Event time selection output techniques
View Patent ↗Event time selection output techniques are described. In one or more implementations, one or more inputs are received, at one or more computing devices, that involve interaction associated with a particular one of a plurality of events via a user interface, in which the plurality of events result from a search of data, each of the plurality of events include the data that is associated with a respective point in time, and the one or more inputs specify a relative time in relation to the respective point in time of the particular event. A determination is made as to which of the plurality of events correspond to the specified relative time by the one or more computing devices and a result of the determination is output by the one or more computing devices for display in the user interface.
1. A computer-implemented method comprising:
accessing a set of events in a data store, each event corresponding to a portion of raw machine data that is produced by a component of an information technology environment, and each event including a timestamp associated with the portion of raw machine data corresponding to the event;
causing display of the accessed set of events in a graphical user interface;
receiving a first user selection of a particular event of the displayed set of events via the graphical user interface;
causing display of a set of options such that the set of options is displayed without navigating away from the displayed set of events in the graphical user interface, wherein a particular option from the displayed set of options specifies a relative time that is in relation to and automatically determined from the timestamp of the selected particular event;
receiving a second user selection of the displayed particular option via the graphical user interface;
in response to receiving the second user selection, determining from a plurality of events, a subset of the plurality of events based on identifying that the timestamp of each event of the subset corresponds to the relative time; and
causing updating of the displayed set of events such that the determined subset of events is displayed in the graphical user interface.
2. A method as described in claim 1 , wherein the plurality of events results from a search of data for the plurality of events.
3. A method as described in claim 1 , wherein the plurality of events results from a search of data performed using one or more extraction rules of a late-binding schema applied to the portion of raw machine data of the plurality of events.
4. A method as described in claim 1 , wherein the first or the second user selection is of a display of the timestamp of the particular event.
5. A method as described in claim 1 , wherein the first or the second user selection comprises a user interaction with a representation of the timestamp of the particular event.
6. A method as described in claim 1 , wherein the first or the second user selection comprises a user interaction with a representation of the timestamp of the particular event, the representation included with a display of a plurality of fields corresponding to the portion of raw machine data of the particular event.
7. A method as described in claim 1 , wherein the first or the second user selection comprises a non-modal user interaction with an option output in response to an initial user selection of a representation of the timestamp of the particular event.
8. A method as described in claim 1 , wherein the first or the second user selection comprises a user interaction with the particular event through an initial user selection of a feature associated with a search input portion of the graphical user interface.
9. A method as described in claim 1 , wherein the particular option selected by the second user selection specifies the relative time as a range of time in relation to the timestamp of the particular event.
10. A method as described in claim 1 , wherein the particular option selected by the second user selection is configured to receive a user input that specifies the relative time as an amount of time in relation to the timestamp of the particular event automatically and without user intervention by the one or more computing devices without involving manual entry of the relative time by the user, and the relative time is automatically determined from the amount of time.
11. A method as described in claim 1 , wherein the particular option selected by the second user selection is configured to receive a user point in time timestamp of the particular event, and the relative time is automatically determined from the amount of time.
12. A method as described in claim 1 , wherein the accessing includes performing a search by applying a late-binding schema to the set of events using one or more extraction rules to extract values for fields defined by the late-binding schema from the set of events.
13. A method as described in claim 1 , wherein the relative time is a range of time, and the second user selection causes execution of a search query in the determining of the subset of the plurality of events to search within the range of time.
14. A method as described in claim 1 , wherein the display of the set of events is in an events list of the graphical user interface, and the display of the determined subset of events replaces the set of events in the events list with the subset of events.
15. A method as described in claim 1 , wherein the plurality of events include data corresponding to a search using one or more extraction rules and the determining is performed using the relative time and the one or more extraction rules.
16. A method as described in claim 1 , wherein the plurality of events include data corresponding to a search using one or more extraction rules and the determining is performed using the relative time and without using the one or more extraction rules.
