Automatic generation of data analysis queries
Disclosed herein is a computer-implemented tool that facilitates data analysis by use of machine learning (ML) techniques. The tool cooperates with a data intake and query system and provides a graphical user interface (GUI) that enables a user to train and apply a variety of different ML models on user-selected datasets of stored machine data. The tool can provide active guidance to the user, to help the user choose data analysis paths that are likely to produce useful results and to avoid data analysis paths that are less likely to produce useful results.
1. A method of enabling validation of a machine learning model for data search and analysis, the method comprising:
receiving, by a computer system, first user input specifying a selected training dataset and parameters for training a selected machine learning model for data search and analysis, the parameters including one or more data fields;
training, by the computer system, the selected machine learning model on the selected training dataset based on the parameters including the one or more data fields;
generating, by the computer system, a plurality of queries, in a pipelined search language, that are executable against stored data without having received any user request to generate any of the queries and prior to receiving a user request for validation analysis of the selected machine learning model, each of the queries being generated based on a separate stored query template and being customized to the selected training dataset by the computer system replacing one or more variables in the stored query template with a corresponding one or more user-specified values, the one or more user-pecified values including the one or more data fields, each of the queries capable of being executed against the selected training dataset, wherein each of the queries is designed to produce a different one of a plurality of different validation analyses that can be invoked on the stored data to allow validation of the selected machine learning model, and wherein the queries are generated without any user request to generate the queries;
causing, by the computer system, display of a separate user control for each of the plurality of different validation analyses;
receiving, by the computer system, second user input selecting one of the controls for a selected validation analysis of the plurality of different validation analyses;
executing, by the computer system, a query of the plurality of queries, designed to produce the selected validation analysis of the plurality of different validation analyses, on the stored data in response to the second user input; and
causing, by the computer system, display of a result of executing the query to allow validation by a user of the selected machine learning model.
2. The method of claim 1 , wherein the selected training dataset comprises timestamped machine data events.
3. The method of claim 1 , wherein the parameters for training a machine learning model comprise a user-selected field of the selected dataset.
4. The method of claim 1 , wherein generating the plurality of queries comprises causing each of the queries to be displayed with explanatory comments.
5. The method of claim 1 , causing display of a user input field in which a user can specify a new search query to be executed against the stored data.
6. The method of claim 1 , wherein each of the queries is generated based on a different one of a plurality of stored query templates.
7. The method of claim 1 , wherein each of the queries is generated based on a different one of a plurality of stored query templates, and wherein each of the query templates comprises a query that contains a variable.
8. The method of claim 1 , further comprising:
generating an indication to a user of a suggested data field of the selected training dataset upon which to base training of the machine learning model.
9. The method of claim 1 , further comprising providing a plurality of user input fields to receive user inputs that specify particular data fields of the selected training dataset, for training the selected machine learning model.
10. The method of claim 1 , further comprising:
providing a plurality of user input fields to receive user inputs that specify particular data fields for applying the selected machine learning model.
11. The method of claim 1 , wherein the method comprises providing an indication to a user of a plurality of selectable machine learning models and enables the user to select the machine learning model to be trained from among the plurality of selectable machine learning models.
12. The method of claim 1 , wherein the method comprises enabling a user to view data indicative of the trained machine learning model.
13. The method of claim 1 , wherein the selected training dataset comprises a plurality of data fields, the method further comprising:
identifying a subset of the data fields in the selected training dataset as satisfying a predetermined criterion for relevance to the selected machine learning model.
14. The method of claim 1 , further comprising:
providing a user input field for receiving user input that specifies a particular data field of the selected training dataset, based on which the machine learning model is to be trained;
identifying a subset of data fields in the selected training dataset as satisfying a predetermined criterion for relevance to the machine learning model; and
suggesting to the user the identified subset of the data fields of the selected training dataset, for possible selection by the user in the user input field.
