# US 8,751,486 B1 · Executing structured queries on unstructured data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,486 B1 - Document ID: US8751486B1 - Status: Granted - Kind: B1 - Application number: 13/956,258 - Filed: 2013-07-31 - Granted: 2014-06-10 - Earliest claimed: 2013-07-31 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Itay Neeman; Bradford H. Lovering - Web page: https://patentgrep.com/patent/US8751486B1 ## CPC - G06F 16/3332: Query translation - G06F 16/2433: {Query languages} - G06F 16/3331: Query processing - G06F 16/338: Presentation of query results - G06F 16/80: of semi-structured data, e.g. markup language structured data such as SGML, XML or HTML (content-based retrieval of web data G06F16/95) - G06F 16/9032: Query formulation - G06F 16/90335: {Query processing} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Technologies are described herein for executing queries expressed with reference to a structured query language against unstructured data. A user issues a structured query through a traditional structured data management (“SDM”) application. Upon receiving the structured query, an SDM driver analyzes the structured query and extracts a data structure from the unstructured data, if necessary. The structured query is then converted to an unstructured query based on the extracted data structure. The converted unstructured query may then be executed against the unstructured data. Results from the query are reorganized into structured data utilizing the extracted data structure and are then presented to the user through the SDM application. ## Claims ### Claim 1 A computer-implemented method for executing structured queries on unstructured data, the method comprising: receiving a structured query in a structured query language; determining a schema that defines a structure for unstructured data, wherein the schema identifies a plurality of fields in the unstructured data; conducting a pilot query on the unstructured data, wherein the pilot query is conducted using the schema, and wherein conducting the pilot query identifies one or more fields in the unstructured data; converting the structured query in the structured query language into an unstructured query in an unstructured query language, wherein the conversion is done using the one or more fields identified by conducting the pilot query, and wherein the unstructured query is used to access the unstructured data; conducting a search on the unstructured data using the unstructured query; caching the one or more fields identified by conducting the pilot query; conducting a new pilot query on the unstructured data, wherein conducting the new pilot query identifies one or more new fields in the unstructured data; and merging the one or more cached fields with the one or more new fields. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the pilot query is conducted on a subset of the unstructured data. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the pilot query is conducted upon receiving the structured query. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the pilot query is conducted prior to receiving the structured query. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: conducting a new pilot query on the unstructured data, wherein the new pilot query identifies one or more new fields in the unstructured data. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: conducting a new pilot query on the unstructured data, wherein conducting the new pilot query identifies one or more new fields in the unstructured data, and wherein the one or more new fields are different from the one or more fields. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the schema includes a late-binding schema that has been previously developed for the unstructured data. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: presenting results of the search. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising: obtaining properties for each of the one or more fields in the unstructured data. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the structured query includes a query in Structured Query Language (“SQL”). ### Claim 11 A computer-implemented system, comprising: one or more processors; and one or more non-transitory computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including: receiving a structured query in a structured query language; determining a schema that defines a structure for unstructured data, wherein the schema identifies a plurality of fields in the unstructured data; conducting a pilot query on the unstructured data, wherein the pilot query is conducted using the schema, and wherein conducting the pilot query identifies one or more fields in the unstructured data; converting the structured query in the structured query language into an unstructured query in an unstructured query language, wherein the conversion is done using the one or more fields identified by conducting the pilot query, and wherein the unstructured query is used to access the unstructured data; conducting a search on the unstructured data using the unstructured query; caching the one or more fields identified by conducting the pilot query; conducting a new pilot query on the unstructured data, wherein conducting the new pilot query identifies one or more new fields in the unstructured data; and merging the one or more cached fields with the one or more new fields. ### Claim 12 (depends on 11) The system of claim 11, wherein the pilot query is conducted on a subset of the unstructured data. ### Claim 13 (depends on 11) The system of claim 11, wherein the pilot query is conducted upon receiving the structured query. ### Claim 14 (depends on 11) The system of claim 11, wherein the pilot query is conducted prior to receiving the structured query. ### Claim 15 (depends on 11) The system of claim 11, further comprising instructions configured to cause the one or more processors to perform operations including: conducting a new pilot query on the unstructured data, wherein the new pilot query identifies one or more new fields in the unstructured data. ### Claim 16 (depends on 11) The system of claim 11, further comprising instructions configured to cause the one or more processors to perform operations including: conducting a new pilot query on the unstructured data, wherein conducting the new pilot query identifies one or more new fields in the unstructured data, and wherein the one or more new fields are different from the one or more fields. ### Claim 17 (depends on 11) The system of claim 11, wherein the schema includes a late-binding schema that has been previously developed for the unstructured data. ### Claim 18 (depends on 11) The system of claim 11, further comprising instructions configured to cause the one or more processors to perform operations including: presenting results of the search. ### Claim 19 (depends on 11) The system of claim 11, further comprising instructions configured to cause the one or more processors to perform operations including: obtaining properties for each of the one or more fields in the unstructured data. ### Claim 20 (depends on 11) The system of claim 11, wherein the structured query includes a query in Structured Query Language (“SQL”). ### Claim 21 A computer-program product, tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to: receive a structured query in a structured query language; determine a schema that defines a structure for unstructured data, wherein the schema identifies a plurality of fields in the unstructured data; conduct a pilot query on the unstructured data, wherein the pilot query is conducted using the schema, and wherein conducting the pilot query identifies one or more fields in the unstructured data; convert the structured query in the structured query language into an unstructured query in an unstructured query language, wherein the conversion is done using the one or more fields identified by conducting the pilot query, and wherein the unstructured query is used to access the unstructured data; conduct a search on the unstructured data using the unstructured query; cache the one or more fields identified by conducting the pilot query; conduct a new pilot query on the unstructured data, wherein conducting the new pilot query identifies one or more new fields in the unstructured data; and merge the one or more cached fields with the one or more new fields. ### Claim 22 (depends on 21) The computer-program product of claim 21, wherein the pilot query is conducted on a subset of the unstructured data. ### Claim 23 (depends on 21) The computer-program product of claim 21, wherein the pilot query is conducted upon receiving the structured query. ### Claim 24 (depends on 21) The computer-program product of claim 21, wherein the pilot query is conducted prior to receiving the structured query. ### Claim 25 (depends on 21) The computer-program product of claim 21, further comprising instructions configured to cause a data processing apparatus to: conduct a new pilot query on the unstructured data, wherein the new pilot query identifies one or more new fields in the unstructured data. ### Claim 26 (depends on 21) The computer-program product of claim 21, further comprising instructions configured to cause a data processing apparatus to: conduct a new pilot query on the unstructured data, wherein conducting the new pilot query identifies one or more new fields in the unstructured data, and wherein the one or more new fields are different from the one or more fields. ### Claim 27 (depends on 21) The computer-program product of claim 21, wherein the schema includes a late-binding schema that has been previously developed for the unstructured data. ### Claim 28 (depends on 21) The computer-program product of claim 21, further comprising instructions configured to cause a data processing apparatus to: present results of the search. ### Claim 29 (depends on 21) The computer-program product of claim 21, further comprising instructions configured to cause a data processing apparatus to: obtain properties for each of the one or more fields in the unstructured data. ### Claim 30 (depends on 21) The computer-program product of claim 21, wherein the structured query includes a query in Structured Query Language (“SQL”).