Using extractions to search events derived from machine data
Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.
1. A method, comprising:
analyzing machine data stored in at least one storage device in order to segment the machine data into a plurality of events by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality of events including some machine data from the stored machine data segmented for that event, the plurality of events including both events produced from a first data resource and events produced from a second data resource that is different from the first data resource, the machine data in one or more events produced from the first data resource having a different data format than the machine data in one or more events produced from the second data resource;
performing a text extraction on machine data in one or more events in the plurality of events to identify one or more events for which the extracted text matches particular criteria;
wherein the method is performed by one or more computing devices.
2. The method as recited in claim 1 , wherein the text extraction is performed based on a particular punctuation structure.
3. The method as recited in claim 1 , wherein the text extraction is performed using an extraction rule.
4. The method as recited in claim 1 , wherein the text extraction is performed using a regular expression.
5. The method as recited in claim 1 , wherein the text extraction is performed on at least two events derived from different machine data sources.
6. The method as recited in claim 1 , wherein the particular criteria requires that the extracted text match one or more tokens.
7. The method as recited in claim 1 , wherein the particular criteria requires that the extracted text match one or more keywords.
8. The method as recited in claim 1 , wherein the particular criteria requires that the extracted text match one or more segment values.
9. The method as recited in claim 1 , wherein the particular criteria requires that the extracted text match one or more extracted entities.
10. The method as recited in claim 1 , wherein the extracted text is a value for an extracted entity.
11. The method as recited in claim 1 , wherein the extracted text is part of a semantic entity.
12. The method as recited in claim 1 , wherein the extracted text includes a particular value for a semantic entity.
13. The method as recited in claim 1 , wherein the particular criteria is associated with an event type.
14. The method as recited in claim 1 , further comprising:
wherein the particular criteria is associated with an event type; and
generating statistical information for the event type.
15. The method as recited in claim 1 , further comprising:
wherein the particular criteria is associated with an event type;
generating statistical information for the event type; and
wherein the statistical information is accessible via an application programming interface.
16. The method as recited in claim 1 , further comprising:
wherein the particular criteria is associated with an event type;
generating a count of events associated with the event type.
17. The method as recited in claim 1 , further comprising:
wherein the particular criteria is associated with an event type;
generating a count of events associated with the event type; and
causing display of the count.
18. The method as recited in claim 1 , further comprising:
identifying a machine data source for at least a portion of the machine data.
19. The method as recited in claim 1 , further comprising:
identifying a machine data source using at least a portion of the machine data.
20. The method as recited in claim 1 , further comprising:
constructing links between events in the plurality of events;
wherein the links represent relationships between events in the plurality of events.
21. The method as recited in claim 1 , further comprising:
constructing links between events in the plurality of events;
wherein the links represent relationships between events in the plurality of events;
constructing a path by chaining event links together;
generating statistical information based on occurrences of one or more paths.
22. The method as recited in claim 1 , further comprising associating a time stamp with each event in the plurality of events.
23. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
analyzing machine data stored in at least one storage device in order to segment the machine data into a plurality of events by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality of events including some machine data from the stored machine data segmented for that event, the plurality of events including both events produced from a first data resource and events produced from a second data resource that is different from the first data resource, the machine data in one or more events produced from the first data resource having a different data format than the machine data in one or more events produced from the second data resource;
performing a text extraction on machine data in one or more events in the plurality of events to identify one or more events for which the extracted text matches particular criteria.
24. The one or more non-transitory computer-readable storage media as recited in claim 23 , wherein the text extraction is performed based on a particular punctuation structure.
25. The one or more non-transitory computer-readable storage media as recited in claim 23 , wherein the text extraction is performed using an extraction rule.
26. The one or more non-transitory computer-readable storage media as recited in claim 23 , wherein the text extraction is performed on at least two events derived from different machine data sources.
27. An apparatus, comprising:
a subsystem, implemented at least partially in hardware, that analyzes machine data stored in at least one storage device in order to segment the machine data into a plurality of events by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality of events including some machine data from the stored machine data segmented for that event, the plurality of events including both events produced from a first data resource and events produced from a second data resource that is different from the first data resource, the machine data in one or more events produced from the first data resource having a different data format than the machine data in one or more events produced from the second data resource;
a subsystem, implemented at least partially in hardware, that performs a text extraction on machine data in one or more events in the plurality of events to identify one or more events for which the extracted text matches particular criteria.
28. The apparatus as recited in claim 27 , wherein the text extraction is performed based on a particular punctuation structure.
29. The apparatus as recited in claim 27 , wherein the text extraction is performed using an extraction rule.
30. The apparatus as recited in claim 27 , wherein the text extraction is performed on at least two events derived from different machine data sources.