Displaying event records with emphasized fields
Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion.
1. A method, comprising:
causing display of a set of event records;
determining a plurality of extraction rules associated with a first event record of the set of event records;
identifying, within the first event record, a first field value of a first field defined by a first extraction rule and a second field value of a second field defined by the second extraction rule; and
automatically causing the first field value to be visually emphasized within the first event record in a first manner based on the identification of the first field value of the first field being defined by the first extraction rule and causing the second field value to be visually emphasized within the first event record in a second manner, different from the first manner, based on the identification of the second field value of the second field being defined by the second extraction rule, wherein at least one of the first manner or the second manner comprises use of color and/or format to visually emphasize the first field value and/or the second field value.
2. The method as recited in claim 1 , wherein the first event record comprises at least a portion of one or more lines of data within machine data.
3. The method as recited in claim 1 , wherein the first extraction rule comprises a regular expression.
4. The method as recited in claim 1 , wherein the plurality of extraction rules are user selected via a graphical user interface.
5. The method as recited in claim 1 further comprising:
identifying, within the first event record, a third field value of a third field defined by a third extraction rule;
determining that the second field and the third field overlap; and
causing the third field value to be visually emphasized within the first event record in the second manner such that the second field value and the third field value are emphasized together as a super set field.
6. The method as recited in claim 1 further comprising:
identifying, within the first event record, a third field value of a third field defined by a third extraction rule;
determining that the second field and the third field overlap based on a start character location and an end character location of the second field and the third field within the first event record; and
causing the third field value to be visually emphasized within the first event record in the second manner such that the second field value and the third field value are emphasized together as a super set field.
7. The method as recited in claim 1 further comprising:
detecting a selection of the visually emphasized first field value; and
causing display of an indication of the first extraction rule associated with the first field value.
8. The method as recited in claim 1 , further comprising automatically generating the first extraction rule based on a text value selected, via a graphical user interface, from an event record, wherein the extraction rule is generated using a pattern recognition algorithm.
9. The method as recited in claim 1 , wherein the first extraction rule is input, via a graphical user interface, into an editable input text box.
10. The method as recited in claim 1 further comprising causing display of an indication of the first extraction rule along with a name of the first extraction rule, the name representing a name of the first field defined by the first extraction rule.
11. A computerized system comprising:
one or more processors; and
computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, implement a method comprising:
causing display of a set of event records;
determining a plurality of extraction rules associated with a first event record of the set of event records;
identifying, within the first event record, a first field value of a first field defined by a first extraction rule and a second field value of a second field defined by the second extraction rule; and
automatically causing the first field value to be visually emphasized within the first event record in a first manner based on the identification of the first field value of the first field being defined by the first extraction rule and causing the second field value to be visually emphasized within the first event record in a second manner, different from the first manner, based on the identification of the second field value of the second field being defined by the second extraction rule, wherein at least one of the first manner or the second manner comprises use of color and/or format to visually emphasize the first field value and/or the second field value.
12. The system of claim 11 , wherein the first manner comprises use of a first color to visually emphasize the first field value and the second manner comprises use of a second color to visually emphasize the second field value.
13. The system of claim 11 further comprising:
identifying, within the first event record, a third field value of a third field defined by a third extraction rule;
determining that the second field and the third field overlap; and
causing the third field value to be visually emphasized within the first event
record in the second manner such that the second field value and the third field value are emphasized together as a super set field.
14. The system of claim 11 further comprising:
identifying, within the first event record, a third field value of a third field defined by a third extraction rule;
determining that the second field and the third field overlap based on a start character location and an end character location of the second field and the third field within the first event record; and
causing the third field value to be visually emphasized within the first event record in the second manner such that the second field value and the third field value are emphasized together as a super set field.
15. The system of claim 11 further comprising:
detecting a selection of the visually emphasized first field value; and
causing display of an indication of the first extraction rule associated with the first field value.
16. A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform a method comprising:
causing display of a set of event records;
determining a plurality of extraction rules associated with a first event record of the set of event records;
identifying, within the first event record, a first field value of a first field defined by a first extraction rule and a second field value of a second field defined by the second extraction rule; and
automatically causing the first field value to be visually emphasized within the first event record in a first manner based on the identification of the first field value of the first field being defined by the first extraction rule and causing the second field value to be visually emphasized within the first event record in a second manner, different from the first manner, based on the identification of the second field value of the second field being defined by the second extraction rule, wherein at least one of the first manner or the second manner comprises use of color and/or format to visually emphasize the first field value and/or the second field value.
17. The non-transitory computer-readable medium of claim 16 , wherein the first manner comprises use of a first format to visually emphasize the first field value and the second manner comprises use of a second format to visually emphasize the second field value.
18. The non-transitory computer-readable medium of claim 16 further comprising:
identifying, within the first event record, a third field value of a third field defined by a third extraction rule;
determining that the second field and the third field overlap; and
causing the third field value to be visually emphasized within the first event
record in the second manner such that the second field value and the third field value are emphasized together as a super set field.
19. The non-transitory computer-readable medium of claim 16 further comprising:
identifying, within the first event record, a third field value of a third field defined by a third extraction rule;
determining that the second field and the third field overlap based on a start character location and an end character location of the second field and the third field within the first event record; and
causing the third field value to be visually emphasized within the first event record in the second manner such that the second field value and the third field value are emphasized together as a super set field.