INTERFACE FOR MANAGING SPLITTABLE TIMESTAMPS ACROSS EVENT RECORDS
Embodiments are directed towards a graphical user interface to identify locations within event records with splittable timestamp information. A display of event records is provided using any of a variety of formats. A splittable timestamp selector allows a user to select one or more locations within event records as having time related information that may be split across the one or more locations, including, information based on date, time of day, day of the week, or other time information. Any of a plurality of mechanisms is used to associate the selected locations with the split timestamp information, including tags, labels, or header information within the event records. In other embodiments, a separate table, list, index, or the like may be generated that associates the selected locations with the split timestamp information. The split timestamp information may be used within extraction rules for selecting subsets of the event records.
1 - 30 . (canceled)
31 . A method, comprising:
receiving raw data;
generating one or more events for a computing system, wherein each event includes a portion of the raw data;
causing generation of a graphical interface on a computing device, wherein the graphical interface displays at least one of the events and a timestamp selection tool, and wherein a timestamp selection tool is a graphical interface tool that enables a user to graphically designate one or more sub-portions of raw data within an event to be extracted and used to generate a timestamp for the event;
receiving input corresponding to a designation of the one or more sub-portions of raw data within the event, wherein the designation is made using the timestamp selection tool;
dynamically generating and storing an extraction rule for determining a timestamp for the event from the designated one or more sub-portions of raw data in the event;
for each of the one or more events, applying the extraction rule to the portion of raw data in the event to generate a timestamp for the event;
storing each of the one or more events using the extracted timestamp for that event;
wherein the method is performed by one or more computing devices.
32 - 39 . (canceled)
40 . A system for managing resources, comprising:
at least one network device, comprising:
a processor; and
a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including:
receiving raw data;
generating one or more events for a computing system, wherein each event includes a portion of the raw data;
causing generation of a graphical interface on a computing device, wherein the graphical interface displays at least one of the events and a timestamp selection tool, and wherein a timestamp selection tool is a graphical interface tool that enables a user to graphically designate one or more sub-portions of raw data within an event to be extracted and used to generate a timestamp for the event;
receiving input corresponding to a designation of the one or more sub-portions of raw data within the event, wherein the designation is made using the timestamp selection tool;
dynamically generating and storing an extraction rule for determining a timestamp for the event from the designated one or more sub-portions of raw data in the event;
for each of the one or more events, applying the extraction rule to the portion of raw data in the event to generate a timestamp for the event;
storing each of the one or more events using the extracted timestamp for that event.
41 - 48 . (canceled)
49 . A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:
receive raw data;
generate one or more events for a computing system, wherein each event includes a portion of the raw data;
cause generation of a graphical interface on a computing device, wherein the graphical interface displays at least one of the events and a timestamp selection tool, and wherein a timestamp selection tool is a graphical interface tool that enables a user to graphically designate one or more sub-portions of raw data within an event to be extracted and used to generate a timestamp for the event;
receive input corresponding to a designation of the one or more sub-portions of raw data within the event, wherein the designation is made using the timestamp selection tool;
dynamically generate and store an extraction rule for determining a timestamp for the event from the designated one or more sub-portions of raw data in the event;
for each of the one or more events, apply the extraction rule to the portion of raw data in the event to generate a timestamp for the event;
store each of the one or more events using the extracted timestamp for that event.
50 - 60 . (canceled)
61 . The method of claim 31 , wherein receiving input corresponding to the designation of the one or more sub-portions of raw data comprises receiving input corresponding to the designation of at least two portions of raw data using the timestamp selection tool.
62 . The method of claim 31 , wherein receiving input corresponding to the designation of the one or more sub-portions of raw data comprises receiving input corresponding to the designation of two portions of raw data using the timestamp selection tool, wherein the timestamp selection tool is split into two graphical user interface elements to designate the two portions of raw data.
63 . The method of claim 31 , wherein the event for which the timestamp selection tool is used to designate one or more sub-portions of raw data includes time information that is not extracted to use for generating the timestamp for that event.
64 . The method of claim 31 , wherein the raw data includes unstructured data.
65 . The method of claim 31 , wherein the raw data includes machine data.
66 . The method of claim 31 , further comprising using one of a tag, a label, or a header to create an association between the timestamp and the one or more sub-portions of raw data within the event.
67 . The method of claim 31 , further comprising using one of a table, a list, or an index to create an association between the timestamp and the one or more sub-portions of raw data within the event.
68 . The method of claim 31 , wherein each of the one or more sub-portions of raw data designated in the event by the timestamp selection tool includes one or more of a year, a month, a day, and a time of day.
69 . The method of claim 31 , wherein at least one of the one or more sub-portions of raw data corresponds to a field that defines a location across multiple events for a category of time information.
70 . The system of claim 40 , wherein receiving input corresponding to the designation of the one or more sub-portions of raw data comprises receiving input corresponding to the designation of at least two portions of raw data using the timestamp selection tool.
71 . The system of claim 40 , wherein receiving input corresponding to the designation of the one or more sub-portions of raw data comprises receiving input corresponding to the designation of two portions of raw data using the timestamp selection tool, wherein the timestamp selection tool is split into two graphical user interface elements to designate the two portions of raw data.
72 . The system of claim 40 , wherein the event for which the timestamp selection tool is used to designate one or more sub-portions of raw data includes time information that is not extracted to use for generating the timestamp for that event.
73 . The system of claim 40 , wherein the raw data includes unstructured data.
74 . The system of claim 40 , wherein the raw data includes machine data.
75 . The system of claim 40 , wherein the operations further comprise using one of a tag, a label, or a header to create an association between the timestamp and the one or more sub-portions of raw data within the event.
76 . The system of claim 40 , wherein the operations further comprise using one of a table, a list, or an index to create an association between the timestamp and the one or more sub-portions of raw data within the event.
77 . The system of claim 40 , wherein each of the one or more sub-portions of raw data designated in the event by the timestamp selection tool includes one or more of a year, a month, a day, and a time of day.
78 . The system of claim 40 , wherein at least one of the one or more sub-portions of raw data corresponds to a field that defines a location across multiple events for a category of time information.
79 . The computer-program product of claim 49 , wherein the instructions is configured to further cause the data processing apparatus to receive input corresponding to the designation of at least two portions of raw data using the timestamp selection tool.
80 . The computer-program product of claim 49 , wherein the instructions is configured to further cause the data processing apparatus to receive input corresponding to the designation of two portions of raw data using the timestamp selection tool, wherein the timestamp selection tool is split into two graphical user interface elements to designate the two portions of raw data.
81 . The computer-program product of claim 49 , wherein the event for which the timestamp selection tool is used to designate one or more sub-portions of raw data includes time information that is not extracted to use for generating the timestamp for that event.
82 . The computer-program product of claim 49 , wherein the raw data includes unstructured data.
83 . The computer-program product of claim 49 , wherein the raw data includes machine data.
84 . The computer-program product of claim 49 , wherein the instructions is configured to further cause the data processing apparatus to use one of a tag, a label, or a header to create an association between the timestamp and the one or more sub-portions of raw data within the event.
85 . The computer-program product of claim 49 , wherein the instructions is configured to further cause the data processing apparatus to use one of a table, a list, or an index to create an association between the timestamp and the one or more sub-portions of raw data within the event.
86 . The computer-program product of claim 49 , wherein each of the one or more sub-portions of raw data designated in the event by the timestamp selection tool includes one or more of a year, a month, a day, and a time of day.
87 . The computer-program product of claim 49 , wherein at least one of the one or more sub-portions of raw data corresponds to a field that defines a location across multiple events for a category of time information.