Granted Patent B1

US 10,705,695 · App. 15/339,417 · Granted Jul 7, 2020

Inventors: Michael Porath (San Francisco, CA); Finlay Cannon (Vancouver, CA); Thomas Allan Haggie (Vancouver, CA)

Assignee: SPLUNK INC.

G06F3/04845G06F3/0482G06F3/04847G06F16/2477G06T11/206G06T11/60G06T2200/24

Abstract

Claims (80)

1. A computer-implemented method for displaying an editable expression of a visualization based on user input, the method comprising:

receiving a first user input corresponding to a first user interaction with a first field identifier of an interactive set of field identifiers occurring in a dataset, the dataset comprising a set of events returned in response to an initial search query, wherein an event includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment;

causing display of a visualization of data comprising a first plurality of values corresponding to the first user interaction and a display of an editable expression relating to the first field identifier;

receiving a second user input corresponding to a second user interaction with a second field identifier of the interactive set of field identifiers;

dynamically adjusting the visualization of data to comprise a display of a second plurality of values corresponding to the second field identifier; and

dynamically updating the display of the editable expression based on the second user interaction.

2. The method of claim 1 , wherein the editable expression comprises a string of one or more sub-expressions.

3. The method of claim 1 , wherein the editable expression comprises a string of one or more sub-expressions, each sub-expression of the string of one or more sub-expressions corresponding specifically with a field identifier of the interactive set of field identifiers.

4. The method of claim 2 , further comprising:

causing display of a set of graphical interactive elements corresponding to a set of alternate sub-expressions for a first sub-expression of the string of one or more sub-expressions; and

receiving a user interaction with a graphical interactive element from the set of graphical interactive elements and corresponding to a second sub-expression from the set of alternate sub-expressions.

5. The method of claim 1 , further comprising:

replacing a first sub-expression in the display of the editable expression with a second sub-expression.

6. The method of claim 1 , further comprising:

replacing a first sub-expression in the display of the editable expression with a second sub-expression without further input from a user.

7. The method of claim 1 , further comprising:

dynamically updating the visualization of data to replace a visualization of data corresponding to the field identifier associated with a first sub-expression with a visualization of data corresponding to the field identifier associated with a second sub-expression.

8. The method of claim 1 , wherein the set of events comprises a selection of events from a store of indexed events.

9. The method of claim 1 , further comprising:

receiving a third user input, the third user input corresponding to a third user interaction with a third field identifier of the interactive set; and

dynamically updating the visualization of data to include a display of a third plurality of values corresponding to the third user interaction with an updated display of the editable expression based on the third user interaction.

10. The method of claim 1 , wherein the dynamically updating the visualization of data comprises appending the editable expression with a sub-expression corresponding to a third field identifier.

11. The method of claim 1 , further comprising:

receiving, as input, a user de-selection of the first field identifier;

dynamically updating the visualization of data to remove a display of a plurality of values corresponding to the de-selected first field identifier; and

dynamically updating the display of the editable expression based on the user de-selection.

12. The method of claim 1 , wherein the display of the editable expression is updated by removing a sub-expression corresponding to a de-selected field identifier from the editable expression.

13. The method of claim 1 , wherein the visualization of data is configured according to a set of visualization parameters.

14. The method of claim 1 , wherein the visualization of data is configured according to a set of visualization parameters selected automatically based on the first user selection.

15. The method of claim 1 , wherein the visualization of data is configured according to a set of visualization parameters by dynamically updating the set of visualization parameters in response to subsequent user selections of field identifiers from the interactive set.

16. The method of claim 1 , further comprising dynamically updating a set of visualization parameters in response to subsequent user selections of field identifiers from the interactive set of field identifiers without further input from the user, wherein the visualization of data is configured according to the set of visualization parameters.

17. The method of claim 1 , further comprising dynamically updating a set of visualization parameters in response to subsequent user selections of field identifiers from the interactive set of field identifiers without further input from the user, wherein the visualization of data is configured according to the set of visualization parameters, and

further wherein the set of visualization parameters comprises one or more visualization parameters selected from a plurality of visualization parameters based on the first plurality of values corresponding to the first field identifier in the first user interaction.

18. The method of claim 1 , wherein the visualization of data is configured according to a set of visualization parameters comprising at least one of:

a visualization type;

an axis assignment;

a scale;

a data resolution;

an ordering;

a color;

a color key; and

a user-customizable option.