15. The method of claim 1 , further comprising:
providing a user input field for receiving user input that specifies at least one of:
a particular data field of the selected training dataset, based on which the selected machine learning model is to be trained; or
a particular data field of a second dataset, for applying the selected machine learning model; and
suggesting to the user a subset of data fields of the selected training dataset or a subset of the data fields of the second dataset, for possible selection by the user in the user input fields.
16. The method of claim 1 , wherein the selected training dataset comprises a plurality of data fields, the method further comprising:
identifying a subset of the data fields in the selected training dataset as satisfying a predetermined criterion for relevance to the selected machine learning model;
providing a plurality of user input fields to receive user input specifying fields to use in training the machine learning model; and
indicating to the user the subset of the data fields in the selected training dataset identified as satisfying the predetermined criterion for relevance, in relation to at least one of the user input fields.
17. The method of claim 1 , wherein the selected training dataset includes a plurality of data fields, each having one or more corresponding data values;
the method further comprising:
applying a transformation to data values of a plurality of data fields of the selected training dataset, to produce new data values;
training the selected machine learning model based on the transformed data values; and
identifying a data field to suggest to the user, for possible selection by the user, based on a result of the training the selected machine learning model in relation to a predetermined quality criterion.
18. A computer system comprising:
a communication device through which to communicate on a computer network; and
at least one processor operatively coupled to the communication device and configured to execute operations to enable validation of a machine learning model for data search and analysis, the operations including
receiving first user input specifying a selected training dataset and parameters for training a selected machine learning model for data search and analysis, the parameters including one or more data fields;
training the selected machine learning model on the selected training dataset based on the parameters;
generating a plurality of queries, in a pipelined search language, that are executable against stored data without having received any user request to generate any of the queries and prior to receiving a user request for validation analysis of the selected machine learning model, each of is the queries being generated based on a separate stored query template and being customized to the selected training dataset by the computer system replacing one or more variables in the stored query template with a corresponding one or more user-specified values, the one or more user-specified values including one or more data fields, each of the queries capable of being executed against the selected training dataset, and wherein each of the queries is designed to produce a different one of a plurality of different validation analyses that can be invoked on the stored data to allow validation of the selected machine learning model, and wherein the queries are generated without any user request to generate the queries;
causing display of a separate user control for each of the plurality of different validation analyses;
receiving second user input selecting one of the controls for a selected one of the plurality of different validation analyses; and
executing a query of the plurality of queries, designed to produce the selected one of the plurality of different validation analyses, on the stored data in response to the second user input; and
causing, display of a result of executing the query to allow validation by a user of the selected machine learning model.
19. A non-transitory machine-readable storage medium storing instructions, execution of which in a processing system causes the processing system to perform operations to enable validation of a machine learning model for data search and analysis, the operations comprising:
receiving first user input specifying a selected training dataset and parameters for training a selected machine learning model for data search and analysis, the parameters including one or more data fields;
training the selected machine learning model on the selected training dataset based on the parameters;
generating a plurality of queries, in a pipelined search language, that are executable against stored data without having received any user request to generate any of the queries and prior to receiving a user request for validation analysis of the selected machine learning model, each of the queries being generated based on a separate stored query template and being customized to the selected training dataset by the processing system replacing one or more variables in the stored query template with a corresponding one or more user-specified values, the one of more user-specified values including the one or more data fields, each of the queries capable of being executed against the selected training dataset, and wherein each of the queries is designed to produce a different one of a plurality of different validation analyses that can be invoked on stored data to allow validation of the selected machine learning model, and wherein the queries are generated without any user request to generate the queries;
causing display of a separate user control for each of the plurality of different validation analyses;
receiving second user input selecting one of the controls for a selected one of the plurality of different validation analyses; and
executing a query of the plurality of queries, designed to produce the selected one of the plurality of different validation analyses, on the stored data in response to the second user input; and
causing, display of a result of executing the query to allow validation by a user of the selected machine learning model.