Facilitating event creation via previews
Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.
1. A method, comprising:
selecting a first portion of raw data from a set of raw data from at least one data source, the set of raw data including the first portion of raw data and a second portion of raw data different from the first portion of raw data;
causing display of one or more selectable parsing rules;
receiving a first user input selecting a particular parsing rule among the one or more selectable parsing rules, the particular parsing rule to be applied to the first portion of raw data;
parsing the selected first portion of raw data into one or more sets of parsed data using the particular parsing rule, each set of parsed data including raw data from the selected portion of raw data;
causing display, via a graphical user interface, of at least a portion of the one or more sets of parsed data of the selected first portion of raw data;
in response to receiving a second user input indicating the displayed at least the portion of the one or more sets of parsed data is satisfactory, processing raw data from the selected first portion of raw data from the set of raw data using the particular parsing rule to create a first set of searchable, time-stamped events and processing additional raw data from the second portion of raw data of the set of raw data using the particular parsing rule to create a second set of searchable, time-stamped events, wherein the additional raw data from the second portion of raw data is different from the raw data from the selected first portion of raw data; and
storing the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in an index store, wherein the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in the index store are used to service search queries received from a search engine.
2. The method of claim 1 , wherein the parsing the selected first portion of raw data further comprises:
causing display of the particular parsing rule.
3. The method of claim 1 , wherein the display of the at least the portion of the one or more sets of parsed data includes an indication of how at least some of the portion of the one or more sets of parsed data has been parsed.
4. The method of claim 1 , wherein at least one of the one or more selectable parsing rules were created based on existing parsing rules.
5. The method of claim 1 , further comprising:
prior to receiving the first user input, causing display of the selected first portion of raw data.
6. The method of claim 1 , further comprising:
prior to receiving the first user input, causing display of the selected first portion of raw data in a scrollable display.
7. The method of claim 1 , wherein the causing the display of the at least the portion of the one or more sets of parsed data displays the at least the portion of the one or more sets of parsed data in a scrollable display.
8. The method of claim 1 , further comprising:
receiving a third user input indicating a user preference to use a different parsing rule; and
parsing the selected first portion of raw data into one or more second sets of parsed data using a second parsing rule.
9. The method of claim 1 , further comprising:
receiving a third user input indicating a user preference to use a different parsing rule;
selecting a second parsing rule; and
parsing the selected first portion of raw data into one or more second sets of parsed data using the second parsing rule.
10. The method of claim 1 , further comprising:
receiving a third user input indicating a user preference to use a different parsing rule;
receiving a fourth user input selecting a second parsing rule; and
parsing the selected first portion of raw data into one or more second sets of parsed data using the second parsing rule.
11. A non-transitory storage medium storing instructions which, when executed by a computing device, cause the computing device to:
select a first portion of raw data from a set of raw data from at least one data source, the set of raw data including the first portion of raw data and a second portion of raw data different from the first portion of raw data;
cause display of one or more selectable parsing rules;
receive a first user input selecting a particular parsing rule among the one or more selectable parsing rules, the particular parsing rule to be applied to the first portion of raw data;
parse the selected first portion of raw data into one or more sets of parsed data using the particular parsing rule, each set of parsed data including raw data from the selected portion of raw data;
cause display, via a graphical user interface, of at least a portion of the one or more sets of parsed data of the selected first portion of raw data;
in response to receiving a second user input indicating the displayed at least the portion of the one or more sets of parsed data is satisfactory, process raw data from the selected first portion of raw data from the set of raw data using the particular parsing rule to create a first set of searchable, time-stamped events and processing additional raw data from the second portion of raw data of the set of raw data using the particular parsing rule to create a second set of searchable, time-stamped events, wherein the additional raw data from the second portion of raw data is different from the raw data from the selected first portion of raw data; and
store the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in an index store, wherein the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in the index store are used to service search queries received from a search engine.
12. The non-transitory storage medium of claim 11 , wherein the parsing the selected first portion of raw data further comprises:
causing display of the particular parsing rule.
13. The non-transitory storage medium of claim 11 , wherein the display of the at least the portion of the one or more sets of parsed data includes an indication of how at least some of the portion of the one or more sets of parsed data has been parsed.
14. The non-transitory storage medium of claim 11 , wherein at least one of the one or more selectable parsing rules were created based on existing parsing rules.
15. A computing system comprising:
a processor; and
computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, configure the computing system to:
select a first portion of raw data from a set of raw data from at least one data source, the set of raw data including the first portion of raw data and a second portion of raw data different from the first portion of raw data;
cause display of one or more selectable parsing rules;
receive a first user input selecting a particular parsing rule among the one or more selectable parsing rules, the particular parsing rule to be applied to the first portion of raw data;
parse the selected first portion of raw data into one or more sets of parsed data using the particular parsing rule, each set of parsed data including raw data from the selected portion of raw data;
cause display, via a graphical user interface, of at least a portion of the one or more sets of parsed data of the selected first portion of raw data;
in response to receiving a second user input indicating the displayed at least the portion of the one or more sets of parsed data is satisfactory, process raw data from the selected first portion of raw data from the set of raw data using the particular parsing rule to create a first set of searchable, time-stamped events and processing additional raw data from the second portion of raw data of the set of raw data using the particular parsing rule to create a second set of searchable, time-stamped events, wherein the additional raw data from the second portion of raw data is different from the raw data from the selected first portion of raw data; and
store the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in an index store, wherein the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in the index store are used to service search queries received from a search engine.
16. The system of claim 15 , wherein the instructions, when executed by the processor, further configure the computing system to:
receive a third user input indicating a user preference to use a different parsing rule;
parse the selected first portion of raw data into one or more second sets of parsed data using a second parsing rule.
17. The system of claim 15 , wherein the instructions, when executed by the processor, further configure the computing system to:
receive a third user input indicating a user preference to use a different parsing rule;
select a second parsing rule;
parse the selected first portion of raw data into one or more second sets of parsed data using the second parsing rule.
18. The system of claim 15 , wherein the instructions, when executed by the processor, further configure the computing system to:
receive a third user input indicating a user preference to use a different parsing rule;
receive a fourth user input selecting a second parsing rule;
parse the selected first portion of raw data into one or more second sets of parsed data using the second parsing rule.
19. The system of claim 15 , wherein the parsing the selected first portion of raw data further comprises:
causing display of the particular parsing rule.
20. The system of claim 15 , wherein the display of the at least the portion of the one or more sets of parsed data includes an indication of how at least some of the portion of the one or more sets of parsed data has been parsed.