Creating a correlation search
Systems and methods for assigning scores to objects based on evaluating triggering conditions applied to datasets produced by search queries in data aggregation and analysis systems. An example method may comprise providing an interface for generating a correlation search, the interface facilitating user input of (i) one or more search criteria for a search query of the correlation search, (ii) a triggering condition to be applied to a dataset produced by the search query, and (iii) one or more actions to be performed when the dataset produced by search query satisfies the triggering condition, wherein the one or more actions comprise at least modifying a score assigned to an object to which the dataset produced by the search query pertains, and causing generation of the correlation search based on the user input.
1. A computer-implemented method comprising:
causing display of a user interface for generating a correlation search comprising (i) a search query of the correlation search, (ii) a triggering condition to be applied to a dataset produced by the search query, and (iii) one or more actions to be performed when the dataset produced by the search query satisfies the triggering condition, wherein the one or more actions comprise at least modifying a score assigned to an object to which the dataset produced by the search query pertains;
receiving, via the user interface for generating the correlation search, first user input indicating one or more search criteria for the search query, second user input indicating the triggering condition to be applied to the dataset produced by the search query, and third user input indicating whether the score assigned to the object to which the dataset produced by the search query pertains is to be modified when the dataset produced by the search query satisfies the triggering condition; and
causing generation of the correlation search based on the first user input, the second user input, and the third user input.
2. The computer-implemented method of claim 1 , further comprising:
causing display in the user interface of a plurality of statistics types that can be used for producing an aggregate on data;
receiving, through the user interface, input identifying a statistics type of the plurality of statistics types;
receiving input identifying an evaluation of the aggregate produced by the statistics type; and
wherein causing generation of the correlation search comprises including the evaluation of the aggregate produced by the statistics type in the search query.
3. The computer-implemented method of claim 1 , further comprising:
causing display in the user interface of a plurality of statistics types that can be used for producing an aggregate on data;
receiving through the user interface, input identifying a statistics type of the plurality of statistics types;
receiving input identifying an evaluation of the aggregate produced by the statistics type; and
wherein causing generation of the correlation search comprises including the evaluation of the aggregate produced by the statistics type in the triggering condition of the correlation search.
4. The computer-implemented method of claim 1 , wherein causing generation of the correlation search comprises:
displaying, in the user interface, options for the one or more actions to be performed when the dataset produced by the search query satisfies the triggering condition;
receiving input identifying the one or more actions to be performed; and
associating the one or more actions with the triggering condition.
5. The computer-implemented method of claim 1 , wherein causing generation of the correlation search comprises:
causing the search query included in the correlation search to be displayed in the user interface.
6. The computer-implemented method of claim 1 , wherein the one or more actions comprise one or more of updating a display with an entry corresponding to satisfaction of the triggering condition, adjusting a score of an object to which data causing satisfaction of the triggering condition pertains, or sending a notification indicating satisfaction of the triggering condition.
7. The computer-implemented method of claim 1 , wherein the user interface comprises one or more graphical user interface (GUI) elements to receive input identifying a time range, the time range defining a scope of data to be searched using the search query.
8. The computer-implemented method of claim 1 , wherein the search query corresponds to a search language that uses a late binding schema.
9. The computer-implemented method of claim 1 , further comprising causing execution of the search query against raw machine data.
10. The computer-implemented method of claim 1 , further comprising causing execution of the search query against time-stamped events that each include a portion of raw machine data.
11. The computer-implemented method of claim 1 , wherein a calculation of a statistics type is included in the search query.
12. The computer-implemented method of claim 1 , wherein an evaluation of a calculation of a statistics type is included in the search query.
13. The computer-implemented method of claim 1 , wherein the dataset satisfies the triggering condition each time the dataset includes an indicator that search criteria of the search query are satisfied.
14. The computer-implemented method of claim 1 , wherein the dataset includes a number of times search criteria of the search query are satisfied, and the dataset satisfies the triggering condition when the number of times exceeds a threshold.
15. The computer-implemented method of claim 1 , wherein the dataset satisfies the triggering condition when an aggregated statistic pertaining to the dataset exceeds a threshold, is under a threshold, or is within a specified range.
16. A system comprising:
a memory; and
a processing device coupled with the memory to:
cause display of a user interface for generating a correlation search comprising (i) a search query of the correlation search, (ii) a triggering condition to be applied to a dataset produced by the search query, and (iii) one or more actions to be performed when the dataset produced by the search query satisfies the triggering condition, wherein the one or more actions comprise at least modifying a score assigned to an object to which the dataset produced by the search query pertains;
receive, via the user interface for generating the correlation search, first user input indicating one or more search criteria for the search query, second user input indicating the triggering condition to be applied to the dataset produced by the search query, and third user input indicating whether the score assigned to the object to which the dataset produced by the search query pertains is to be modified when the dataset produced by the search query satisfies the triggering condition; and
cause generation of the correlation search based on the first user input, the second user input, and the third user input.
17. The system of claim 16 , wherein to cause generation of the correlation search comprises:
displaying, in the user interface, options for the one or more actions to be performed when the dataset produced by the search query satisfies the triggering condition;
receiving input identifying the one or more actions to be performed; and
associating the one or more actions with the triggering condition.
18. The system of claim 16 , wherein to cause generation of the correlation search comprises:
causing the search query included in the correlation search to be displayed in the user interface.
19. The system of claim 16 , wherein the one or more actions comprise one or more of updating a display with an entry corresponding to satisfaction of the triggering condition, adjusting a score of an obj ect to which data causing satisfaction of the triggering condition pertains, or sending a notification indicating satisfaction of the triggering condition.
20. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing device to perform operations comprising:
causing display of a user interface for generating a correlation search comprising (i) a search query of the correlation search, (ii) a triggering condition to be applied to a dataset produced by the search query, and (iii) one or more actions to be performed when the dataset produced by the search query satisfies the triggering condition, wherein the one or more actions comprise at least modifying a score assigned to an object to which the dataset produced by the search query pertains;
receiving, via the user interface for generating the correlation search, first user input indicating one or more search criteria for the search query, second user input indicating the triggering condition to be applied to the dataset produced by the search query, and third user input indicating whether the score assigned to the object to which the dataset produced by the search query pertains is to be modified when the dataset produced by the search query satisfies the triggering condition; and
causing generation of the correlation search based on the first user input, the second user input, and the third user input.
21. The non-transitory computer-readable storage medium of claim 20 , wherein causing generation of the correlation search comprises:
displaying in the user interface options for the one or more actions to be performed when the dataset produced by the search query satisfies the triggering condition;
receiving input identifying the one or more actions to be performed; and
associating the one or more actions with the triggering condition.
22. The non-transitory computer-readable storage medium of claim 20 , wherein causing generation of the correlation search comprises:
causing the search query included in the correlation search to be displayed in the user interface.
23. The non-transitory computer-readable storage medium of claim 20 , wherein the one or more actions comprise one or more of updating a display with an entry corresponding to satisfaction of the triggering condition, adjusting a score of an object to which data causing satisfaction of the triggering condition pertains, or sending a notification indicating satisfaction of the triggering condition.