# US 2017/0255606 A1 · Determining Events having a Value > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0255606 A1 - Document ID: US20170255606A1 - Status: Published application - Kind: A1 - Application number: 15/582,667 - Filed: 2017-04-29 - Published: 2017-09-07 - Earliest claimed: 2013-01-23 - Assignees: Splunk Inc. - Applicants: SPLUNK, Inc. - Inventors: R. David Carasso; Micah James Delfino; Johnvey Hwang - Web page: https://patentgrep.com/patent/US20170255606A1 ## CPC - G06F 16/287: {Visualization; Browsing} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) - G06F 16/248: Presentation of query results - G06F 16/332: Query formulation - G06F 16/334: Query execution (filtering based on additional data G06F16/335) - G06F 16/338: Presentation of query results - G06F 16/34: Browsing; Visualisation therefor (browsing or visualisation for clustering or classification G06F16/358) - G06F 16/93: Document management systems - G06F 16/951: Indexing; Web crawling techniques - G06F 40/166: Editing, e.g. inserting or deleting - G06F 40/169: Annotation, e.g. comment data or footnotes - G06F 40/174: Form filling; Merging - G06Q 10/00: Administration; Management - G06Q 10/0637: Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals - Y04S 10/50: Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value. ## Claims ### Claim 1 A computer-implemented method, comprising: accessing a set of events in a field-searchable data store that acts as a persistent repository for the events, wherein each event in the set includes a portion of raw machine data in textual form, and wherein the raw machine data is produced by a component within an information technology environment and reflects activity within the information technology environment; applying an extraction rule, which specifies how to extract a subportion of text from a larger portion of text, to the portion of raw machine data in textual form in each event in the accessed set of events to extract a set of values; for one or more particular values in the extracted set of values, determining a proportion of events that include the particular value at a location corresponding to the extraction rule; causing display of the one or more particular values concurrently with its associated proportion; and wherein the method is performed by one or more computing devices. ### Claim 2 (depends on 1) The method of claim 1, wherein the field-searchable data store is searchable to reveal a performance or security of the information technology environment based on the activity reflected by the raw machine data in the data store. ### Claim 3 (depends on 1) The method of claim 1, wherein the proportion is a percentage. ### Claim 4 (depends on 1) The method of claim 1, wherein the proportion is a ratio. ### Claim 5 (depends on 1) The method of claim 1, wherein the extraction rule at least in part defines a field. ### Claim 6 (depends on 1) The method of claim 1, wherein the extraction rule at least in part defines a field, and the extracted set of values produced by applying extraction rule to the accessed set of events are semantically related. ### Claim 7 (depends on 1) The method of claim 1, wherein the extraction rule at least in part defines a field that can be referenced in a search query by a name for the field. ### Claim 8 (depends on 1) The method of claim 1, wherein a data store of events is field-searchable when a search query containing a criterion for a field can be executed against the events in the data store to cause comparison between the criterion and values extracted from the events by an extraction rule defining the field. ### Claim 9 (depends on 1) The method of claim 1, further comprising causing display of an indication of a relative rate of occurrence in events of different values from the extracted set of values. ### Claim 10 (depends on 1) The method of claim 1, wherein causing display of the one or more particular values concurrently with its associated proportion further comprises causing display of the one or more particular values in a sorted order based on the associated proportions. ### Claim 11 (depends on 1) The method of claim 1, wherein the one or more particular values include only unique values found in the extracted set of values. ### Claim 12 (depends on 1) The method of claim 1, wherein the extraction rule is a regular expression. ### Claim 13 (depends on 1) The method of claim 1, wherein the extraction rule is a regular expression that has been automatically generated to correspond to a user-selected portion of raw machine data in a particular event. ### Claim 14 (depends on 1) The method of claim 1, further comprising: causing display of at least one event having a given value in the extracted set of values at a location corresponding to the extraction rule; and causing highlighting of the given value in the at least one displayed event. ### Claim 15 (depends on 1) The method of claim 1, further comprising: receiving input corresponding to a selection of a particular value that has been displayed with its associated proportion; based on receiving the selection, determining a subset of the set of events such that each event in the subset includes the selected particular value at a location corresponding to the extraction rule; and modifying a displayed set of events to include only events in the determined subset and to hide any events not in the determined subset. ### Claim 16 A non-transitory computer readable storage medium impressed with computer program instructions that, when executed on a processor, implement a method comprising: accessing a set of events in a field-searchable