# US 2018/0322190 A1 · Graphical controls for selecting criteria based on fields present in event data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0322190 A1 - Document ID: US20180322190A1 - Status: Published application - Kind: A1 - Application number: 16/034,289 - Filed: 2018-07-12 - Published: 2018-11-08 - Earliest claimed: 2012-09-07 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Alice Neels; Sundar Vasan; Simon Fishel; Marc Robichaud; Divanny Lamas - Web page: https://patentgrep.com/patent/US20180322190A1 ## CPC - G06F 16/338: Presentation of query results - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) - G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials - G06F 16/24575: {using context} - G06F 16/2477: {Temporal data queries} - G06F 16/248: Presentation of query results - G06F 16/26: Visual data mining; Browsing structured data - G06F 16/334: Query execution (filtering based on additional data G06F16/335) - G06F 16/335: Filtering based on additional data, e.g. user or group profiles (filtering in web context G06F16/9535, G06F16/9536) - G06F 16/345: {Summarisation for human users} - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/9538: Presentation of query results - G06F 40/166: Editing, e.g. inserting or deleting - G06T 11/26: Drawing of charts or graphs - G06T 2200/24: involving graphical user interfaces [GUIs] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events. ## Claims ### Claim 1 A computer-implemented method, comprising: identifying a set of fields included in raw machine data that reflects activity in an information technology environment; causing display of a first graphical control for selecting a first criterion from a first set of criteria, wherein the first set of criteria corresponds to a first field present in the set of fields; causing display of a second graphical control for selecting a second criterion from a second set of criteria, wherein the second set of criteria is different than the first set of criteria and corresponds to a second field present in the set of fields; receiving, via at least one of the first graphical control and the second graphical control, a selection of at least one of the first criterion and the second criterion; extracting data from at least one of a plurality of occurrences of the first field in the raw machine data and a plurality of occurrences of the second field in the raw machine data based on one or more extraction rules associated with at least one of the first field and the second field; and causing display of a report associated with the data, wherein the report is generated based at least one of the first criterion and the second criterion. ### Claim 2 (depends on 1) The method of claim 1, wherein the first set of criteria comprises one or more aggregate functions. ### Claim 3 (depends on 1) The method of claim 1, wherein the first set of criteria comprises one or more aggregate functions, and the data comprises a set of field values, and further comprising determining one or more values by applying the one or more aggregate functions to the set of field values. ### Claim 4 (depends on 1) The method of claim 1, wherein the first set of criteria comprises one or more filter functions. ### Claim 5 (depends on 1) The method of claim 1, wherein the first set of criteria comprises at least one of a time filter, a match filter, and a limit filter. ### Claim 6 (depends on 1) The method of claim 1, wherein the report comprises a graphical visualization, and the first set of criteria comprises one or more attributes of the graphical visualization. ### Claim 7 (depends on 1) The method of claim 1, wherein the report comprises a graphical visualization that includes at least one of a table, a column chart, a bar chart, a scatter chart, an area chart, a line chart, a pie chart, a radial gauge, a marker gauge, and a filler gauge, and the first set of criteria comprises one or more attributes of the graphical visualization. ### Claim 8 (depends on 1) The method of claim 1, wherein the report comprises a graphical visualization, and the first set of criteria comprises one or more attributes associated with one or more axes of the graphical visualization. ### Claim 9 (depends on 1) The method of claim 1, wherein the report comprises a graphical visualization, the first criterion comprises a first attribute of the graphical visualization, the first attribute corresponding to the first field and being associated with a first axis of the graphical visualization, and the second criterion comprises a second attribute of the graphical visualization, the second attribute corresponding to the second field and being associated with a second axis of the graphical visualization. ### Claim 10 (depends on 1) The method of claim 1, wherein the first graphical control comprises at least one of a menu and a drop-down list. ### Claim 11 (depends on 1) The method of claim 1, wherein the set of fields is included in a set of events, wherein each event in the set of events includes a portion of the raw machine data, and each event is associated with a timestamp extracted from the raw machine data associated with that event. ### Claim 12 (depends on 1) The method of claim 1, further comprising: identifying a second set of fields included in second raw machine data that reflects activity in an information technology environment; causing display of a third graphical control for selecting a third criterion from a third set of criteria, wherein the third set of criteria is different than the first set of criteria and the second set of criteria, and the third set of criteria corresponds to a third field present in the second set of fields; receiving, via the third graphical control, a selection of the third criterion; extracting second data from a plurality of occurrences of the third field in the second raw machine data based on at least one extraction rule associated with the third field; and causing display of a second report associated with the second data, wherein the second report is generated based on the third criterion. ### Claim 13 (depends on 1) The method of claim 1, wherein the one or more extraction rules are used to identify a pattern in the raw machine data that indicates occurrences of the first field in the raw machine data. ### Claim 14 A system, comprising: a memory storing instructions; and a processor coupled to the memory, wherein, when executed by the processor, the instructions configure the processor to: identify a set of fields included in raw machine data that reflects activity in an information technology environment; cause display of a first graphical control for selecting a first criterion from a first set of criteria, wherein the first set of criteria corresponds to a first field present in the set of fields; cause display of a second graphical control for selecting a second