Event Segment Search Drill Down

1 . A method, comprising:

executing a search system on one or more computing devices to perform:

causing emphasis of a segment in event raw data of an event that is one of multiple events returned as a search result set displayed in a search interface;

causing display of a menu of search options that are selectable to operate on the emphasized segment in the event raw data;

receiving a selection of one of the search options displayed in the menu; and

updating a search command in a search bar of the search interface based on the search option that is selected from the menu for the emphasized segment.

2 . The method as recited in claim 1 , further comprising:

said causing the emphasized segment responsive to detection of an input pointer over the segment.

3 . The method as recited in claim 1 , further comprising:

receiving an input associated with the emphasized segment in the event raw data; and

wherein the menu of the search options is displayed responsive to the received input.

4 . The method as recited in claim 1 , wherein the menu of the search options is displayed proximate the emphasized segment in the search interface.

5 . The method as recited in claim 1 , wherein the search options displayed in the menu include an add to search option, an exclude from search option, and a new search option.

6 . The method as recited in claim 1 , wherein the search options displayed in the menu include an add to search option that is selectable to initiate the emphasized segment added as a keyword to the search command in the search bar.

7 . The method as recited in claim 1 , wherein the search options displayed in the menu include an exclude from search option that is selectable to add a keyword that represents the emphasized segment to the search command in the search bar to exclude the keyword from a search.

8 . The method as recited in claim 1 , wherein the search options displayed in the menu include a new search option that is selectable to create a new data search based on the emphasized segment.

9 . The method as recited in claim 1 , wherein the menu includes the search options to:

add the emphasized segment as a keyword to the search command in the search bar;

exclude a keyword that represents the emphasized segment from a search; or

create a new data search based on the emphasized segment.

10 . The method as recited in claim 1 , wherein:

said receiving the selection of a search option to add the emphasized segment as a keyword to a data search;

said updating the search command in the search bar to include the keyword that represents the emphasized segment; and

the method further comprises:

performing the data search based on the updated search command to determine the multiple events that each include the keyword that represents the emphasized segment; and

causing display of an updated search result set of the multiple events that each include the emphasized segment in the search interface.

11 . The method as recited in claim 1 , wherein:

said receiving the selection of a search option to add the emphasized segment as a keyword to a data search;

said updating the search command in the search bar to include the keyword that represents the emphasized segment; and

the method further comprises:

performing the data search based on the updated search command to determine the multiple events that each include the keyword that represents the emphasized segment;

causing display of an updated search result set of the multiple events that each include the emphasized segment in the search interface;

receiving an input associated with the emphasized segment in the event raw data of one of the multiple events displayed as part of the updated search result set; and

causing display of an additional search menu of options to one of:

remove the keyword that represents the emphasized segment from the search command; or

create a new search based on the emphasized segment.

12 . The method as recited in claim 1 , wherein:

receiving the selection of a search option includes receiving the selection to add a keyword that represents the emphasized segment to the search command to exclude the keyword from a data search;

said updating the search command in the search bar to exclude the keyword that represents the emphasized segment; and

the method further comprises:

performing the data search based on the updated search command to determine the multiple events that do not include the keyword that represents the emphasized segment; and

causing display of an updated search result set of the multiple events that do not include the emphasized segment.

13 . The method as recited in claim 1 , wherein:

said receiving the selection of a search option to create a new data search based on the emphasized segment;

said updating the search command in the search bar to include only a keyword that represents the emphasized segment; and

the method further comprises:

performing the new data search based on the updated search command to determine the multiple events that include the keyword that represents the emphasized segment; and

causing display of an updated search result set of the multiple events that include the emphasized segment.

14 . The method as recited in claim 1 , wherein:

the menu of the search options includes selectable interface links, each associated with a corresponding search option; and

a selectable interface link being selectable to initiate a new search interface.

15 . The method as recited in claim 1 , wherein the search options displayed in the menu include an add to search option, an exclude from search option, a new search option, and a field extraction option.

16 . The method as recited in claim 1 , wherein said causing emphasis of the segment comprises highlighting the segment.

