LOCATING AND CATEGORIZING DATA USING INVERTED INDEXES

    公开(公告)号:US20180293327A1

    公开(公告)日:2018-10-11

    申请号:US15479823

    申请日:2017-04-05

    Applicant: Splunk Inc.

    Abstract: Systems and methods are disclosed for locating data and categorizing a set of data using inverted indexes. The inverted indexes include token entries and field-value pair entries, as well as event references that correspond to events that include raw machine data. Using filter criteria, the inverted indexes are identified. In turn, the inverted indexes are used to identify a set of events that satisfy the filter criteria. The identified set of events are categorized based on categorization criteria and provided for display to a user.

    FILE BROWSER USER INTERFACE
    22.
    发明申请

    公开(公告)号:US20170270132A1

    公开(公告)日:2017-09-21

    申请号:US14611227

    申请日:2015-01-31

    Applicant: Splunk Inc.

    CPC classification number: G06F16/134 G06F16/148 G06F16/168 G06F16/182

    Abstract: A search support system allows a customer to browse data contained in files stored on an external storage system. The search support system allows a customer to specify data processing tasks to be performed on raw data retrieved from a file stored on the external storage system. The customer specifies each data processing task and the search support system performs each task as it is selected by the customer on raw data retrieved from the file. The search support system concurrently displays the results of each data processing task in real time in a graphical user interface. The search support system saves the customer's settings as a late binding schema that can be applied to raw data retrieved from the external storage system in order to parse the raw data and to create, index, and search timestamped events derived from the raw data.

    Source type definition configuration using a graphical user interface

    公开(公告)号:US11789901B2

    公开(公告)日:2023-10-17

    申请号:US17443436

    申请日:2021-07-26

    Applicant: Splunk Inc.

    Abstract: A data intake and query system provides interfaces that enable users to configure source type definitions used by the system. A data intake and query system generally refers to a system for collecting and analyzing data including machine-generated data. Such a system may be configured to consume many different types of machine data generated by any number of different data sources including various servers, network devices, applications, etc. At a high level, a source type definition comprises one or more properties that define how various components of a data intake and query system collect, index, store, search and otherwise interact with particular types of data consumed by the system. The interfaces provided by the system generally comprise one or more interface components for configuring various attributes of a source type definition.

    Graphical user interface for parsing events using a designated field delimiter

    公开(公告)号:US11604763B2

    公开(公告)日:2023-03-14

    申请号:US17589799

    申请日:2022-01-31

    Applicant: Splunk Inc.

    Inventor: Jesse Miller

    Abstract: A graphical user interface allows a customer to specify delimiters and/or patterns that occur in event data and indicate the presence of a particular field. The graphical user interface applies a customer's delimiter specifications directly to event data and displays the resulting event data in real time. Delimiter specifications may be saved as configuration settings and systems in a distributed setting may use the delimiter specifications to extract field values as the systems process raw data into event data. Extracted field values may be used to accelerate search queries that a system receives.

    Providing extraction results for a particular field

    公开(公告)号:US11423216B2

    公开(公告)日:2022-08-23

    申请号:US17169254

    申请日:2021-02-05

    Applicant: SPLUNK Inc.

    Abstract: The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

Patent Agency Ranking