filed: 2013-01-23
- Published: 2014-07-24
- Earliest claimed: 2013-01-23
- Assignees: Splunk Inc.
- Applicants: Splunk Inc.
- Inventors: R. David Carasso; Micah James Delfino; Johnvey Hwang
- Web page: https://patentgrep.com/patent/US20140208218A1

## CPC

- G06F 16/287: {Visualization; Browsing}
- G06F 3/0482: Interaction with lists of selectable items, e.g. menus
- G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence)
- G06F 16/248: Presentation of query results
- G06F 16/332: Query formulation
- G06F 16/334: Query execution (filtering based on additional data G06F16/335)
- G06F 16/338: Presentation of query results
- G06F 16/34: Browsing; Visualisation therefor (browsing or visualisation for clustering or classification G06F16/358)
- G06F 16/93: Document management systems
- G06F 16/951: Indexing; Web crawling techniques
- G06F 40/166: Editing, e.g. inserting or deleting
- G06F 40/169: Annotation, e.g. comment data or footnotes
- G06F 40/174: Form filling; Merging
- G06Q 10/00: Administration; Management
- G06Q 10/0637: Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
- Y04S 10/50: Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS

## Abstract

Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

## Claims

### Claim at position 1

1-30. (canceled)

### Claim 31

A computer-implemented method, comprising:
receiving raw data;
storing a set of events for a computing system, wherein each event in the set includes unstructured data, and wherein each event is derived from the raw data;
applying an extraction rule to the set of events, wherein the extraction rule defines a field within one or more of the events from which to extract a value that comprises a portion of the raw data in an event;
extracting one or more values from the field of the events using the extraction rule;
displaying one or more of the events in a first portion of a graphical interface, wherein the one or more values extracted from the field of the events are emphasized in the one or more events displayed in the first portion of the graphical interface;
displaying a subset of the one or more extracted values in a second portion of the graphical interface;
determining a statistic for one or more of the extracted values in the subset; and
displaying the statistic in the second portion of the graphical interface, wherein the second portion and the first portion are concurrently displayed in the same graphical interface.

### Claim 32 (depends on 31)

The method of claim 31, wherein the unstructured data includes machine data.

### Claim 33 (depends on 31)

The method of claim 31, wherein displaying the subset of the one or more extracted values in the second portion of the graphical interface includes displaying unique values in the second portion of the graphical interface.

### Claim 34 (depends on 31)

The method of claim 31, wherein the statistic includes a percentage of the set of events in which the one or more extracted values appear in the field defined by the extraction rule.

### Claim 35 (depends on 31)

The method of claim 31, further comprising:
receiving input corresponding to a selection of a value from the extracted values displayed in the first or second portion of the graphical interface;
determining a subset of the set of events in response to receiving the selection, wherein each event of the subset includes an extracted value that matches the selected value; and
modifying the display of the one or more of the events in the first portion of the graphical interface to display the subset of the set of events and to hide events that do not include an extracted value that matches the selected value.

### Claim 36 (depends on 31)

The method of claim 31, wherein the extraction rule includes a regular expression rule.

### Claim 37 (depends on 31)

The method of claim 31, wherein the extraction rule includes a regular expression rule automatically generated to extract a value selected from an event.

### Claim 38 (depends on 31)

The method of claim 31, wherein the extraction rule is editable, the method further comprising:
receiving input corresponding to an edit of the extraction rule;
modifying the display of the one or more of the events in the first portion of the graphical interface to emphasize one or more values extracted from a field defined by the edited extraction rule; and
updating the display of the single instance of the one or more of the extracted values in the second portion of the graphical interface to reflect the values extracted from the field defined by the edited extraction rule.

### Claim 39 (depends on 31)

The method of claim 31, wherein the set of events is a sample subset of a larger dataset of events.

### Claim 40 (depends on 31)

The method of claim 31, further comprising:
receiving input corresponding to an edit of the extraction rule; and
dynamically updating in real-time the display of the one or more of the events in the first portion of the graphical interface.

### Claim 41

A system, comprising:
one or more processors; and
one or more non-transitory computer-readable storage media storing instructions configured to cause the one or more processors to perform operations including:
receiving raw data;
storing a set of events for a computing system, wherein each event in the set includes unstructured data, and wherein each event is derived from the raw data;
applying an extraction rule to the set of events, wherein the extraction rule defines a field within one or more of the events from which to extract a value that comprises a portion of the raw data in an event;
extracting one or more values from the field of the events using the extraction rule;
displaying one or more of the events in a first portion of a graphical interface, wherein the one or more values extracted from the field of the events are emphasized in the one or more events displayed in the first portion of the graphical interface;
displaying a subset of the one or more extracted values in a second portion of the graphical interface;
determining a statistic for one or more of the extracted values in the subset; and
displaying the statistic in the second portion of the graphical interface, wherein the second portion and the first portion are concurrently displayed in the same graphical interface.

### Claim 42 (depends on 41)

The system of claim 41, wherein the unstructured data includes machine data.

