# US 9,437,022 B2 · Time-based visualization of the number of events having various values for a field

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,437,022 B2
- Document ID: US9437022B2
- Status: Granted
- Kind: B2
- Application number: 14/165,232
- Filed: 2014-01-27
- Published: 2015-07-30
- Granted: 2016-09-06
- Earliest claimed: 2014-01-27
- Assignees: Splunk Inc.
- Applicants: Splunk Inc.
- Inventors: Philip John Vander Broek
- Web page: https://patentgrep.com/patent/US9437022B2

## CPC

- G06T 11/26: Drawing of charts or graphs
- G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
- G06F 3/0486: Drag-and-drop
- G06F 16/2477: {Temporal data queries}
- G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q 30/02: Marketing; Price estimation or determination; Fundraising
- G06Q 30/0201: Market modelling; Market analysis; Collecting market data
- G06T 11/10: Texturing; Colouring; Generation of textures or colours (retouching, inpainting or scratch removal G06T5/77)
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Systems and methods are provided for visualizing the number of events having different values for a field of interest over a selected time range. The events may be derived from machine data obtained from one or more data sources. User input received via a graphical user interface may specify the field of interest, a time range, and a time granularity for displaying counts of the number of events having various values during different time slots within the selected time range. Events including the specified field during the user-selected time range are identified and values for the field are extracted from the identified events. A visualization indicating a relation between a number of the events occurring within each of a plurality of time slots over the selected time range and each of the unique extracted values of the field is provided to the user via the graphical user interface.

## Claims

### Claim 1

A computer-implemented method comprising:
receiving a first user input via a graphical user interface, the input specifying a field and a time range;
identifying a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;
determining a set of unique values for the field from the identified set of events;
for each unique value in the set of unique values, identifying a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;
determining whether the set of unique values can be treated numerically;
in response to determining that the set of unique values can not be treated numerically, causing display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;
in response to determining that the set of unique values can be treated numerically, causing display of a scatter plot visualization.

### Claim 2 (depends on 1)

The method of claim 1, wherein the events are derived at least in part from machine data.

### Claim 3 (depends on 1)

The method of claim 1, wherein the events are derived at least in part from log files generated by one or more servers.

### Claim 4 (depends on 1)

The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade.

### Claim 5 (depends on 1)

The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a linear scale.

### Claim 6 (depends on 1)

The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a logarithmic scale.

### Claim 7 (depends on 1)

The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to an exponential scale.

### Claim 8 (depends on 1)

The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a rank assigned to that intersection based on the corresponding number of events.

### Claim 9 (depends on 1)

The method of claim 1, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection using a scale based on a maximum event count and a minimum event count determined from (i) intersections within a row including the intersection for which the color or shade is being applied, (ii) intersections within a column including the intersection for which the color or shade is being applied, or (iii) all displayed intersections.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
receiving input through a graphical control element that specifies a time granularity; and
determining a duration of time covered by each of the plurality of time slots based on the time granularity.

### Claim 11 (depends on 1)

The method of claim 1, further comprising:
receiving user input indicative of a column to be used for sorting the set of rows; and
sorting the set of rows, wherein each row is positioned in ascending or descending order based on the number of events corresponding to the intersection of that row with the column indicated by the user input.

### Claim 12 (depends on 1)

The method of claim 1, further comprising
displaying a statistic for each unique value in the set of unique values for the field, wherein the statistic for a given unique value includes a minimum event count corresponding to intersections in the row corresponding to the given unique value, a maximum event count corresponding to intersections in the row corresponding to the given unique value, an average of event counts corresponding to displayed intersections in the row corresponding to the given unique value, a total count of events in multiple displayed intersections in the row corresponding to the given unique value, or a percentage of the set of events that correspond to multiple displayed intersections in the row corresponding to the given unique value.

### Claim 13 (depends on 1)

The method of claim 1, further comprising:
displaying for each row a number representing a maximum count of events corresponding to intersections in the row or a number representing a minimum count of events corresponding to intersections in the row;
receiving input indicative of selection of the number; and
highlighting or visually distinguishing the intersection in the row that corresponds to the number.

### Claim 14 (depends on 1)

The method of claim 1, further comprising reordering the set of rows based on a drag and drop gesture received from a user input device.

### Claim 15 (depends on 1)

The method of claim 1, wherein the extraction rule is a regular expression.