criterion from a second set of criteria, wherein the second set of criteria is different than the first set of criteria and corresponds to a second field present in the set of fields; receive, via at least one of the first graphical control and the second graphical control, a selection of at least one of the first criterion and the second criterion; extract data from at least one of a plurality of occurrences of the first field in the raw machine data and a plurality of occurrences of the second field in the raw machine data based on one or more extraction rules associated with at least one of the first field and the second field; and cause display of a report associated with the data, wherein the report is generated based at least one of the first criterion and the second criterion. ### Claim 15 (depends on 14) The system of claim 14, wherein the first set of criteria comprises one or more aggregate functions. ### Claim 16 (depends on 14) The system of claim 14, wherein the first set of criteria comprises one or more filter functions. ### Claim 17 (depends on 14) The system of claim 14, wherein the report comprises a graphical visualization, and the first set of criteria comprises one or more attributes of the graphical visualization. ### Claim 18 (depends on 14) The system of claim 14, wherein the report comprises a graphical visualization that includes at least one of a table, a column chart, a bar chart, a scatter chart, an area chart, a line chart, a pie chart, a radial gauge, a marker gauge, and a filler gauge, and the first set of criteria comprises one or more attributes of the graphical visualization. ### Claim 19 (depends on 14) The system of claim 14, wherein the first graphical control comprises at least one of a menu and a drop-down list. ### Claim 20 (depends on 14) The system of claim 14, wherein the set of fields is included in a set of events, wherein each event in the set of events includes a portion of the raw machine data, and each event is associated with a timestamp extracted from the raw machine data associated with that event. ### Claim 21 (depends on 14) The system of claim 14, wherein, when executed by the processor, the instructions further configure the processor to: identify a second set of fields included in second raw machine data that reflects activity in an information technology environment; cause display of a third graphical control for selecting a third criterion from a third set of criteria, wherein the third set of criteria is different than the first set of criteria and the second set of criteria, and the third set of criteria corresponds to a third field present in the second set of fields; receive, via the third graphical control, a selection of the third criterion; extract second data from a plurality of occurrences of the third field in the second raw machine data based on at least one extraction rule associated with the third field; and cause display of a second report associated with the second data, wherein the second report is generated based on the third criterion. ### Claim 22 A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to perform the steps of: identifying a set of fields included in raw machine data that reflects activity in an information technology environment; causing display of a first graphical control for selecting a first criterion from a first set of criteria, wherein the first set of criteria corresponds to a first field present in the set of fields; causing display of a second graphical control for selecting a second criterion from a second set of criteria, wherein the second set of criteria is different than the first set of criteria and corresponds to a second field present in the set of fields; receiving, via at least one of the first graphical control and the second graphical control, a selection of at least one of the first criterion and the second criterion; extracting data from at least one of a plurality of occurrences of the first field in the raw machine data and a plurality of occurrences of the second field in the raw machine data based on one or more extraction rules associated with at least one of the first field and the second field; and causing display of a report associated with the data, wherein the report is generated based at least one of the first criterion and the second criterion. ### Claim 23 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the first set of criteria comprises one or more aggregate functions. ### Claim 24 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the first set of criteria comprises one or more filter functions. ### Claim 25 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the report comprises a graphical visualization, and the first set of criteria comprises one or more attributes of the graphical visualization. ### Claim 26 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the report comprises a graphical visualization that includes at least one of a table, a column chart, a bar chart, a scatter chart, an area chart, a line chart, a pie chart, a radial gauge, a marker gauge, and a filler gauge, and the first set of criteria comprises one or more attributes of the graphical visualization. ### Claim 27 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the first graphical control comprises at least one of a menu and a drop-down list. ### Claim 28 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the set of fields is included in a set of events, wherein each event in the set of events includes a portion of the raw machine data, and each event is associated with a timestamp extracted from the raw machine data associated with that event. ### Claim 29 (depends on 22) The non-transitory computer-readable storage medium of claim 22, further comprising: identifying a second set of fields included in second raw machine data that reflects activity in an information technology environment; causing display of a third graphical control for selecting a third criterion from a third set of criteria, wherein the third set of criteria is different than the first set of criteria and the second set of criteria, and the third set of criteria corresponds to a third field present in the second set of fields; receiving, via the third graphical control, a selection of the third criterion; extracting second data from a plurality of occurrences of the third field in the second raw machine data based on at least one extraction rule associated with the third field; and causing display of a second report associated with the second data, wherein the second report is generated based on the third criterion. ### Claim 30 (depends on 22) The non-transitory computer-readable storage medium of claim 22, wherein the one or more extraction rules are used to identify a pattern in the raw machine data that indicates occurrences of the first field in the raw machine data.