Parallel coordinates chart visualization for machine data search and analysis system

1. A method comprising:

in response to a search query, retrieving search results including a plurality of events, each of the plurality of events containing time-stamped data, at a system for indexing and searching data;

identifying a plurality of characteristics from the time-stamped data corresponding to the plurality of events; and

causing display of an interactive multiple-dimensional chart depicting the data corresponding to the events the interactive multiple-dimensional chart including a plurality of axes, each of the axes corresponding to one of the identified characteristics, the interactive multiple-dimensional chart further including a plurality of polylines representing the events, each of the polylines including a plurality of vertices on the axes;

wherein causing display of the interactive multiple-dimensional chart includes:

formatting the time-stamped data corresponding to the plurality of events into a data object that is readable by a code library for generating a static visualization;

receiving state information that is indicative of a current state of display of the interactive multiple-dimensional chart, wherein use of the state information enables the interactive multiple-dimensional chart to be displayed at a plurality of different devices without saving a rendering of the interactive multiple-dimensional chart; and

processing the data object using the code library to render the interactive multiple-dimensional chart based on the received state information.

2. The method of claim 1 , wherein the multiple-dimensional chart is a parallel coordinates chart and the plurality of axes are parallel to each other.

3. The method of claim 1 , wherein for an individual polyline of the plurality of polylines, a position of an individual vertex of the individual polyline on an individual axis is indicative of a value of a particular characteristic corresponding to the individual axis.

4. The method of claim 1 , wherein the time-stamped data comprises machine data.

5. The method of claim 1 , wherein the time-stamped data comprises real-time event data.

6. The method of claim 1 further comprising:

in response to a signal indicative of a user interaction with an individual axis of the plurality of axes of the interactive multiple-dimensional chart, identifying a subset of events that correspond with the individual axis; and

dynamically updating display of the interactive multiple-dimensional chart by processing the subset of events using the code library.

7. The method of claim 1 , wherein the code library is open source.

8. The method of claim 1 , further comprising:

repeatedly and automatically updating the interactive multiple-dimensional chart when the search results are updated with new events.

9. The method of claim 1 , wherein the events represent products or data points that are indicated in the time-stamped data corresponding to the events.

10. The method of claim 1 , wherein a color of each individual polyline of the plurality of polylines is indicative of a position of a vertex of the individual polyline on a particular axis of the plurality of axes.

11. The method of claim 1 , wherein a color of each individual polyline of the plurality of polylines is indicative of a value or a value range of a particular characteristic for an event represented by the individual polyline, or is indicative of a category of a particular characteristic for an event represented by the individual polyline.

12. The method of claim 1 , further comprising:

in response to a user interacting with the interactive multiple-dimensional chart or the user changing the search query,

reordering the axes of the interactive multiple-dimensional chart; and

causing changes of the polylines of the interactive multiple-dimensional chart in response to the reordering of the axes.

13. The method of claim 1 , further comprising:

in response to a user input, dynamically switching the interactive multiple-dimensional chart between a categorical color mode and a sequential color mode;

wherein in a sequential color mode, a color of an individual polyline of the plurality of polylines denotes a value range of a particular characteristic for an event represented by the individual polyline; and

wherein in a categorical color mode, a color of an individual polyline of the plurality of polylines denotes a category of a particular characteristic for an event represented by the individual polyline.

14. The method of claim 1 , further comprising:

displaying the plurality of polylines in a plurality of colors, wherein a color of an individual polyline of the plurality of polylines denotes a value range of a particular characteristic for an event represented by the individual polyline;

in response to a user input, adjusting value ranges of the particular characteristic for the plurality of colors;

dynamically changing the colors of the polylines based on the adjusted value ranges.

15. The method of claim 1 , further comprising:

generating a user interface element for users to specify a time range of events as part of the search query.

16. The method of claim 1 , further comprising:

receiving a signal indicative of a user input interacting with an individual axis of the plurality of axes of the interactive multiple-dimensional chart;

in response to the signal, generating a filter specifying a value range of a particular characteristic represented by the individual axis; and

highlighting polylines representing events that are selected by the filter.

17. The method of claim 1 , further comprising:

receiving a signal indicative of a user input interacting with an individual axis of the plurality of axes of the interactive multiple-dimensional chart;

in response to the signal, generating a filter specifying a value range of a particular characteristic represented by the individual axis, based on the user input interacting with the individual axis; and

reducing intensities of polylines representing events that are excluded by the filter.

18. The method of claim 1 , further comprising:

receiving a signal indicative of a user input interacting with an individual axis of the plurality of axes of the interactive multiple-dimensional chart;

in response to the signal, generating a filter specifying a value range of a particular characteristic represented by the individual axis;

removing polylines representing events that are excluded by the filter;

receiving a second signal indicative of a user input clearing the filter; and

displaying polylines representing events that are excluded by the filter and polylines representing events that are selected by the filter.

