Event identification based on cells associated with aggregated metrics
In embodiments of statistics value chart interface cell mode drill down, a first interface displays in a table format that includes columns each with field values of an event field, and each column having a column heading of a different one of the event fields, and includes rows each with one or more of the field values, each field value in a row associated with a different one of the event fields, and having an aggregated metric that represents a number of events with field-value pairs that match all of the field values listed in a respective row and the corresponding event fields listed in the respective columns. A cell can be emphasized that includes one of the field values in a row that corresponds to one of the different event fields in a column, and in response, a menu displays options to transition to a second interface.
1. A computer-implemented method comprising:
causing display of a table within an interface, wherein the table includes:
cells that display values of field-value pairs for fields associated with a first set of events, and
an aggregated metric computed based on a quantity of events in the first set of events that are associated with the values of the field-value pairs displayed in the cells;
in response to a selection associated with a single cell of a plurality of cells in a first row of the first set of events, causing the interface to display a menu corresponding to at least one field-value pair associated with the single cell, the menu displaying a list of options representing different uses of the at least one field-value pair; and
causing display of a subset of events of the first set of events, the subset of events being identified based on an option selected from the menu and the at least one field-value pair associated with the single cell.
2. The method of claim 1 , wherein the cells that display the values of the field-value pairs and a cell that displays the aggregated metric are each in a same row of the table.
3. The method of claim 1 , wherein the display of the table is responsive to a search query received from the interface.
4. The method of claim 1 , wherein each cell of the cells uniquely corresponds to a field of the fields.
5. The method of claim 1 , wherein each event included in the first set of events is associated with each of the field-value pairs displayed in the cells.
6. The method of claim 1 , wherein the display of the subset of events is in another interface that is separate from the interface.
7. The method of claim 1 , wherein the display of the values of the field-value pairs for the fields is based on user input specifying each of the fields.
8. The method of claim 1 , wherein selection of the option from the menu causes events to be included in the subset of events based on the events having field-value pairs that exclude the at least one field-value pair.
9. The method of claim 1 , wherein selection of the option causes events to be included in the subset of events based on the events having field-value pairs that match the at least one field-value pair.
10. A computer-implemented system, comprising:
one or more processors; and
one or more computer-readable media having executable instructions embodied thereon, which, when executed by the one or more processors, cause the one or more processors to perform a method comprising:
causing display of a table within an interface, wherein the table includes:
cells that display values of field-value pairs for fields associated with a first set of events, and
an aggregated metric computed based on a quantity of events in the first set of events that are associated with the values of the field-value pairs displayed in the cells;
in response to a selection associated with a single cell of a plurality of cells in a first row of the first set of events, causing the interface to display a menu corresponding to at least one field-value pair associated with the single cell, the menu displaying a list of options representing different uses of the at least one field-value pair; and
causing display of a subset of events of the first set of events, the subset of events being identified based on an option selected from the menu and the at least one field-value pair associated with the single cell.
11. The computer-implemented system of claim 10 , wherein the cells that display the values of the field-value pairs and a cell that displays the aggregated metric are each in a same row of the table.
12. The computer-implemented system of claim 10 , wherein the display of the table is responsive to a search query received from the interface.
13. The computer-implemented system of claim 10 , wherein each cell of the cells uniquely corresponds to a field of the fields.
14. The computer-implemented system of claim 10 , wherein each event included in the first set of events is associated with each of the field-value pairs displayed in the cells.
15. One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform a method comprising:
causing display of a table within an interface, wherein the table includes:
cells that display values of field-value pairs for fields associated with a first set of events, and
an aggregated metric computed based on a quantity of events in the first set of events that are associated with the values of the field-value pairs displayed in the cells;
in response to a selection associated with a single cell of a plurality of cells in a first row of the first set of events, causing the interface to display a menu corresponding to at least one field-value pair associated with the single cell, the menu displaying a list of options representing different uses of the at least one field-value pair; and
causing display of a subset of events of the first set of events, the subset of events being identified based on an option selected from the menu and the at least one field-value pair associated with the single cell.
16. The one or more non-transitory computer-storage media of claim 15 , wherein the cells that display the values of the field-value pairs and a cell that displays the aggregated metric are each in a same row of the table.
17. The one or more non-transitory computer-storage media of claim 15 , wherein the display of the table is responsive to a search query received from the interface.
18. The one or more non-transitory computer-storage media of claim 15 , wherein each cell of the cells uniquely corresponds to a field of the fields.