data store that acts as a persistent repository for the events, wherein each event in the set includes a portion of raw machine data in textual form, and wherein the raw machine data is produced by a component within an information technology environment and reflects activity within the information technology environment; applying an extraction rule, which specifies how to extract a subportion of text from a larger portion of text, to the portion of raw machine data in textual form in each event in the accessed set of events to extract a set of values; for one or more particular values in the extracted set of values, determining a proportion of events that include the particular value at a location corresponding to the extraction rule; causing display of the one or more particular values concurrently with its associated proportion; and wherein the method is performed by one or more computing devices. ### Claim 17 (depends on 16) The computer readable medium of claim 16, wherein the field-searchable data store is searchable to reveal a performance or security of the information technology environment based on the activity reflected by the raw machine data in the data store. ### Claim 18 (depends on 16) The computer readable medium of claim 16, wherein the proportion is a percentage. ### Claim 19 (depends on 16) The computer readable medium of claim 16, wherein causing display of the one or more particular values concurrently with its associated proportion further comprises causing display of the one or more particular values in a sorted order based on the associated proportions. ### Claim 20 (depends on 16) The computer readable medium of claim 16, wherein the extraction rule is a regular expression that has been automatically generated to correspond to a user-selected portion of raw machine data in a particular event. ### Claim 21 (depends on 16) The computer readable medium of claim 16, implementing the method further comprising: causing display of at least one event having a given value in the extracted set of values at a location corresponding to the extraction rule; and causing highlighting of the given value in the at least one displayed event. ### Claim 22 (depends on 16) The computer readable medium of claim 16, implementing the method further comprising: receiving input corresponding to a selection of a particular value that has been displayed with its associated proportion; based on receiving the selection, determining a subset of the set of events such that each event in the subset includes the selected particular value at a location corresponding to the extraction rule; and modifying a displayed set of events to include only events in the determined subset and to hide any events not in the determined subset. ### Claim 23 A system including one or more processors coupled to memory, the memory loaded with computer instructions that, when executed on the processors, implement actions comprising: accessing a set of events in a field-searchable data store that acts as a persistent repository for the events, wherein each event in the set includes a portion of raw machine data in textual form, and wherein the raw machine data is produced by a component within an information technology environment and reflects activity within the information technology environment; applying an extraction rule, which specifies how to extract a subportion of text from a larger portion of text, to the portion of raw machine data in textual form in each event in the accessed set of events to extract a set of values; for one or more particular values in the extracted set of values, determining a proportion of events that include the particular value at a location corresponding to the extraction rule; causing display of the one or more particular values concurrently with its associated proportion; and wherein the method is performed by one or more computing devices. ### Claim 24 (depends on 23) The system of claim 23, wherein the field-searchable data store is searchable to reveal a performance or security of the information technology environment based on the activity reflected by the raw machine data in the data store. ### Claim 25 (depends on 23) The system of claim 23, wherein the proportion is a percentage. ### Claim 26 (depends on 23) The system of claim 23, wherein causing display of the one or more particular values concurrently with its associated proportion further comprises causing display of the one or more particular values in a sorted order based on the associated proportions. ### Claim 27 (depends on 23) The system of claim 23, wherein the extraction rule is a regular expression that has been automatically generated to correspond to a user-selected portion of raw machine data in a particular event. ### Claim 28 (depends on 23) The system of claim 23, further implementing actions comprising: causing display of at least one event having a given value in the extracted set of values at a location corresponding to the extraction rule; and causing highlighting of the given value in the at least one displayed event. ### Claim 29 (depends on 23) The system of claim 23, further implementing actions comprising: receiving input corresponding to a selection of a particular value that has been displayed with its associated proportion; based on receiving the selection, determining a subset of the set of events such that each event in the subset includes the selected particular value at a location corresponding to the extraction rule; and modifying a displayed set of events to include only events in the determined subset and to hide any events not in the determined subset.