17. A method as described in claim 1 , wherein the set of options of the second user selection includes a list of relative points in time, each relative point in time being a different amount of time to offset the timestamp of the particular event by to result in the relative time.
18. A method as described in claim 1 , wherein the particular option selected by the second user selection comprises a user interaction with a non-modal option in a pop-up menu to specify the relative time without navigating away from the graphical user interface.
19. A method as described in claim 1 , wherein the particular option selected by the second user selection specifies an amount of time before or after the timestamp, and the relative time is automatically determined from the amount of time.
20. A method as described in claim 1 , wherein the particular option selected by the second user selection comprises an initial user selection of an option that indicates that the relative time is the timestamp.
21. A computer-implemented system comprising:
one or more computing devices configured to perform operations comprising:
accessing a set of events in a data store, each event corresponding to a portion of raw machine data that is produced by a component of an information technology environment, and each event including a timestamp associated with the portion of raw machine data corresponding to the event;
causing display of the accessed set of events in a graphical user interface;
receiving a first user selection of a particular event of the displayed set of events via the graphical user interface;
causing display of a set of options such that the set of options is displayed without navigating away from the displayed set of events in the graphical user interface, wherein a particular option from the displayed set of options specifies a relative time that is in relation to and automatically determined from the timestamp of the selected particular event;
receiving a second user selection of the displayed particular option via the graphical user interface;
in response to receiving the second user selection, determining from a plurality of events, a subset of the plurality of events based on identifying that the timestamp of each event of the subset corresponds to the relative time; and
causing updating of the displayed set of events such that the determined subset of events is displayed in the graphical user interface.
22. A system as described in claim 21 , wherein the first user selection comprises an initial user selection of a display of the timestamp that is associated with the particular event.
23. A system as described in claim 21 , wherein the first or the second user selection comprises a user interaction with a representation of the timestamp associated with of the particular event.
24. A system as described in claim 21 , wherein the first or the second user selection comprises a user interaction with a representation of the timestamp of the event, the representation included with a display of a plurality of fields corresponding to the particular event in the graphical user interface.
25. A system as described in claim 21 , wherein the first or the second user selection comprises a user interaction with the particular event through an initial user selection of a feature associated with a search input portion of the graphical user interface.
26. One or more computer-readable storage media comprising instructions that are stored thereon that, responsive to execution by a computing device, causes the computing device to perform operations comprising:
accessing a set of events in a data store, each event corresponding to a portion of raw machine data that is produced by a component of an information technology environment, and each event including a timestamp associated with the portion of raw machine data corresponding to the event;
causing display of the accessed set of events in a graphical user interface;
receiving a first user selection of a particular event of the displayed set of events via the graphical user interface;
causing display of a set of options such that the set of options is displayed without navigating away from the displayed set of events in the graphical user interface, wherein a particular option from the displayed set of options specifies a relative time that is in relation to and automatically determined from the timestamp of the selected particular event;
receiving a second user selection of the displayed particular option via the graphical user interface;
in response to receiving the second user selection, determining from a plurality of events, a subset of the plurality of events based on identifying that the timestamp of each event of the subset corresponds to the relative time; and
causing updating of the displayed set of events such that the determined subset of events is displayed in the graphical user interface.
27. One or more computer-readable storage media as described in claim 26 , wherein the first or the second user selection comprises an initial user selection of a display of the timestamp of the particular event.
28. One or more computer-readable storage media as described in claim 26 , wherein the first or the second user selection comprises a user interaction with a representation of the timestamp of the particular event.
29. One or more computer-readable storage media as described in claim 26 , wherein the first or the second user selection comprises a user interaction with a representation of the timestamp of the particular event, the representation included with a display of a plurality of fields corresponding to the particular event in the graphical user interface.
30. One or more computer-readable storage media as described in claim 26 , wherein the first or the second user selection comprises a user interaction with the particular event through an initial user selection of a feature associated with a search input portion of graphical user interface.