Facilitating modification of an extracted field

    公开(公告)号:US10430505B2

    公开(公告)日:2019-10-01

    申请号:US15417430

    申请日:2017-01-27

    Applicant: Splunk, Inc.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    REFINING EXTRACTION RULES BASED ON SELECTED TEXT WITHIN EVENTS

    公开(公告)号:US20180267947A1

    公开(公告)日:2018-09-20

    申请号:US15694654

    申请日:2017-09-01

    Applicant: SPLUNK INC.

    CPC classification number: G06F17/243 G06F16/2477

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Advanced field extractor with multiple positive examples

    公开(公告)号:US09753909B2

    公开(公告)日:2017-09-05

    申请号:US14610668

    申请日:2015-01-30

    Applicant: Splunk Inc.

    CPC classification number: G06F17/243 G06F17/30551

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Advanced field extractor with modification of an extracted field
    14.
    发明授权
    Advanced field extractor with modification of an extracted field 有权
    高级字段提取器,具有提取字段的修改

    公开(公告)号:US09594814B2

    公开(公告)日:2017-03-14

    申请号:US14611089

    申请日:2015-01-30

    Applicant: Splunk Inc.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Abstract translation: 所公开的技术涉及制定和提炼在查询时使用具有后期绑定模式的原始数据的字段提取规则。 字段提取规则识别原始数据的部分,以及它们的数据类型和层次关系。 这些提取规则是针对未组织成尚未通过标准提取或转换方法处理的关系结构的非常大的数据集执行的。 通过使用示例事件,关注主要和次要示例事件有助于制定跨多个数据格式的单个提取规则,或者针对不同格式的多个规则。 选择工具标记示例事件以指示提取规则的正例,并确定负面示例以避免错误的值选择。 提取规则可以保存以供查询时间使用,并且可以被并入事件数据的集合和子集的数据模型中。

    INTERACTIVE SELECTION AND DISPLAY OF A RAW DATA PARSING RULE
    15.
    发明申请
    INTERACTIVE SELECTION AND DISPLAY OF A RAW DATA PARSING RULE 有权
    互动选择和显示原始数据分配规则

    公开(公告)号:US20160342696A1

    公开(公告)日:2016-11-24

    申请号:US15224655

    申请日:2016-07-31

    Applicant: Splunk Inc.

    Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

    Abstract translation: 实施例针对在将对应的索引数据添加到索引存储之前预览从索引数据原始数据生成的结果。 可以从预览数据源接收原始数据。 在可以建立一组初始配置信息之后,可以将预览数据提交给索引处理流水线。 预览应用可以基于预览索引数据和配置信息生成预览结果。 预览结果可能可以预览索引应用程序如何处理数据。 如果预览结果不可接受,则可以修改配置信息。 预览应用程序可以修改配置信息,直到生成的预览结果可以接受。 如果配置信息是可接受的,则预览数据可以在一个或多个索引存储中被处理和索引。

    ADVANCED FIELD EXTRACTOR WITH MODIFICATION OF AN EXTRACTED FIELD
    16.
    发明申请
    ADVANCED FIELD EXTRACTOR WITH MODIFICATION OF AN EXTRACTED FIELD 有权
    先进的场提取器,具有改进的领域

    公开(公告)号:US20150154269A1

    公开(公告)日:2015-06-04

    申请号:US14611089

    申请日:2015-01-30

    Applicant: Splunk Inc.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Abstract translation: 所公开的技术涉及制定和提炼在查询时使用具有后期绑定模式的原始数据的字段提取规则。 字段提取规则识别原始数据的部分,以及它们的数据类型和层次关系。 这些提取规则是针对未组织成尚未通过标准提取或转换方法处理的关系结构的非常大的数据集执行的。 通过使用示例事件,关注主要和次要示例事件有助于制定跨多个数据格式的单个提取规则,或者针对不同格式的多个规则。 选择工具标记示例事件以指示提取规则的正例,并确定负面示例以避免错误的值选择。 提取规则可以保存以供查询时间使用,并且可以被并入事件数据的集合和子集的数据模型中。

    Wizard for configuring a field extraction rule

    公开(公告)号:US10783324B2

    公开(公告)日:2020-09-22

    申请号:US16541637

    申请日:2019-08-15

    Applicant: SPLUNK INC.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

    Facilitating modification of an extracted field

    公开(公告)号:US10783318B2

    公开(公告)日:2020-09-22

    申请号:US15417430

    申请日:2017-01-27

    Applicant: Splunk, Inc.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

Patent Agency Ranking