17 . The method as recited in claim 1 , wherein the multiple events are initially derived from collected data that comprises at least one of raw data, machine data, performance data, log data, diagnostic information, transformed data, or mashup data combined from multiple sources.

18 . The method as recited in claim 1 , wherein the multiple events of the search result are returned as a result of a search performed using a late-binding schema on data originally collected from one or more sources.

19 . The method as recited in claim 1 , wherein the multiple events each comprise a portion of raw data that is associated with a timestamp indicating a respective point in time.

20 . A system, comprising:

one or more data stores configured to store collected data that is searchable by a search system using a late-binding schema;

a processing system to implement the search system on one or more computing devices, the search system configured to:

emphasize a segment in event raw data of an event that is one of multiple events returned as a search result set displayed in a search interface;

initiate display of a menu of search options that are selectable to operate on the emphasized segment in the event raw data;

receive a selection of one of the search options displayed in the menu; and

update a search command in a search bar of the search interface based on the search option that is selected from the menu for the emphasized segment.

21 . The system as recited in claim 20 , wherein the search system is configured to:

highlight the segment responsive to detection of an input pointer over the segment;

receive an input associated with the emphasized segment in the event raw data; and

wherein the menu of the search options is displayed proximate the emphasized segment in the search interface responsive to the received input.

22 . The system as recited in claim 20 , wherein the search options displayed in the menu include an add to search option, an exclude from search option, and a new search option.

23 . The system as recited in claim 20 , wherein the menu includes the search options to:

add the emphasized segment as a keyword to the search command in the search bar;

exclude the keyword that represents the emphasized segment from a search; or

create a new data search based on the emphasized segment.

24 . The system as recited in claim 20 , wherein the search system is configured to:

receive the selection of a search option to add the emphasized segment as a keyword to a data search;

update the search command in the search bar to include the keyword that represents the emphasized segment;

perform the data search based on the updated search command to determine the multiple events that each include the keyword that represents the emphasized segment; and

initiate display of an updated search result set of the multiple events that each include the emphasized segment in the search interface.

25 . The system as recited in claim 20 , wherein the search system is configured to:

receive the selection of a search option to exclude a keyword that represents the emphasized segment from a data search;

update the search command in the search bar to exclude the keyword that represents the emphasized segment;

perform the data search based on the updated search command to determine the multiple events that do not include the keyword that represents the emphasized segment; and

initiate display of an updated search result set of the multiple events that do not include the emphasized segment.

26 . The system as recited in claim 20 , wherein the search system is configured to:

receive the selection of a search option to create a new data search based on the emphasized segment;

update the search command in the search bar to include only the keyword that represents the emphasized segment;

perform the new data search based on the updated search command to determine the multiple events that include the keyword that represents the emphasized segment; and

initiate display of an updated search result set of the multiple events that include the emphasized segment.

27 . One or more computer-readable, non-volatile storage memory comprising stored instructions that are executable and, responsive to execution by a computing device, the computing device performs operations comprising:

causing emphasis of a segment in event raw data of an event that is one of multiple events returned as a search result set displayed in a search interface;

causing display of a menu of search options that are selectable to operate on the emphasized segment in the event raw data;

receiving a selection of one of the search options displayed in the menu; and

updating a search command in a search bar of the search interface based on the search option that is selected from the menu for the emphasized segment.

28 . The one or more computer-readable, non-volatile storage memory as recited in claim 27 , wherein the computing device performs the operations comprising:

said causing the emphasized segment responsive to detection of an input pointer over the segment;

receiving an input associated with the emphasized segment in the event raw data; and

wherein the menu of the search options is displayed proximate the emphasized segment in the search interface responsive to the received input.

29 . The one or more computer-readable, non-volatile storage memory as recited in claim 27 , wherein:

the search options displayed in the menu include an add to search option, an exclude from search option, and a new search option;

the add to search option being selectable to add the emphasized segment as a keyword to the search command in the search bar;

the exclude from search option being selectable to exclude the keyword that represents the emphasized segment from a search; and

the new search option being selectable to create a new data search based on the emphasized segment.

30 . The one or more computer-readable, non-volatile storage memory as recited in claim 27 , wherein the search options displayed in the menu include an add to search option, an exclude from search option, and a new search option.