Display of aggregation and category selection options based on field name selections
Embodiments are disclosed for a data analysis tool for facilitating iterative and exploratory analysis of large sets of data. In some embodiments a data analysis tool includes a graphical user interface through which an interactive set of field identifiers is displayed. Each of the listed field identifiers may reference fields associated with a set of events returned in response to a search query, the set of events including machine data produced by components within an information technology (IT) environment that reflects activity in the IT environment. In response to user selections of field identifiers included in the displayed set, a data analysis tool may cause display of manipulable visualizations based on values included in fields referenced by the selected field identifiers.
1. A computer-implemented method comprising:
identifying a set of fields in a plurality of events returned in response to a search query, wherein each event of the plurality of events includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment;
receiving a first user input indicating selection by a user of a field identifier from an interactive set of field identifiers, wherein each field identifier in the interactive set of field identifiers references a corresponding field of the set of fields;
causing display, in response to receiving the first user input, of a set of interactive elements, each interactive element of the set of interactive elements corresponding to an option to apply a function to values included in the field referenced by the selected field identifier
receiving a second user input indicating interaction by the user with an interactive element of the set of interactive elements;
applying, in response to the second user input, a function to the values included in the field referenced by selected field identifier, the function corresponding to the interactive element; and
dynamically adjusting, based on application of the function to the values, a visualization of data, wherein the visualization of data includes at least one of a graph, a chart, a plot, or a map based on the values.
2. The method of claim 1 , wherein the set of fields is automatically selected based on a pre-defined selection algorithms.
3. The method of claim 1 , wherein the function is an aggregation function,
wherein applying the aggregation function includes aggregating the values included in the field referenced by the selected field identifier to generate a set of aggregated values; and
wherein dynamically adjusting the visualization of data includes updating the visualization using the aggregated values.
4. The method of claim 1 , wherein the function is a filter function,
wherein applying the filter function includes filtering the values included in the field referenced by the selected field identifier to generate a filtered set of values; and
wherein dynamically adjusting the visualization of data includes updating the visualization using the filtered set of values.
5. The method of claim 1 , further comprising:
causing display, in response to the first user input, of the visualization of data;
wherein causing display of the visualization of data includes:
accessing the values included in the field referenced by the selected field identifier;
processing the values to generate a rendered visualization; and
outputting the rendered visualization for display to the user.
6. The method of claim 1 , further comprising:
causing display, in response to the first user input, of the visualization of data;
wherein causing display of the visualization of data includes:
accessing the values included in the field referenced by the selected field identifier;
processing the values to generate a rendered visualization; and
outputting the rendered visualization for display to the user in a client device operated by the user.
7. The method of claim 1 , wherein display of the visualization is performed automatically in response to the receiving the first user input.
8. The method of claim 1 , further comprising:
causing display, in response to the first user input, of the visualization of data;
wherein causing display of the visualization of data includes:
accessing the values included in the field referenced by the selected field identifier;
defining a visualization parameter;
processing the values to generate a rendered visualization based on the visualization parameter; and
outputting the rendered visualization for display to the user.
9. The method of claim 1 , further comprising:
causing display, in response to the first user input, of the visualization of data;
wherein causing display of the visualization of data includes:
accessing the values included in the field referenced by the selected field identifier;
defining a visualization parameter without input from the user;
processing the values to generate a rendered visualization based on the visualization parameter; and
outputting the rendered visualization for display to the user.
10. The method of claim 1 , further comprising:
causing display, in response to the first user input, of the visualization of data;
wherein causing display of the visualization of data includes:
accessing the values included in the field referenced by the selected field identifier;
applying a rule to select a visualization parameter from a plurality of visualization parameters;
processing the values to generate a rendered visualization based on the selected visualization parameter; and
outputting the rendered visualization for display to the user.
11. The method of claim 1 , further comprising:
causing display, in response to the first user input, of the visualization of data;
wherein causing display of the visualization of data includes:
accessing the values included in the field referenced by the selected field identifier;
applying an algorithm to select a visualization parameter from a plurality of visualization parameters;
processing the values to generate a rendered visualization based on the selected visualization parameter; and
outputting the rendered visualization for display to the user.
12. The method of claim 1 , wherein the visualization of data is configured based on a visualization parameter, the visualization comprising at least one of:
a visualization type;
an axis assignment;
a scale;
a data resolution;
an ordering;
a color;
a color key; and
a user-customizable option.
13. The method of claim 1 , wherein the visualization further comprises additional information regarding the set of fields.
