US 2021/0011925 A1 · FIELD VALUE AND LABEL EXTRACTION FROM A FIELD VALUE

Abstract

First one or more values are extracted from a plurality of events using a first extraction rule. The extracted first one or more values are assigned to a first field of the plurality of events as a first set of field-data item pairs. Second one or more values are extracted from the plurality of the events using a second extraction rule. The second extraction rule identifies the second one or more values and a field label corresponding to the second one or more values in the extracted first one or more values of the first set of field-data item pairs. The extracted second one or more values are assigned to a second field of the plurality of events as a second set of field-data item pairs. The field label extracted using the second extraction rule or a modified version thereof may be assigned to the second field.

Claims21

Dependent claims

1-30. (canceled)

A system comprising:

one or more data processors;
and
one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:
accessing raw machine data associated with a first event of a set of events;
employing a first extraction rule to extract, from the raw machine data associated with the first event, a first value for a first field of the set of events;
employing a second extraction rule to extract, from the first value for the first field, a second value for a second field of the set of events and a field label for the second field, wherein text corresponding to the second value for the second field and the field label is embedded in the first value for the first field;
and
causing display of at least a portion of the raw machine data associated with the first event, the first value of the first field, and the second value of the second field in a user interface.

5 more elements

One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by a computing device, perform a method, the method comprising:

accessing raw machine data associated with a first event of a set of events;
employing a first extraction rule to extract, from the raw machine data associated with the first event, a first value for a first field of the set of events;
employing a second extraction rule to extract, from the first value for the first field, a second value for a second field of the set of events and a field label for the second field, wherein text corresponding to the second value for the second field and the field label is embedded in the first value for the first field;
and
causing display of at least a portion of the raw machine data associated with the first event, the first value of the first field, and the second value of the second field in a user interface.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application

16/919,400Filed 2 Jul 2020

Priority

30 Jan 2015

Published

14 Jan 2021

Term ends

Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 16/254
Integrating or interfacing systems involving database management systems: extract, transform and load [ETL] procedures, e.g. ETL data flows in…
G06F 11/30
Error detection; Error correction; Monitoring: monitoring
G06F 11/3006
Monitoring arrangements specially adapted to the computing system or computing system component being monitored: where the computing system is…
G06F 11/3072
Monitoring arrangements determined by the means or processing involved in reporting the monitored data: where the reporting involves data…

Field value and label extraction from a field value

Life of this patent

Field value and label extraction from a field value

Life of this patent

Abstract

Claims21