# US 2017/0286455 A1 · Technology Add-On Packages Controlling a Data Input and Query System > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286455 A1 - Document ID: US20170286455A1 - Status: Published application - Kind: A1 - Application number: 15/143,562 - Filed: 2016-04-30 - Published: 2017-10-05 - Earliest claimed: 2016-03-31 - Applicants: Splunk Inc. - Inventors: Li Li; Gang Tao; Yongxin Su; Junqing Hao; Ting Wang; John Robert Coates; Elias Haddad; Guodong Wang - Web page: https://patentgrep.com/patent/US20170286455A1 ## CPC - G06F 16/212: {with details for data modelling support} - G06F 16/24575: {using context} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The operation of an automatic data input and query system is controlled by well-defined control data. Technology Add-On (TA) control data extends the operations of the system to gather and process machine data from additional sources. A user interface is exposed enabling a user who may be agnostic of requirements imposed by the system for TA content and format, to build a proper TA for controlling the system. ## Claims ### Claim 1 A method comprising: receiving input via a user interface, the input indicative of: a source of machine data; and schema information having one or more extraction rules applicable to the machine data; constructing a data package based at least in part on the received input, the data package representing a technology add-on (TA) and conforming to a standard representation format for an extension of a data input and query system; whereby the operation of an active instance of the data input and query system may be controlled with information based at least in part on content of the data package; and wherein the method is performed by a computer system comprising one or more processors. ### Claim 2 (depends on 1) The method of claim 1 wherein the input indicative of schema information includes an indication of user acceptance of an automatically generated extraction model. ### Claim 3 (depends on 1) The method of claim 1 wherein the input indicative of schema information includes an indication of user acceptance of an automatically generated extraction model represented, at least in part, in a display of the user interface. ### Claim 4 (depends on 1) The method of claim 1 wherein the input indicative of schema information includes an indication of user acceptance of an automatically generated extraction model represented in a display of the user interface, the display including a depiction of a sample event. ### Claim 5 (depends on 1) The method of claim 1 wherein the input indicative of schema information includes an indication of user acceptance of an automatically generated extraction model represented in a display of the user interface, the display including a depiction of a sample event having one or more portions color-coded in accordance with the schema information. ### Claim 6 (depends on 1) The method of claim 1 wherein the input indicative of schema information includes an indication of user acceptance of an automatically generated extraction model represented in a display of the user interface, the display including a depiction of a sample event having one or more portions each substituted with a field identifier in accordance with the schema information. ### Claim 7 (depends on 1) The method of claim 1 wherein the schema information is pre-existing. ### Claim 8 (depends on 1) The method of claim 1 wherein the schema information is from an automatically generated extraction model. ### Claim 9 (depends on 1) The method of claim 1 wherein the schema information is from an automatically generated extraction model produced by the method comprising: receiving a data sample representative of machine data produced by the source of machine data, the machine data comprising event segments; identifying a plurality of event segments of the data sample; classifying the event segments into two or more groups based at least in part on a determination of similarity; and determining automatically, for each of the groups, an extraction rule to extract a common set of one or more fields from each event segment of the group. ### Claim 10 (depends on 1) The method of claim 1 wherein constructing the data package comprises constructing the data package without prior disclosure of the standard representation format to a person from whom the input was received. ### Claim 11 (depends on 1) The method of claim 1 wherein constructing the data package comprises constructing the data package without prior disclosure of the standard representation format to a person from whom the input was received and who has no present or prior employment relationship with a company that supplies software forming the data input and query system. ### Claim 12 (depends on 1) The method of claim 1 wherein receiving the input via the user interface comprises receiving the input from a user of the user interface to whom the standard representation format has not been made available. ### Claim 13 (depends on 1) The method of claim 1 wherein the standard representation format has not been generally published to customers using the data input and query system. ### Claim 14 (depends on 1) The method of claim 1 wherein the input is further indicative of a sourcetype. ### Claim 15 (depends on 1) The method of claim 1 wherein the input is further indicative of data normalization for at least one field represented in the schema information. ### Claim 16 (depends on 1) The method of claim 1 wherein the input is further indicative of data normalization based on a data model for at least one field represented in the schema information. ### Claim 17 (depends on 1) The method of claim 1 wherein constructing the data package includes transforming content of the data package to an archival and/or a compressed form. ### Claim 18 (depends on 1) The method of claim 1 wherein the standard representation format includes one or more files. ### Claim 19 (depends on 1) The method of claim 1 wherein the standard representation format includes one or more files organized in one or more directories. ### Claim 20 (depends on 1) The method of claim 1 wherein the standard representation format is an archival and/or compressed format that includes one or more files organized in one or more directories. ### Claim 21 (depends on 1) The method of claim 1 wherein the standard representation format includes data represented in extensible markup language (XML) format. ### Claim 22 (depends on 1) The method of claim 1 wherein the data input and query system is of a type that operates as a platform incorporating a field-searchable data store to gather and index machine-generated data. ### Claim 23 (depends on 1) The method of claim 1 wherein the data input and query system is of a type that operates as a platform incorporating a field-searchable data store to gather and index machine-generated data, and to search the data store by reference to a late-binding schema. ### Claim 24 (depends on 1) The method of claim 1 wherein the data input and query system is of a type that operates as a platform incorporating a field-searchable data store to gather and index machine-generated data, the machine-generated data represented in the data store as timestamped events. ### Claim 25 (depends on 1) The method of claim 1 wherein the data input and query system is of a type that operates as a platform incorporating a field-searchable data store to gather and index machine-generated data, the machine-generated data represented in the data store as timestamped events each containing a segment of machine data. ### Claim 26 (depends on 1) The method of claim 1 wherein the data input and query system is of a type that operates as a platform incorporating a field-searchable data store to gather and index machine-generated data, the machine-generated data represented in the data store as timestamped events each containing a segment of machine data, and searchable by reference to a late-binding schema. ### Claim 27 A system comprising: a memory; and a processing device coupled with the memory to: receive input via a user interface, the input indicative of: a source of machine data; and schema information having one or more extraction rules applicable to the machine data; construct a data package based at least in part on the received input, the data package representing a technology add-on (TA) and conforming to a standard representation format for an extension of a data input and query system; and whereby the operation of an active instance of the data input and query system may be controlled with information based at least in part on content of the data package. ### Claim 28 (depends on 27) The system of claim 27 wherein to receive the input via the user interface comprises receiving the input from a user of the user interface to whom the standard representation format has not been made available. ### Claim 29 A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising: receiving input via a user interface, the input indicative of: a source of machine data; and schema information having one or more extraction rules applicable to the machine data; constructing a data package based at least in part on the received input, the data package representing a technology add-on (TA) and conforming to a standard representation format for an extension of a data input and query system; and whereby the operation of an active instance of the data input and query system may be controlled with information based at least in part on content of the data package. ### Claim 30 (depends on 29) The computer readable storage medium of claim 29 wherein receiving the input via the user interface comprises receiving the input from a user of the user interface to whom the standard representation format has not been made available.