# US 8,751,963 B1 · Real time indication of previously extracted data fields for regular expressions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,963 B1 - Document ID: US8751963B1 - Status: Granted - Kind: B1 - Application number: 13/748,391 - Filed: 2013-01-23 - Granted: 2014-06-10 - Earliest claimed: 2013-01-23 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: R. David Carasso; Micah James Delfino; Johnvey Hwang - Web page: https://patentgrep.com/patent/US8751963B1 ## CPC - G06F 7/24: Sorting, i.e. extracting data from one or more carriers, rearranging the data in numerical or other ordered sequence, and rerecording the sorted data on the original carrier or on a different carrier or set of carriers {sorting methods in general}(G06F7/36 takes precedence) - G06F 16/2477: {Temporal data queries} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving raw data on a computing device; dividing the raw data into a set of time stamped searchable events; storing the set of events in an indexed data store; applying an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value; extracting a value from a field within an event, wherein the value is extracted using the extraction rule; and displaying the event in a graphical interface, wherein the value extracted from the field within the event is emphasized. ### Claim 2 (depends on 1) The method of claim 1, wherein the set of events includes unstructured machine data. ### Claim 3 (depends on 1) The method of claim 1, wherein the extraction rule includes a regular expression. ### Claim 4 (depends on 1) The method of claim 1, wherein the extraction rule includes a regular expression automatically generated to extract a value selected from an event. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving input corresponding to a selection of the emphasized value from the displayed event; and displaying one or more extraction rules that extract the selected emphasized value from the event when applied to the event. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving input corresponding to a selection of the emphasized value from the displayed event, wherein the selected emphasized value is included within a plurality of fields defined by a plurality of extraction rules, and wherein the plurality of fields at least partially overlap each other; and displaying one or more of the plurality of extraction rules. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving input corresponding to a selection of the emphasized value from the displayed event; and displaying two or more extraction rules that are associated with the selected emphasized value. ### Claim 8 (depends on 1) The method of claim 1, further comprising: extracting an additional value from the displayed event using an additional extraction rule; and emphasizing the additional value differently than the displayed emphasized value. ### Claim 9 (depends on 1) The method of claim 1, further comprising: extracting an additional value in an additional filed defined by an additional extraction rule; and determining that the field and the additional field overlap. ### Claim 10 (depends on 1) The method of claim 1, further comprising: extracting an additional value in an additional filed defined by an additional extraction rule; determining that the field and the additional field overlap; receiving input corresponding to a hovering or a selection over an overlapping portion of the value and the additional value; and concurrently displaying the value and the additional value. ### Claim 11 A system, comprising: a processor; and a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including: receiving raw data on a computing device; dividing the raw data into a set of time stamped searchable events; storing the set of events in an indexed data store; applying an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value; extracting a value from a field within an event, wherein the value is extracted using the extraction rule; and displaying the event in a graphical interface, wherein the value extracted from the field within the event is emphasized. ### Claim 12 (depends on 11) The system of claim 11, wherein the set of events includes unstructured machine data. ### Claim 13 (depends on 11) The system of claim 11, wherein the extraction rule includes a regular expression. ### Claim 14 (depends on 11) The system of claim 11, wherein the extraction rule includes a regular expression automatically generated to extract a value selected from an event. ### Claim 15 (depends on 11) The system of claim 11, further comprising instructions configured to cause the processor to perform operations including: receiving input corresponding to a selection of the emphasized value from the displayed event; and displaying one or more extraction rules that extract the selected emphasized value from the event when applied to the event. ### Claim 16 (depends on 11) The system of claim 11, further comprising instructions configured to cause the processor to perform operations including: receiving input corresponding to a selection of the emphasized value from the displayed event, wherein the selected emphasized value is included within a plurality of fields defined by a plurality of extraction rules, and wherein the plurality of fields at least partially overlap each other; and displaying one or more of the plurality of extraction rules. ### Claim 17 (depends on 11) The system of claim 11, further comprising instructions configured to cause the processor to perform operations including: receiving input corresponding to a selection of the emphasized value from the displayed event; and displaying two or more extraction rules that are associated with the selected emphasized value. ### Claim 18 (depends on 11) The system of claim 11, further comprising instructions configured to cause the processor to perform operations including: extracting an additional value from the displayed event using an additional extraction rule; and emphasizing the additional value differently than the displayed emphasized value. ### Claim 19 (depends on 11) The system of claim 11, further comprising instructions configured to cause the processor to perform operations including: extracting an additional value in an additional filed defined by an additional extraction rule; and determining that the field and the additional field overlap. ### Claim 20 (depends on 11) The system of claim 11, further comprising instructions configured to cause the processor to perform operations including: extracting an additional value in an additional filed defined by an additional extraction rule; determining that the field and the additional field overlap; receiving input corresponding to a hovering or a selection over an overlapping portion of the value and the additional value; and concurrently displaying the value and the additional value. ### Claim 21 A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to: receive raw data on a computing device; divide the raw data into a set of time stamped searchable events; store the set of events in an indexed data store; apply an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value; extract a value from a field within an event, wherein the value is extracted using the extraction rule; and display the event in a graphical interface, wherein the value extracted from the field within the event is emphasized. ### Claim 22 (depends on 21) The computer-program product of claim 21, wherein the set of events includes unstructured machine data. ### Claim 23 (depends on 21) The computer-program product of claim 21, wherein the extraction rule includes a regular expression. ### Claim 24 (depends on 21) The computer-program product of claim 21, wherein the extraction rule includes a regular expression automatically generated to extract a value selected from an event. ### Claim 25 (depends on 21) The computer-program product of claim 21, further including instructions configured to cause the data processing apparatus to: receive input corresponding to a selection of the emphasized value from the displayed event; and display one or more extraction rules that extract the selected emphasized value from the event when applied to the event. ### Claim 26 (depends on 21) The computer-program product of claim 21, further including instructions configured to cause the data processing apparatus to: receive input corresponding to a selection of the emphasized value from the displayed event, wherein the selected emphasized value is included within a plurality of fields defined by a plurality of extraction rules, and wherein the plurality of fields at least partially overlap each other; and display one or more of the plurality of extraction rules. ### Claim 27 (depends on 21) The computer-program product of claim 21, further including instructions configured to cause the data processing apparatus to: receive input corresponding to a selection of the emphasized value from the displayed event; and display two or more extraction rules that are associated with the selected emphasized value. ### Claim 28 (depends on 21) The computer-program product of claim 21, further including instructions configured to cause the data processing apparatus to: extract an additional value from the displayed event using an additional extraction rule; and emphasize the additional value differently than the displayed emphasized value. ### Claim 29 (depends on 21) The computer-program product of claim 21, further including instructions configured to cause the data processing apparatus to: extract an additional value in an additional filed defined by an additional extraction rule; and determine that the field and the additional field overlap. ### Claim 30 (depends on 21) The computer-program product of claim 21, further including instructions configured to cause the data processing apparatus to: extract an additional value in an additional filed defined by an additional extraction rule; determine that the field and the additional field overlap; receive input corresponding to a hovering or a selection over an overlapping portion of the value and the additional value; and concurrently display the value and the additional value.