# US 2021/0174009 A1 · Providing extraction results for a particular field > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0174009 A1 - Document ID: US20210174009A1 - Status: Published application - Kind: A1 - Application number: 17/169,254 - Filed: 2021-02-05 - Published: 2021-06-10 - Earliest claimed: 2012-09-07 - Assignees: Splunk Inc. - Applicants: SPLUNK Inc. - Inventors: Jesse MILLER; Micah James DELFINO; Marc ROBICHAUD; David CARASSO - Web page: https://patentgrep.com/patent/US20210174009A1 ## CPC - G06F 40/174: Form filling; Merging - G06F 16/2477: {Temporal data queries} - G06F 40/279: Recognition of textual entities - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data. ## Claims ### Claim 1 A computer-implemented method comprising: identifying a field associated with a set of events; identifying a set of unique values corresponding with the field in the set of events; determining a count of a number of times each unique value corresponds with the field in the set of events; causing concurrent display of the set of unique values corresponding with the field in the set of events and the counts of the number of times the unique value corresponds with the field in the set of events. ### Claim 2 (depends on 1) The method of claim 1, wherein the field is a field for which values are extracted from the set of events. ### Claim 3 (depends on 1) The method of claim 1, wherein each event in the set of events includes a portion of raw data. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of events comprise a sample set of events selected by a user. ### Claim 5 (depends on 1) The method of claim 1, wherein the count comprises the number of times each unique value was extracted from the field in the set of events, the set of events having a plurality of fields. ### Claim 6 (depends on 1) The method of claim 1 further comprising: determining a percent of the number of times each unique value corresponds with the field in the set of events relative to a total number of events in the set of events; and causing concurrent display of the percent with the set of unique values and the counts. ### Claim 7 (depends on 1) The method of claim 1 further comprising: determining a percent of the number of times each unique value corresponds with the field in the set of events relative to a total number of events in the set of events; and causing concurrent display of a graphical illustration representing the percent along with the set of unique values and the counts. ### Claim 8 (depends on 1) The method of claim 1, wherein the displayed set of unique values are presented in rows in a first column and the counts are displayed in a second column in a corresponding row. ### Claim 9 (depends on 1) The method of claim 1, wherein the concurrent display includes row controls to populate a filter control with a selected value. ### Claim 10 (depends on 1) The method of claim 1, wherein each unique value in the concurrent display includes a link to populate a filter control with the corresponding unique value. ### Claim 11 (depends on 1) The method of claim 1 further comprising: identifying a selection of a link of a displayed unique value; and causing presentation of the set of events with a key-value filter set in a filter control that corresponds with the selected displayed unique value. ### Claim 12 (depends on 1) The method of claim 1 further comprising determining a coverage within a source type, the coverage comprising a percent of tokens within events of the source type that have extracted values. ### Claim 13 (depends on 1) The method of claim 1 further comprising determining a confidence rating within a source type, the confidence rating indicating insight into an estimated success of existing extractions. ### Claim 14 A system comprising: one or more data processors; and one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including: identifying a field associated with a set of events; identifying a set of unique values corresponding with the field in the set of events; determining a count of a number of times each unique value corresponds with the field in the set of events; causing concurrent display of the set of unique values corresponding with the field in the set of events and the counts of the number of times the unique value corresponds with the field in the set of events. ### Claim 15 (depends on 14) The system of claim 14, wherein the count comprises the number of times each unique value was extracted from the field in the set of events, the set of events having a plurality of fields. ### Claim 16 (depends on 14) The system of claim 14 further comprising: determining a percent of the number of times each unique value corresponds with the field in the set of events relative to a total number of events in the set of events; and causing concurrent display of the percent with the set of unique values and the counts. ### Claim 17 (depends on 14) The system of claim 14 further comprising: determining a percent of the number of times each unique value corresponds with the field in the set of events relative to a total number of events in the set of events; and causing concurrent display of a graphical illustration representing the percent along with the set of unique values and the counts. ### Claim 18 One or more computer-storage media storing computer-executable instructions that, when executed by a computing device, perform a method for generating an extraction rule, the method comprising: identifying a field associated with a set of events; identifying a set of unique values corresponding with the field in the set of events; determining a count of a number of times each unique value corresponds with the field in the set of events; causing concurrent display of the set of unique values corresponding with the field in the set of events and the counts of the number of times the unique value corresponds with the field in the set of events. ### Claim 19 (depends on 18) The one or more computer-storage media of claim 18 further comprising: identifying a selection of a link of a displayed unique value; and causing presentation of the set of events with a key-value filter set in a filter control that corresponds with the selected displayed unique value. ### Claim 20 (depends on 18) The one or more computer-storage media of claim 18 further comprising: determining a coverage within a source type, the coverage comprising a percent of tokens within events of the source type that have extracted values.