19. The method of claim 1 , further comprising:

receiving a first signal indicative of a user input interacting with a first individual axis of the plurality of axes of the interactive multiple-dimensional chart;

in response to the first signal, generating a first filter specifying a first value range of a first particular characteristic represented by the first individual axis;

receiving a second signal indicative of a user interaction with a second individual axis of the plurality of axes of the interactive multiple-dimensional chart;

in response to the second signal, generating a second filter specifying a second value range of a second particular characteristic represented by the second individual axis, based on the user input interacting with the second individual axis; and

highlighting polylines representing events that are selected by the first filter and the second filter.

20. The method of claim 1 , further comprising:

receiving a user input selecting a subset of events from the search results; and

generating a second interactive multiple-dimensional chart visualizing data of the subset of events by processing the subset of events using the code library.

21. The method of claim 1 , further comprising:

receiving a signal indicative of a user input interacting with an individual axis of the plurality of axes of the interactive multiple-dimensional chart;

in response to the signal, generating a filter specifying a value range of a particular characteristic represented by the individual axis, based on the user input interacting with the individual axis;

identifying a set of new coordinate ranges for the plurality of axes, based on the filter specifying the value range of the particular characteristic; and

generating a second interactive multiple-dimensional chart visualizing data of the subset of events selected by the filter, the second interactive multiple-dimensional chart including the plurality of axes with the set of new coordinate ranges.

22. The method of claim 1 , further comprising:

in response to a cursor being positioned over an individual polyline of the plurality of polylines, displaying a total number of the one or more events that are represented by the individual polyline.

23. The method of claim 1 , further comprising:

in response to a cursor being positioned over an individual polyline of the plurality of polylines, displaying a total number of the one or more events that are share common characteristics represented by vertices of the individual polyline.

24. The method of claim 1 , further comprising:

in response to a cursor being positioned over an individual polyline of the plurality of polylines, displaying a hovering window that includes additional information related to the individual polyline.

25. The method of claim 1 , further comprising:

in response to a cursor being positioned over an individual polyline of the plurality of polylines, displaying an event represented by the individual polyline.

26. The method of claim 1 , further comprising:

receiving a signal indicative of a user input interacting with an individual axis of the plurality of axes of the interactive multiple-dimensional chart; and

in response to the signal, updating the state information based on the user interaction with the individual axis of the plurality of axes of the interactive multiple-dimensional chart.

27. The method of claim 1 , further comprising:

in response to a signal indicative of a user interaction with an individual axis of the plurality of axes of the interactive multiple-dimensional chart, identifying a subset of events that correspond with the individual axis; and

dynamically updating display of the interactive multiple dimensional chart by:

discarding the object used to render a current version of the multiple-dimensional chart;

formatting a subset of the time-stamped data corresponding to the subset of events into a second data object that is readable by the code library; and

processing the second data object using the code library to render an updated version of the multiple-dimensional chart.

28. A computer system comprising:

processor; and

a storage device having instructions stored thereon, which when executed by the processor cause the system to:

in response to a search query, retrieve search results including a plurality of events, each of the plurality of events containing time-stamped data;

identify a plurality of characteristics from the time-stamped data corresponding to the plurality of events; and

cause display of an interactive multiple-dimensional chart depicting the data corresponding to the events, the interactive multiple-dimensional chart including a plurality of axes, each of the axes corresponding to one of the identified characteristics, the interactive multiple-dimensional chart further including a plurality of polylines representing the events, each of the polylines including a plurality of vertices on the axes;

wherein causing display of the interactive multiple-dimensional chart includes:

formatting the time-stamped data corresponding to the plurality of events into a data object that is readable by a code library for generating a static visualization;

receiving state information that is indicative of a current state of display of the interactive multiple-dimensional chart, wherein use of the state information enables the interactive multiple-dimensional chart to be displayed at a plurality of different devices without saving a rendering of the interactive multiple-dimensional chart; and

processing the data object using the code library to render the interactive multiple-dimensional chart based on the received state information.

29. A non-transitory computer readable medium containing instructions, execution of which in a computer system causes the computer system to:

in response to a search query, retrieve search results including a plurality of events, each of the plurality of events containing time-stamped data;

identify a plurality of characteristics from the time-stamped data corresponding to the plurality of events; and

cause display of an interactive multiple-dimensional chart depicting the data corresponding to the events, the interactive multiple-dimensional chart including a plurality of axes, each of the axes corresponding to one of the identified characteristics, the interactive multiple-dimensional chart further including a plurality of polylines representing the events, each of the polylines including a plurality of vertices on the axes;

wherein causing display of the interactive multiple-dimensional chart includes:

formatting the time-stamped data corresponding to the plurality of events into a data object that is readable by a code library for generating a static visualization;

receiving state information that is indicative of a current state of display of the interactive multiple-dimensional chart, wherein use of the state information enables the interactive multiple-dimensional chart to be displayed at a plurality of different devices without saving a rendering of the interactive multiple-dimensional chart; and

processing the data object using the code library to render the interactive multiple-dimensional chart based on the received state information.