Concurrent display of search results from differing time-based search queries executed across event data
A visualization can include a set of swim lanes, each swim lane representing information about an event type. An event type can be specified, e.g., as those events having certain keywords and/or having specified value(s) for specified field(s). The swim lane can plot when (within a time range) events of the associated event type occurred. Specifically, each such event can be assigned to a bucket having a bucket time matching the event time. A swim lane can extend along a timeline axis in the visualization, and the buckets can be positioned at a point along the axis that represents the bucket time. Thus, the visualization may indicate whether events were clustered at a point in time. Because the visualization can include a plurality of swim lanes, the visualization can further indicate how timing of events of a first type compare to timing of events of a second type.
1. A method comprising:
executing, by a computer system, two or more differing time-based search queries on a set of raw data, wherein the raw data is indexed and stored in one or more data stores;
causing display on a display device, by the computer system, of two or more graphical indicators on a common timeline representation,
wherein each of the two or more graphical indicators represents search results from a separate one of the two or more differing time-based search queries,
wherein the two or more graphical indicators include a first graphical indicator associated with a first time-based search query of the two or more differing time-based search queries and a second graphical indicator associated with a second time-based search query of the two or more differing time-based search queries, and
wherein the first graphical indicator is displayed in a first display region and the second graphical indicator is displayed in a second display region that is spatially aligned with the first display region;
receiving, by the computer system, user input selecting a portion of each of the two or more graphical indicators, the portion of each of the two or more graphical indicators corresponding to a selected portion of data represented by each of the two or more graphical indicators in a common time interval;
defining, by the computer system, the selected portion of data represented by each of the two or more graphical indicators as a notable event; and
causing display of a third graphical indicator representing the notable event, in a third display region that is spatially aligned with the first display region and the second display region.
2. The method of claim 1 , further comprising:
based on user input, adjusting a timeframe of the common timeline representation.
3. The method of claim 1 , further comprising:
based on user input, adjusting a timeframe of the common timeline representation;
causing display of graphical indicators that represent search results within the adjusted timeframe for the first time-based search query and the second time-based search query.
4. The method of claim 1 , further comprising:
based on user input, adjusting a timeframe of the common timeline representation;
executing the two or more differing time-based search queries across the set of raw data for the adjusted timeframe;
causing display of graphical indicators that represent search results for the two or more differing time-based search queries over the adjusted timeframe.
5. The method of claim 1 , further comprising:
causing display of a population graph that represents a time plot across the common timeline representation of one or more of the search results for the two or more differing time-based search queries.
6. The method of claim 1 , further comprising:
causing display of a population graph that represents a time plot across the common timeline representation of one or more of the search results for the two or more differing time-based search queries;
wherein portions of the population graph are selectable by a user.
7. The method of claim 1 , further comprising:
causing display of a population graph that represents a time plot across the common timeline representation of one or more of the search results for the two or more differing time-based search queries;
wherein portions of the population graph are selectable by a user;
based on user input selecting a portion of the population graph, adjusting a timeframe of the common timeline representation to match a time period of the selected portion of the population graph.
8. The method of claim 1 , further comprising:
based on user input, rearranging a displayed order of the display of the one or more graphical indicators for the first time-based search query and the one or more graphical indicators for the second time-based search query.
9. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein the two or more differing time-based search queries include search criteria requiring matching events to relate to a same particular user.
10. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein the two or more differing time-based search queries include search criteria requiring matching events to relate to a same particular asset.
11. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, the method further comprising:
in response to receiving an input identifying a graphical indicator among the displayed one or more graphical indicators that represent search results from the two or more differing time-based search queries, displaying additional information about one or more events represented by the identified graphical indicator.
12. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, the method further comprising:
in response to receiving an input identifying a graphical indicator among the displayed one or more graphical indicators that represent search results from the two or more differing time-based search queries, displaying at least a portion of one or more events represented by the identified graphical indicator.
13. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, the method further comprising:
receiving input indicative of a request to create an alert corresponding to one or more events represented by a selected one or more one or more graphical indicators among the displayed one or more graphical indicators that represent search results from the two or more differing time-based search queries; and
creating the alert corresponding to the events represented by the selected one or more graphical indicators.
14. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein one or more events of the plurality of events is derived from machine data.
15. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein one or more events of the plurality of events includes a portion of raw machine data.
16. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein at least one displayed graphical indicator graphically indicates a number of events represented by the displayed graphical indicator.
17. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein at least one displayed graphical indicator indicates a number of events represented by the displayed graphical indicator using color or color shading.
18. The method of claim 1 , wherein the set of raw data is segmented into a plurality of events, wherein particular time-based search query was executed against the plurality of events using a late-binding schema to generate a search result.
19. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, execution of which by one or more processors causes performance of:
executing two or more differing time-based search queries on a set of raw data, wherein the raw data is indexed and stored in one or more data stores;
causing display on a display device of two or more graphical indicators on a common timeline representation,
wherein each of the two or more graphical indicators represents search results from a separate one of the two or more differing time-based search queries,
wherein the two or more graphical indicators include a first graphical indicator associated with a first time-based search query of the two or more differing time-based search queries and a second graphical indicator associated with a second time-based search query of the two or more differing time-based search queries, and
wherein the first graphical indicator is displayed in a first display region and the second graphical indicator is displayed in a second display region that is spatially aligned with the first display region;
receiving, by the computer system, user input selecting a portion of each of the two or more graphical indicators, the portion of each of the two or more graphical indicators corresponding to a selected portion of data represented by each of the two or more graphical indicators in a common time interval;
defining, by the computer system, the selected portion of data represented by each of the two or more graphical indicators as a notable event; and
causing display of a third graphical indicator representing the notable event, in a third display region that is spatially aligned with the first display region and the second display region.
20. A processing system comprising:
a processor; and,
a storage facility, accessible to the processor, and storing instructions that, when executed by the processor, cause the processing system to perform operations including
executing two or more differing time-based search queries on a set of raw data, wherein the raw data is indexed and stored in one or more data stores;
causing display on a display device of two or more graphical indicators on a common timeline representation,
wherein each of the two or more graphical indicators represents search results from a separate one of the two or more differing time-based search queries,
wherein the two or more graphical indicators include a first graphical indicator associated with a first time-based search query of the two or more differing time-based search queries and a second graphical indicator associated with a second time-based search query of the two or more differing time-based search queries, and
wherein the first graphical indicator is displayed in a first display region and the second graphical indicator is displayed in a second display region that is spatially aligned with the first display region;
receiving, by the computer system, user input selecting a portion of each of the two or more graphical indicators, the portion of each of the two or more graphical indicators corresponding to a selected portion of data represented by each of the two or more graphical indicators in a common time interval;
defining, by the computer system, the selected portion of data represented by each of the two or more graphical indicators as a notable event; and
causing display of a third graphical indicator representing the notable event, in a third display region that is spatially aligned with the first display region and the second display region.