Real time indication of previously extracted data fields for regular expressions
View Patent ↗Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion.
1. A computer-implemented method, comprising:
receiving raw data on a computing device;
dividing the raw data into a set of time stamped searchable events;
storing the set of events in an indexed data store;
applying an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value;
extracting a value from a field within an event, wherein the value is extracted using the extraction rule; and
displaying the event in a graphical interface, wherein the value extracted from the field within the event is emphasized.
2. The method of claim 1 , wherein the set of events includes unstructured machine data.
3. The method of claim 1 , wherein the extraction rule includes a regular expression.
4. The method of claim 1 , wherein the extraction rule includes a regular expression automatically generated to extract a value selected from an event.
5. The method of claim 1 , further comprising:
receiving input corresponding to a selection of the emphasized value from the displayed event; and
displaying one or more extraction rules that extract the selected emphasized value from the event when applied to the event.
6. The method of claim 1 , further comprising:
receiving input corresponding to a selection of the emphasized value from the displayed event, wherein the selected emphasized value is included within a plurality of fields defined by a plurality of extraction rules, and wherein the plurality of fields at least partially overlap each other; and
displaying one or more of the plurality of extraction rules.
7. The method of claim 1 , further comprising:
receiving input corresponding to a selection of the emphasized value from the displayed event; and
displaying two or more extraction rules that are associated with the selected emphasized value.
8. The method of claim 1 , further comprising:
extracting an additional value from the displayed event using an additional extraction rule; and
emphasizing the additional value differently than the displayed emphasized value.
9. The method of claim 1 , further comprising:
extracting an additional value in an additional filed defined by an additional extraction rule; and
determining that the field and the additional field overlap.
10. The method of claim 1 , further comprising:
extracting an additional value in an additional filed defined by an additional extraction rule;
determining that the field and the additional field overlap;
receiving input corresponding to a hovering or a selection over an overlapping portion of the value and the additional value; and
concurrently displaying the value and the additional value.
11. A system, comprising:
a processor; and
a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including:
receiving raw data on a computing device;
dividing the raw data into a set of time stamped searchable events;
storing the set of events in an indexed data store;
applying an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value;
extracting a value from a field within an event, wherein the value is extracted using the extraction rule; and
displaying the event in a graphical interface, wherein the value extracted from the field within the event is emphasized.
12. The system of claim 11 , wherein the set of events includes unstructured machine data.
13. The system of claim 11 , wherein the extraction rule includes a regular expression.
14. The system of claim 11 , wherein the extraction rule includes a regular expression automatically generated to extract a value selected from an event.
15. The system of claim 11 , further comprising instructions configured to cause the processor to perform operations including:
receiving input corresponding to a selection of the emphasized value from the displayed event; and
displaying one or more extraction rules that extract the selected emphasized value from the event when applied to the event.
16. The system of claim 11 , further comprising instructions configured to cause the processor to perform operations including:
receiving input corresponding to a selection of the emphasized value from the displayed event, wherein the selected emphasized value is included within a plurality of fields defined by a plurality of extraction rules, and wherein the plurality of fields at least partially overlap each other; and
displaying one or more of the plurality of extraction rules.
17. The system of claim 11 , further comprising instructions configured to cause the processor to perform operations including:
receiving input corresponding to a selection of the emphasized value from the displayed event; and
displaying two or more extraction rules that are associated with the selected emphasized value.
18. The system of claim 11 , further comprising instructions configured to cause the processor to perform operations including:
extracting an additional value from the displayed event using an additional extraction rule; and
emphasizing the additional value differently than the displayed emphasized value.
19. The system of claim 11 , further comprising instructions configured to cause the processor to perform operations including:
extracting an additional value in an additional filed defined by an additional extraction rule; and
determining that the field and the additional field overlap.
20. The system of claim 11 , further comprising instructions configured to cause the processor to perform operations including:
extracting an additional value in an additional filed defined by an additional extraction rule;
determining that the field and the additional field overlap;
receiving input corresponding to a hovering or a selection over an overlapping portion of the value and the additional value; and
concurrently displaying the value and the additional value.
21. A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:
receive raw data on a computing device;
divide the raw data into a set of time stamped searchable events;
store the set of events in an indexed data store;
apply an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value;
extract a value from a field within an event, wherein the value is extracted using the extraction rule; and
display the event in a graphical interface, wherein the value extracted from the field within the event is emphasized.
22. The computer-program product of claim 21 , wherein the set of events includes unstructured machine data.
23. The computer-program product of claim 21 , wherein the extraction rule includes a regular expression.
24. The computer-program product of claim 21 , wherein the extraction rule includes a regular expression automatically generated to extract a value selected from an event.
25. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to:
receive input corresponding to a selection of the emphasized value from the displayed event; and
display one or more extraction rules that extract the selected emphasized value from the event when applied to the event.
26. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to:
receive input corresponding to a selection of the emphasized value from the displayed event, wherein the selected emphasized value is included within a plurality of fields defined by a plurality of extraction rules, and wherein the plurality of fields at least partially overlap each other; and
display one or more of the plurality of extraction rules.
27. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to:
receive input corresponding to a selection of the emphasized value from the displayed event; and
display two or more extraction rules that are associated with the selected emphasized value.
28. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to:
extract an additional value from the displayed event using an additional extraction rule; and
emphasize the additional value differently than the displayed emphasized value.
29. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to:
extract an additional value in an additional filed defined by an additional extraction rule; and
determine that the field and the additional field overlap.
30. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to:
extract an additional value in an additional filed defined by an additional extraction rule;
determine that the field and the additional field overlap;
receive input corresponding to a hovering or a selection over an overlapping portion of the value and the additional value; and
concurrently display the value and the additional value.