公开(公告)号：US20150019537A1

公开(公告)日：2015-01-15

申请号：US14503335

申请日：2014-09-30

Applicant: Splunk Inc.

Inventor： Alice Neels ,  Sundar Vasan ,  Simon Fishel ,  Marc Robichaud ,  Divanny Lamas

IPC: G06F17/30 ,  G06F3/0484 ,  G06F3/0481

CPC classification number: G06F16/338 ,  G06F3/0482 ,  G06F3/04842 ,  G06F3/04847 ,  G06F16/24575 ,  G06F16/2477 ,  G06F16/248 ,  G06F16/26 ,  G06F16/334 ,  G06F16/335 ,  G06F16/345 ,  G06F16/9024 ,  G06F16/9535 ,  G06F17/24 ,  G06T11/206 ,  G06T2200/24

Abstract: The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

Abstract translation: 本公开涉及用于从非结构化数据生成报告的某些系统和方法实施例。 在一个实施例中，一种方法可以包括识别匹配初始搜索查询的标准的事件（每个事件包括与时间相关联的原始机器数据的一部分），标识一组字段，每个字段被定义为一个或多个 识别的事件，导致显示包括一个或多个交互元件的交互式图形用户界面（GUI），使得用户能够定义用于提供与匹配事件有关的信息的报告（每个交互元件能够处理或呈现在 通过GUI接收指示如何报告与匹配事件有关的信息的报告定义，以及基于报告定义生成包括与所述事件相关的信息的报告的报告 匹配事件。

公开(公告)号：US11294559B2

公开(公告)日：2022-04-05

申请号：US16140447

申请日：2018-09-24

Applicant: Splunk Inc.

Inventor： Marc Robichaud

IPC: G06F3/0485

Abstract: The disclosed embodiments include techniques for navigating sections with exposable content in a viewing area. A method includes causing display, on a display device, of a view panel including contiguous sections. Each contiguous section includes a heading bar and content. The method further includes causing a portion of a first content of a first section to display on the display device by positioning a first heading bar of the first section at a first distance from a second heading bar of a second section. In response to a selection of the first heading bar, the first heading bar and/or the second heading bar is repositioned a second distance from each other. The second distance is greater than the first distance such that more of the first content is displayed.

公开(公告)号：US10783324B2

公开(公告)日：2020-09-22

申请号：US16541637

申请日：2019-08-15

Applicant: SPLUNK INC.

Inventor： Jesse Miller ,  Micah James Delfino ,  Marc Robichaud ,  Catherine Anne Hanson ,  David Carasso

IPC: G06F3/048 ,  G06F40/174 ,  G06F16/2458

Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

公开(公告)号：US10783318B2

公开(公告)日：2020-09-22

申请号：US15417430

申请日：2017-01-27

Applicant: Splunk, Inc.

Inventor： Jesse Miller ,  Micah James Delfino ,  Marc Robichaud ,  David Carasso

IPC: G06F3/048 ,  G06F40/166 ,  G06F16/904 ,  G06F16/2458 ,  G06F16/248 ,  G06F7/24 ,  G06F3/0484 ,  G06F40/169 ,  G06F40/177

Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

公开(公告)号：US20190025998A1

公开(公告)日：2019-01-24

申请号：US16140447

申请日：2018-09-24

Applicant: Splunk Inc.

Inventor： Marc Robichaud

IPC: G06F3/0485

Abstract: The disclosed embodiments include techniques for navigating sections with exposable content in a viewing area. A method includes causing display, on a display device, of a view panel including contiguous sections. Each contiguous section includes a heading bar and content. The method further includes causing a portion of a first content of a first section to display on the display device by positioning a first heading bar of the first section at a first distance from a second heading bar of a second section. In response to a selection of the first heading bar, the first heading bar and/or the second heading bar is repositioned a second distance from each other. The second distance is greater than the first distance such that more of the first content is displayed.

公开(公告)号：US10095397B2

公开(公告)日：2018-10-09

申请号：US13874223

申请日：2013-04-30

Applicant: Splunk Inc.

Inventor： Marc Robichaud

IPC: G06F3/0485

Abstract: Systems and methods for displaying an interface are provided. A system and method can be configured to display a scrollable viewing region. The viewing region can be a fixed size and the viewing region can facilitate displaying underlying content. Underlying content can be divided into multiple sectioned viewing areas, and each sectioned viewing area can have a corresponding heading. Headings can be docked or undocked. Input corresponding to a scroll movement can be received, and the viewing region can be adjusted according to the scroll movement. Adjusting a viewing region can include shifting the display of the underlying content by docking or undocking headings. Headings can be docked or undocked as they occur in the underlying content.

公开(公告)号：US20150026167A1

公开(公告)日：2015-01-22

申请号：US14448937

申请日：2014-07-31

Applicant: Splunk Inc.

Inventor： Alice Neels ,  Sundar Vasan ,  Simon Fishel ,  Marc Robichaud

IPC: G06F17/30 ,  G06F3/0482 ,  G06F3/0484

CPC classification number: G06F17/30867 ,  G06F3/0482 ,  G06F3/04842 ,  G06F17/30424 ,  G06F17/3053

Abstract: Fields may be discovered in events that are returned in response to an initial search. The events may comprise portions of raw data. Furthermore, the fields may be defined by extraction rules for extracting values from corresponding portions of raw data. The displaying of a graphical user interface (GUI) may be caused where the GUI enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar. At least one criterion for at least one field from the subset of the discovered fields may be received through a portion of the GUI that does not include a search bar for entering a search query. The events returned in response to the initial search query may be caused to be filtered based on the received criterion.

Abstract translation: 可以在响应初始搜索返回的事件中发现字段。 事件可以包括原始数据的部分。 此外，这些字段可以由用于从原始数据的相应部分提取值的提取规则来定义。 图形用户界面（GUI）的显示可能是在GUI允许用户选择或输入所发现的字段的子集的标准而不在搜索栏中输入搜索查询的情况下引起的。 可以通过不包括用于输入搜索查询的搜索栏的GUI的一部分来接收来自所发现字段的子集的至少一个字段的至少一个标准。 响应于初始搜索查询而返回的事件可能被导致根据接收到的标准进行过滤。

公开(公告)号：US20200012715A1

公开(公告)日：2020-01-09

申请号：US16541637

申请日：2019-08-15

Applicant: SPLUNK INC.

Inventor： Jesse Miller ,  Micah James Delfino ,  Marc Robichaud ,  Catherine Anne Hanson ,  David Carasso

IPC: G06F17/24 ,  G06F16/2458

Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

公开(公告)号：US10394946B2

公开(公告)日：2019-08-27

申请号：US15694654

申请日：2017-09-01

Applicant: SPLUNK INC.

Inventor： Jesse Miller ,  Micah James Delfino ,  Marc Robichaud ,  Catherine Anne Hanson ,  David Carasso

IPC: G06F3/048 ,  G06F17/24 ,  G06F16/2458

Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

公开(公告)号：US10296616B2

公开(公告)日：2019-05-21

申请号：US14449051

申请日：2014-07-31

Applicant: Splunk Inc.

Inventor： Alice Neels ,  Steve Zhang ,  Marc Robichaud

IPC: G06F17/30 ,  G06F17/00

Abstract: A processing device performs a preliminary grouping of data items in a dataset to define one or more clusters and for each cluster, identifies a set of search terms for a search query that would retrieve data items in the cluster upon execution of the search query against the dataset.