Real time searching and reporting
AssigneeSplunk Inc.
InventorsSteve Y. Zhang, Stephen P. Sorkin, Vishal Patel
Life of this patent
Estimating the term…
Abstract
A system arranged to search machine data to generate reports in real time. A search query is provided that includes a plurality of search commands. The search query is parsed to form a main search query and a remote search query. Machine data is collected from remote data sources and evaluated against one of the main and remote search queries to generate a set of search results. The main search query is then evaluated against at least a partial set of the search result to generate at least one report regarding the collected machine data. Each report can be provided for display to a user.
Claims31
A method for searching and reporting machine data with a computing device over a network, comprising:
- receiving a search query comprising a plurality of commands;
- employing a plurality of commands in the search query to generate a remote search query and a main search query;
- receiving machine data from at least one of a plurality of remote data sources that is then aggregated into a plurality of separate events, wherein each event includes at least one determined segment;
- performing the remote search query against the collected machine data to generate a search result associated with the remote search query;
- and
- performing the main search query against the search result to generate a report of the collected machine data.
A non-transitory computer-readable storage medium that comprises computer program code for searching and reporting machine data over a network, wherein execution of the computer program code by a processor enables actions, including:
- receiving a search query comprising a plurality of commands;
- employing a plurality of commands in the search query to generate a remote search query and a main search query;
- receiving machine data from at least one of a plurality of remote data sources that is then aggregated into a plurality of separate events, wherein each event includes at least one determined segment;
- performing the remote search query against the collected machine data to generate a search result associated with the remote search query;
- and
- performing the main search query against the search result to generate a report of the collected machine data.
A network device for searching and reporting machine data over a network, comprising:
- a transceiver for communicating over a network;
- a memory for storing, a plurality of data;
- and
- a processor for executing the data to perform actions, including;
- receiving a search query comprising a plurality of commands;
- employing a plurality of commands in the search query to generate a remote search query and a main search query;
- receiving machine data from at least one of a plurality of remote data sources that is then aggregated into a plurality of separate events, wherein each event includes at least one determined segment;
- performing the remote search query against the collected machine data to generate a search result associated with the remote search query;
- and
- performing the main search query against the search result to generate a report of the collected machine data,
A system for searching and reporting machine data over a network, comprising:
- a server device that performs actions;
- including:
- receiving a search query comprising a plurality of commands;
- employing a plurality of commands in the search query to generate a remote search query and a main search query;
- receiving machine data from at least one of a plurality of remote data sources that is then aggregated into a plurality of separate events, wherein each event includes at least one determined segment:
- performing the remote search query against the collected machine data to generate a search result associated with the remote search query;
- and
- performing the main search query against the search result to generate a report of the collected machine data;
- and
- a client device that performs actions including:
- providing the search query to the server device;
- and
- displaying the report to a user.
Dependencies are inferred from the claim text.