### Claim 43 (depends on 41)

The system of claim 41, wherein displaying the subset of the one or more extracted values in the second portion of the graphical interface includes displaying unique values in the second portion of the graphical interface.

### Claim 44 (depends on 41)

The system of claim 41, wherein the statistic includes a percentage of the set of events in which the one or more extracted values appear in the field defined by the extraction rule.

### Claim 45 (depends on 41)

The system of claim 41, wherein the non-transitory computer-readable storage medium contains further instructions configured to cause the processor to perform operations including:
receiving input corresponding to a selection of a value from the extracted values displayed in the first or second portion of the graphical interface;
determining a subset of the set of events in response to receiving the selection, wherein each event of the subset includes an extracted value that matches the selected value; and
modifying the display of the one or more of the events in the first portion of the graphical interface to display the subset of the set of events and to hide events that do not include an extracted value that matches the selected value.

### Claim 46 (depends on 41)

The system of claim 41, wherein the extraction rule includes a regular expression rule.

### Claim 47 (depends on 41)

The system of claim 41, wherein the extraction rule includes a regular expression rule automatically generated to extract a value selected from an event.

### Claim 48 (depends on 41)

The system of claim 41, wherein the extraction rule is editable, and wherein the non-transitory computer-readable storage medium contains further instructions configured to cause the processor to perform operations including:
receiving input corresponding to an edit of the extraction rule;
modifying the display of the one or more of the events in the first portion of the graphical interface to emphasize one or more values extracted from a field defined by the edited extraction rule; and
updating the display of the single instance of the one or more of the extracted values in the second portion of the graphical interface to reflect the values extracted from the field defined by the edited extraction rule.

### Claim 49 (depends on 41)

The system of claim 41, wherein the set of events is a sample subset of a larger dataset of events.

### Claim 50 (depends on 41)

The system of claim 41, wherein the extraction rule is editable, and wherein the non-transitory computer-readable storage medium contains further instructions configured to cause the processor to perform operations including:
receiving input corresponding to an edit of the extraction rule; and
dynamically updating in real-time the display of the one or more of the events in the first portion of the graphical interface.

### Claim 51

A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:
receive raw data;
store a set of events for a computing system, wherein each event in the set includes unstructured data, and wherein each event is derived from the raw data;
apply an extraction rule to the set of events, wherein the extraction rule defines a field within one or more of the events from which to extract a value that comprises a portion of the raw data in an event;
extract one or more values from the field of the events using the extraction rule;
display one or more of the events in a first portion of a graphical interface, wherein the one or more values extracted from the field of the events are emphasized in the one or more events displayed in the first portion of the graphical interface;
display a subset of the one or more extracted values in a second portion of the graphical interface;
determine a statistic for one or more of the extracted values in the subset; and
display the statistic in the second portion of the graphical interface, wherein the second portion and the first portion are concurrently displayed in the same graphical interface.

### Claim 52 (depends on 51)

The computer-program product of claim 51, wherein the unstructured data includes machine data.

### Claim 53 (depends on 51)

The computer-program product of claim 51, wherein displaying the subset of the one or more extracted values in the second portion of the graphical interface includes displaying unique values in the second portion of the graphical interface.

### Claim 54 (depends on 51)

The computer-program product of claim 51, wherein the statistic includes a percentage of the set of events in which the one or more extracted values appear in the field defined by the extraction rule.

### Claim 55 (depends on 51)

The computer-program product of claim 51, further including instructions configured to cause the data processing apparatus to:
receive input corresponding to a selection of a value from the extracted values displayed in the first or second portion of the graphical interface;
determine a subset of the set of events in response to receiving the selection, wherein each event of the subset includes an extracted value that matches the selected value; and
modify the display of the one or more of the events in the first portion of the graphical interface to display the subset of the set of events and to hide events that do not include an extracted value that matches the selected value.

### Claim 56 (depends on 51)

The computer-program product of claim 51, wherein the extraction rule includes a regular expression rule.

### Claim 57 (depends on 51)

The computer-program product of claim 51, wherein the extraction rule includes a regular expression rule automatically generated to extract a value selected from an event.

### Claim 58 (depends on 51)

The computer-program product of claim 51, further including instructions configured to cause the data processing apparatus to:
receive input corresponding to an edit of the extraction rule;
modify the display of the one or more of the events in the first portion of the graphical interface to emphasize one or more values extracted from a field defined by the edited extraction rule; and
update the display of the single instance of the one or more of the extracted values in the second portion of the graphical interface to reflect the values extracted from the field defined by the edited extraction rule.

### Claim 59 (depends on 51)

The computer-program product of claim 51, wherein the set of events is a sample subset of a larger dataset of events.

### Claim 60 (depends on 51)

The computer-program product of claim 51, further including instructions configured to cause the data processing apparatus to:
receive input corresponding to an edit of the extraction rule; and
dynamically update in real-time the display of the one or more of the events in the first portion of the graphical interface.