14. The method of claim 1 , wherein the visualization further comprises additional information regarding the set of fields, the additional information regarding a field from the set of fields comprising at least one of:
a field name;
a field type;
a value type; and
statistical information on a plurality of values corresponding to the field.
15. The method of claim 1 , wherein the visualization comprises a graphical list of the interactive set of field identifiers.
16. The method of claim 1 , wherein the visualization comprises a graphical list of the interactive set of field identifiers, the graphical list being displayed as at least one of the following:
a drop down menu; and
a categorical selection menu.
17. The method of claim 1 , wherein the plurality of events comprises a plurality of events in a dataset selected from a plurality of datasets for analysis.
18. The method of claim 1 , wherein the plurality of events comprises a plurality of events in a dataset selected from a plurality of datasets for analysis based on a user interaction with an interactive set of dataset identifiers corresponding to the plurality of datasets.
19. The method of claim 1 , wherein the values included in the field referenced by the selected field identifier comprise a dataset identified in response to the search query.
20. A computer system comprising;
a processing unit; and
a storage device having instructions stored thereon, which when executed by the processing unit cause the computer system to:
identify a set of fields in a plurality of events returned in response to a search query, wherein each event of the plurality of events includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment;
receive a first user input indicating selection by a user of a field identifier from an interactive set of field identifiers, wherein each field identifier in the interactive set of field identifiers references a corresponding field of the set of fields;
cause display, in response to receiving the first user input, of a set of interactive elements, each interactive element of the set of interactive elements corresponding to an option to apply a function to values included in the field referenced by the selected field identifier;
receive a second user input indicating interaction by the user with an interactive element of the set of interactive elements;
apply, in response to the second user input, a function to the values included in the field referenced by selected field identifier, the function corresponding to the interactive element; and
dynamically adjust, based on application of the function to the values, a visualization of data wherein the visualization of data includes at least one of a graph, a chart, a plot, or a map based on the values.
21. The computer system of claim 20 , wherein the function is an aggregation function,
wherein applying the aggregation function includes aggregating the values included in the field referenced by the selected field identifier to generate a set of aggregated values; and
wherein dynamically adjusting the visualization of data includes updating the visualization using the aggregated values.
22. The computer system of claim 20 , wherein the function is a filter function,
wherein applying the filter function includes filtering the values included in the field referenced by the selected field identifier to generate a filtered set of values; and
wherein dynamically adjusting the visualization of data includes updating the visualization using the filtered set of values.
23. The computer system of claim 20 , wherein to display the visualization of data, the instructions, when executed by the processor, further cause the computer system to:
access the values included in the field of the set of fields from a dataset;
process the values to generate a rendered visualization; and
output the rendered visualization for display to a user.
24. The computer system of claim 20 , wherein to display the visualization of data, the instructions, when executed by the processor, further cause the computer system to:
access the values included in the field of the set of fields from a dataset;
define a visualization parameter;
process the values to generate a rendered visualization based on the visualization parameter; and
output the rendered visualization for display to a user.
25. A non-transitory computer-readable medium containing instructions, execution of which in a computer system causes the computer system to:
identify a set of fields in a plurality of events returned in response to a search query, wherein each event of the plurality of events includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment;
receive a first user input indicating selection by a user of a field identifier from an interactive set of field identifiers, wherein each field identifier in the interactive set of field identifiers references a corresponding field of the set of fields;
cause display, in response to receiving the first user input, of a set of interactive elements, each interactive element of the set of interactive elements corresponding to an option to apply a function to values included in the field referenced by the selected field identifier;
receive a second user input indicating interaction by the user with an interactive element of the set of interactive elements;
apply, in response to the second user input, a function to the values included in the field referenced by selected field identifier, the function corresponding to the interactive element; and
dynamically adjust, based on application of the function to the values, a visualization of data, wherein the visualization of data includes at least one of a graph, a chart, a plot, or a map based on the values.
26. The non-transitory computer-readable medium of claim 25 , wherein the function is an aggregation function,
wherein applying the aggregation function includes aggregating the values included in the field referenced by the selected field identifier to generate a set of aggregated values; and
wherein dynamically adjusting the visualization of data includes updating the visualization using the aggregated values.
27. The non-transitory computer-readable medium of claim 25 , wherein the function is a filtering function,
wherein applying the filter function includes filtering the values included in the field referenced by the selected field identifier to generate a filtered set of values; and
wherein dynamically adjusting the visualization of data includes updating the visualization using the filtered set of values.