19. The method of claim 1 , further comprising:

causing display of a set of graphical interactive elements corresponding to a plurality of options for configuring the visualization;

receiving, as input, a user interaction with a graphical interactive element from the set of graphical interactive elements and corresponding to a function;

dynamically updating the visualization of data by applying the function to at least one of the first plurality of values and the second plurality of values; and

dynamically updating the editable expression to include an identification of the function.

20. The method of claim 1 , further comprising dynamically updating the visualization of data by applying the function to at least one of the first plurality of values and the second plurality of values,

wherein the function corresponds to at least one of:

an aggregation of at least one of the first plurality of values and the second plurality of values; and

a filtering of at least one of the first plurality of values and the second plurality of values.

21. A computer system comprising:

a processing unit; and

a storage device having instructions stored thereon, which when executed by the processing unit cause the computer system to:

receive a first user input corresponding to a first user interaction with a first field identifier of an interactive set of field identifiers occurring in a dataset, the dataset comprising a set of events returned in response to an initial search query, wherein an event includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment;

cause display of a visualization of data comprising a first plurality of values corresponding to the first user interaction and a display of an editable expression relating to the first field identifier;

receive a second user input corresponding to a second user interaction with a second field identifier of the interactive set of field identifiers; and

dynamically adjust the visualization of data to comprise a display of a second plurality of values corresponding to the second field identifier; and

dynamically update the display of the editable expression based on the second user interaction.

22. The computer system of claim 21 , wherein the editable expression comprises a string of one or more sub-expressions.

23. The computer system of claim 21 , wherein the editable expression comprises a string of one or more sub-expressions, and

further wherein each sub-expression of the string of one or more sub-expressions corresponds specifically with a field identifier.

24. The computer system of claim 21 , wherein the instructions, when executed by the processing unit, further cause the computer system to:

cause display of a set of graphical interactive elements corresponding to a set of alternate sub-expressions for a first sub-expression of a string of one or more sub-expressions comprising the editable expression; and

receive a user interaction with a graphical interactive element from the set of graphical interactive elements and corresponding to a second sub-expression from the set of alternate sub-expressions.

25. The computer system of claim 21 , wherein the instructions, when executed by the processing unit, further cause the computer system to:

replace a first sub-expression in a display of the editable expression with a second sub-expression.

26. A non-transitory computer-readable medium containing instructions, execution of which in a computer system causes the computer system to display an editable expression of a visualization based on user input, the instructions comprising:

instructions to receive a first user input corresponding to a first user interaction with a first field identifier of an interactive set of field identifiers occurring in a dataset, the dataset comprising a set of events returned in response to an initial search query, wherein an event includes a time-stamped portion of raw machine data reflecting activity of a component in an information technology (IT) environment;

instructions to cause display of a visualization of data comprising a first plurality of values corresponding to the first user interaction with and a display of an editable expression relating to the first field identifier;

instructions to receive a second user input corresponding to a second user interaction with a second field identifier of the interactive set of field identifiers;

instructions to dynamically adjust the visualization of data to comprise a display of a second plurality of values corresponding to the second field identifier; and

instructions to dynamically update the display of the editable expression based on the second user interaction.

27. The non-transitory computer readable medium of claim 26 , wherein the editable expression comprises a string of one or more sub-expressions.

28. The non-transitory computer readable medium of claim 26 , wherein the editable expression comprises a string of one or more sub-expressions, each sub-expression of the string of one or more sub-expressions corresponding specifically with a field identifier.

29. The non-transitory computer readable medium of claim 26 , wherein the instructions further comprise:

instructions to cause display of a set of graphical interactive elements corresponding to a set of alternate sub-expressions for a first sub-expression of the string of one or more sub-expressions; and

instructions to receive as input, a user interaction with a graphical interactive element from the set of graphical interactive elements and corresponding to a second sub-expression from the set of alternate sub-expressions.

30. The non-transitory computer readable medium of claim 26 , wherein the instructions further comprise:

instructions to replace a first sub-expression in a display of the editable expression with a second sub-expression.

Assignments (4)

Continuity (1)

Cited By (13)

US 12,229,145 US 12,242,490 US 12,260,079 US 12,292,898 US 12,353,442 US 12,373,498 US 12,393,693 US 12,393,903 US 12,423,333 US 12,423,353 US 12,505,312 US 12,554,748 US 12,639,374