### Claim 16 (depends on 1)

The method of claim 1, wherein the extraction rule is applied as a late binding schema.

### Claim 17

A non-transitory computer readable medium storing instructions that, when executed by a computer, cause the computer to perform functions to:
receiving a first user input via a graphical user interface, the input specifying a field and a time range;
identifying a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;
determining a set of unique values for the field from the identified set of events;
for each unique value in the set of unique values, identifying a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;
determining whether the set of unique values can be treated numerically;
in response to determining that the set of unique values can not be treated numerically, causing display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;
in response to determining that the set of unique values can be treated numerically, causing display of a scatter plot visualization.

### Claim 18 (depends on 17)

The non-transitory computer readable medium of claim 17, wherein the events are derived at least in part from machine data.

### Claim 19 (depends on 17)

The non-transitory computer readable medium of claim 17, wherein the extraction rule is a regular expression.

### Claim 20 (depends on 17)

The non-transitory computer readable medium of claim 17, wherein the extraction rule is applied as a late binding schema.

### Claim 21

A system comprising:
a memory having processor-readable instructions stored therein; and
a processor configured to access the memory and execute the processor-readable instructions, which when executed by the processor, configures the processor to perform a plurality of functions, including functions to:
receive a first user input via a graphical user interface, the input specifying a field and a time range;
identify a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;
determine a set of unique values for the field from the identified set of events;
for each unique value in the set of unique values, identify a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;
determine whether the set of unique values can be treated numerically;
in response to determining that the set of unique values can not be treated numerically, cause display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;
in response to determining that the set of unique values can be treated numerically, cause display of a scatter plot visualization.

### Claim 22 (depends on 21)

The system of claim 21, wherein the events are derived at least in part from machine data.

### Claim 23 (depends on 21)

The system of claim 21, wherein the events are derived at least in part from log files generated by one or more servers.

### Claim 24 (depends on 21)

The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade.

### Claim 25 (depends on 21)

The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a linear scale.

### Claim 26 (depends on 21)

The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a logarithmic scale.

### Claim 27 (depends on 21)

The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to an exponential scale.

### Claim 28 (depends on 21)

The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection according to a rank assigned to that intersection based on the corresponding number of events.

### Claim 29 (depends on 21)

The system of claim 21, wherein the indication of the number of events is an absolute or relative indication of the number of events that is provided using a color or shade, and the color or shade is applied to each intersection using a scale based on a maximum event count and a minimum event count determined from (i) intersections within a row including the intersection for which the color or shade is being applied, (ii) intersections within a column including the intersection for which the color or shade is being applied, or (iii) all displayed intersections.

### Claim 30 (depends on 21)

The system of claim 21, wherein the processor is further configured to perform functions to:
receive input through a graphical control element that specifies a time granularity; and
determine a duration of time covered by each of the plurality of time slots based on the time granularity.

### Claim 31 (depends on 21)

The system of claim 21, wherein the processor is further configured to perform functions to:
receive user input indicative of a column to be used for sorting the set of rows; and
sort the set of rows, wherein each row is positioned in ascending or descending order based on the number of events corresponding to the intersection of that row with the column indicated by the user input.

### Claim 32 (depends on 21)

The system of claim 21, wherein the processor is further configured to perform functions to display a statistic for each unique value in the set of unique values for the field, and wherein the statistic for a given unique value includes a minimum event count corresponding to intersections in the row corresponding to the given unique value, a maximum event count corresponding to intersections in the row corresponding to the given unique value, an average of event counts corresponding to displayed intersections in the row corresponding to the given unique value, a total count of events in multiple displayed intersections in the row corresponding to the given unique value, or a percentage of the set of events that correspond to multiple displayed intersections in the row corresponding to the given unique value.

### Claim 33 (depends on 21)

The system of claim 21, wherein the processor is further configured to perform functions to:
display for each row a number representing a maximum count of events corresponding to intersections in the row or a number representing a minimum count of events corresponding to intersections in the row;
receive input indicative of selection of the number; and
highlight or visually distinguish the intersection in the row that corresponds to the number.

### Claim 34 (depends on 21)

The system of claim 21, wherein the processor is further configured to perform functions to reorder the set of rows based on a drag and drop gesture received from a user input device.

### Claim 35 (depends on 21)

The system of claim 21, wherein the extraction rule is a regular expression.

### Claim 36 (depends on 21)

The system of claim 21, wherein the extraction rule is applied as a late binding schema.