Identification of Relevant Data Events by Use of Clustering

A system for improving time-based searching of data, the system comprising:

• a memory;
• a network interface;
• and
• at least one processor coupled to the memory and the network interface, the at least one processor being configured to perform operations including:
• (a) receiving first user input that specifies criteria for a first search query;
• and
• (b) in response to the first user input that specifies the first search query,
• (b)(1) accessing events in a data store, each event being associated with a time stamp and containing raw machine-generated data indicative of performance or operation of a component in an information-technology environment, wherein the raw machine-generated data contained in each event includes a plurality of strings associated with a corresponding time stamp, and wherein each string includes text, numbers, or a combination of text and numbers;
• (b)(2) applying a clustering algorithm to the accessed events to form at least one cluster of events;
• (b)(3) for each cluster of the at least one cluster of events, after formation of the cluster, defining, based on contents of the cluster, a set of one or more search terms as criteria for a corresponding search query designed to retrieve at least one of the events of the cluster, and associating the defined search terms with the cluster;
• and
• (b)(4) causing a display of a result of the first search query, the displayed result including an identification of each cluster of the at least one cluster of events.

A non-transitory computer-readable storage medium storing instructions, execution of which by at least one processing device in a computer system causes the computer system to perform operations comprising:

• (a) receiving first user input that specifies criteria for a first search query;
• and
• (b) in response to the first user input that specifies the first search query,
• (b)(1) accessing events in a data store, each event being associated with a time stamp and containing raw machine-generated data indicative of performance or operation of a component in an information-technology environment, wherein the raw machine-generated data contained in each event includes a plurality of strings associated with a corresponding time stamp, and wherein each string includes text, numbers, or a combination of text and numbers;
• (b)(2) applying a clustering algorithm to the accessed events to form at least one cluster of events;
• (b)(3) for each cluster of the at least one cluster of events, after formation of the cluster, defining, based on contents of the cluster, a set of one or more search terms as criteria for a corresponding search query designed to retrieve at least one of the events of the cluster, and associating the defined search terms with the cluster;
• and
• (b)(4) causing a display of a result of the first search query, the displayed result including an identification of each cluster of the at least one cluster of events.