Event selection via graphical user interface control

    公开(公告)号:US11651149B1

    公开(公告)日:2023-05-16

    申请号:US17874046

    申请日:2022-07-26

    Applicant: SPLUNK Inc.

    CPC classification number: G06F40/174 G06F16/2477

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Graphical user interface for parsing events using a selected field delimiter option

    公开(公告)号:US11449464B2

    公开(公告)日:2022-09-20

    申请号:US16746611

    申请日:2020-01-17

    Applicant: SPLUNK INC.

    Inventor: Jesse Miller

    Abstract: A graphical user interface allows a customer to specify delimiters and/or patterns that occur in event data and indicate the presence of a particular field. The graphical user interface applies a customer's delimiter specifications directly to event data and displays the resulting event data in real time. Delimiter specifications may be saved as configuration settings and systems in a distributed setting may use the delimiter specifications to extract field values as the systems process raw data into event data. Extracted field values are used to accelerate search queries that a system receives.

    Locating and categorizing data using inverted indexes

    公开(公告)号:US11061918B2

    公开(公告)日:2021-07-13

    申请号:US15479823

    申请日:2017-04-05

    Applicant: Splunk Inc.

    Abstract: Systems and methods are disclosed for locating data and categorizing a set of data using inverted indexes. The inverted indexes include token entries and field-value pair entries, as well as event references that correspond to events that include raw machine data. Using filter criteria, the inverted indexes are identified. In turn, the inverted indexes are used to identify a set of events that satisfy the filter criteria. The identified set of events are categorized based on categorization criteria and provided for display to a user.

    Determining an extraction rule from positive and negative examples

    公开(公告)号:US11042697B2

    公开(公告)日:2021-06-22

    申请号:US16589445

    申请日:2019-10-01

    Applicant: SPLUNK INC.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Runtime permissions of queries
    20.
    发明授权

    公开(公告)号:US10235418B2

    公开(公告)日:2019-03-19

    申请号:US14815929

    申请日:2015-07-31

    Applicant: SPLUNK INC.

    Abstract: A method includes assigning an access permission of a first user to a query object that represents a first query, the access permission granting the first user access rights to one or more data sources of the first query, the access permission being assigned as a runtime permission of the first query, granting a request from a second user to execute a second query, the first query being a subquery of the second query, and allowing the second user to execute the first query on the one or more data sources of the first query using the runtime permission assigned to the first query in executing the second query using the first query as the subquery.

Patent Agency Ranking