# US 2018/0024702 A1 · Concurrent Display of Search Results from Differing Time-Based Search Queries Executed Across Event Data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0024702 A1 - Document ID: US20180024702A1 - Status: Published application - Kind: A1 - Application number: 15/721,551 - Filed: 2017-09-29 - Published: 2018-01-25 - Earliest claimed: 2013-09-16 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Cary Noel; John Coates - Web page: https://patentgrep.com/patent/US20180024702A1 ## CPC - G06F 3/0481: based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance - G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range - G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) - G06F 16/2477: {Temporal data queries} - G06F 16/248: Presentation of query results - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A visualization can include a set of swim lanes, each swim lane representing information about an event type. An event type can be specified, e.g., as those events having certain keywords and/or having specified value(s) for specified field(s). The swim lane can plot when (within a time range) events of the associated event type occurred. Specifically, each such event can be assigned to a bucket having a bucket time matching the event time. A swim lane can extend along a timeline axis in the visualization, and the buckets can be positioned at a point along the axis that represents the bucket time. Thus, the visualization may indicate whether events were clustered at a point in time. Because the visualization can include a plurality of swim lanes, the visualization can further indicate how timing of events of a first type compare to timing of events of a second type. ## Claims ### Claim 1 A method, comprising: executing two or more differing time-based search queries across a plurality of events, wherein the plurality of events is derived from raw data; causing display of one or more graphical indicators across a common timeline representation that represent search results from each of the two or more differing time-based search queries, wherein the one or more graphical indicators for a particular time-based search query of the two or more differing time-based search queries are displayed in a display area that is parallel with a display of the one or more graphical indicators for another time-based search query of the two or more differing time-based search queries; wherein the method is performed by one or more computing devices. ### Claim 2 (depends on 1) The method of claim 1, further comprising: based on user input, adjusting a timeframe of the common timeline representation. ### Claim 3 (depends on 1) The method of claim 1, further comprising: based on user input, adjusting a timeframe of the common timeline representation; causing display of graphical indicators that represent search results within the adjusted timeframe for the particular time-based search query and the another time-based search query. ### Claim 4 (depends on 1) The method of claim 1, further comprising: based on user input, adjusting a timeframe of the common timeline representation; executing the two or more differing time-based search queries across the plurality of events for the adjusted timeframe; causing display of graphical indicators that represent search results for the two or more differing time-based search queries over the adjusted timeframe. ### Claim 5 (depends on 1) The method of claim 1, further comprising: causing display of a population graph that represents a time plot across the common timeline representation of one or more of the search results for the two or more differing time-based search queries. ### Claim 6 (depends on 1) The method of claim 1, further comprising: causing display of a population graph that represents a time plot across the common timeline representation of one or more of the search results for the two or more differing time-based search queries; wherein portions of the population graph are selectable by a user. ### Claim 7 (depends on 1) The method of claim 1, further comprising: causing display of a population graph that represents a time plot across the common timeline representation of one or more of the search results for the two or more differing time-based search queries; wherein portions of the population graph are selectable by a user; based on user input selecting a portion of the population graph, adjusting a timeframe of the common timeline representation to match a time period of the selected portion of the population graph. ### Claim 8 (depends on 1) The method of claim 1, further comprising: based on user input, rearranging a displayed order of the display of the one or more graphical indicators for the particular time-based search query and the one or more graphical indicators for the another time-based search query. ### Claim 9 (depends on 1) The method of claim 1, wherein the two or more differing time-based search queries include search criteria requiring matching events to relate to a same particular user. ### Claim 10 (depends on 1) The method of claim 1, wherein the two or more differing time-based search queries include search criteria requiring matching events to relate to a same particular asset. ### Claim 11 (depends on 1) The method of claim 1, further comprising: in response to receiving an input identifying a graphical indicator among the displayed one or more graphical indicators that represent search results from the two or more differing time-based search queries, displaying additional information about one or more events represented by the identified graphical indicator. ### Claim 12 (depends on 1) The method of claim 1, further comprising: in response to receiving an input identifying a graphical indicator among the displayed one or more graphical indicators that represent search results from the two or more differing time-based search queries, displaying at least a portion of one or more events represented by the identified graphical indicator. ### Claim 13 (depends on 1) The method of claim 1, further comprising: receiving input indicative of a request to create an alert corresponding to one or more events represented by a selected one or more one or more graphical indicators among the displayed one or more graphical indicators that represent search results from the two or more differing time-based search queries; and creating the alert corresponding to the events represented by the selected one or more graphical indicators. ### Claim 14 (depends on 1) The method of claim 1, wherein one or more events of the plurality of events is derived from machine data. ### Claim 15 (depends on 1) The method of claim 1, wherein one or more events of the plurality of events includes a portion of raw machine data. ### Claim 16 (depends on 1) The method of claim 1, wherein at least one displayed graphical indicator graphically indicates a number of events represented by the displayed graphical indicator. ### Claim 17 (depends on 1) The method of claim 1, wherein at least one displayed graphical indicator indicates a number of events represented by the displayed graphical indicator using color or color shading. ### Claim 18 (depends on 1) The method of claim 1, wherein particular time-based search query was executed against the plurality of events using a late-binding schema to generate a search result. ### Claim 19 One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of: executing two or more differing time-based search queries across a plurality of events, wherein the plurality of events is derived from raw data; causing display of one or more graphical indicators across a common timeline representation that represent search results from each of the two or more differing time-based search queries, wherein the one or more graphical indicators for a particular time-based search query of the two or more differing time-based search queries are displayed in a display area that is parallel with a display of the one or more graphical indicators for another time-based search query of the two or more differing time-based search queries. ### Claim 20 An apparatus, comprising: a subsystem, implemented at least partially in hardware, that executes two or more differing time-based search queries across a plurality of events, wherein the plurality of events is derived from raw data; a subsystem, implemented at least partially in hardware, that causes display of one or more graphical indicators across a common timeline representation that represent search results from each of the two or more differing time-based search queries, wherein the one or more graphical indicators for a particular time-based search query of the two or more differing time-based search queries are displayed in a display area that is parallel with a display of the one or more graphical indicators for another time-based search query of the two or more differing time-based search queries.