IP Library › Granted Patent US 11,709,850

Granted Patent B1

US 11,709,850 · App. 17/443,892 · Granted Jul 25, 2023

Using a timestamp selector to select a time information and a type of time information

Inventors: R. David Carasso (San Rafael, CA); Micah James Delfino (San Francisco, CA)

Assignee: Splunk Inc.

G06F16/2477 G06F16/9014 G06F40/284

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,709,850
App. No.: 17/443,892
Granted: Jul 25, 2023
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Embodiments are directed towards a graphical user interface identify locations within event records with splittable timestamp information. A display of event records is provided using any of a variety of formats. A splittable timestamp selector allows a user to select one or more locations within event records as having time related information that may be split across the one or more locations, including, information based on date, time of day, day of the week, or other time information. Any of a plurality of mechanisms is used to associate the selected locations with the split timestamp information, including tags, labels, or header information within the event records. In other embodiments, a separate table, list, index, or the like may be generated that associates the selected locations with the split timestamp information. The split timestamp information may be used within extraction rules for selecting subsets or the event records.

Claims (61)

1. A method in a computing system, comprising:

causing display of a set of event records comprising machine data;

receiving a selection of a portion of an event record, wherein the selected portion of the event record comprises time information about time, day, or date that is selected via a timestamp selector being moved from an original location to a point proximate to the selected portion of the event record;

receiving a selection, via the timestamp selector, of a type of time information corresponding with the selected portion of the event record; and

causing display of an indication that the selected portion of the event record corresponds with the type of time information selected via the timestamp selector.

2. The method of claim 1 , further comprising:

for each event record of the set of event records, using an extraction rule to extract a corresponding timestamp; and

storing the corresponding timestamps in a data store comprising a field-searchable data store.

3. The method of claim 1 , further comprising automatically generating an extraction rule that extracts the selected portion of the event record.

4. The method of claim 1 , further comprising causing the timestamp selector to be displayed concurrently with the set of event records.

5. The method of claim 1 , further comprising:

causing the timestamp selector to be displayed concurrently with the set of event records, and

receiving a selection of an additional portion of the event record, the selection of the additional portion indicating moving the timestamp selector from the original location to a point proximate to the additional portion of the event record, wherein an extraction rule is generated that extracts the selected additional portion of the event record along with the selected portion of the event record.

6. The method of claim 1 , further comprising:

causing to be displayed concurrently with the set of event records, in the original location, the timestamp selector, and

such that, after the selection of the portion of the event record and the selection of the additional portion of the event record are received, the timestamp selector is simultaneously displayed at both the point proximate to the selected portion of the event record and the point proximate to the additional portion of the event record.

7. The method of claim 1 , further comprising:

automatically generating an extraction rule that extracts the selected portion of the event record;

using the extraction rule, extracting the selected portion of the event record;

creating a timestamp using the extracted portion of the event record;

associating the timestamp with the event record; and

storing the timestamped event record in a data store.

8. The method of claim 1 , wherein the selection, via the timestamp selector, of the type of time information comprises input representing manipulating the moved timestamp selector to select one of a plurality of predefined types of time information available in association with the timestamp selector.

9. The method of claim 1 , wherein the selection, via the timestamp selector, of the type of time information comprises input representing manipulating the moved timestamp selector to select from a drop-down element of the timestamp selector one of a plurality of predefined types of time information available in the drop-down element of the timestamp selector.

10. The method of claim 1 wherein the set of event records is displayed across two or more columns, and wherein the received selection of the portion of the event record selects one of the columns to select the portion of the event record displayed in that column.

11. The method of claim 1 further comprising:

creating a timestamp using an extracted portion of the event record, wherein creating the timestamp comprises:

modifying the extracted portion of the event record; and

creating the timestamp to include the modified extracted portion.

12. The method of claim 1 further comprising:

receiving input specifying a second type of time information to which the additional portion of the event record corresponds.

13. The method of claim 1 , wherein the event record comprises structured data or unstructured data.

14. A computing system, comprising:

a processor; and

computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, configure the computing system to:

cause display of a set of event records comprising machine data;

receive a selection of a portion of an event record, wherein the selected portion of the event record comprises time information about time, day, or date that is selected via a timestamp selector being moved from an original location to a point proximate to the selected portion of the event record;

receive a selection, via the timestamp selector, of a type of time information corresponding with the selected portion of the event record; and

cause display of an indication that the selected portion of the event record corresponds with the type of time information selected via the timestamp selector.

15. The computing system of claim 14 , further comprising:

causing to be displayed concurrently with the set of event records, in the original location, the timestamp selector, and

16. The computing system of claim 14 , further comprising:

automatically generating an extraction rule that extracts the selected portion of the event record;

using the extraction rule, extracting the selected portion of the event record;

creating a timestamp using the extracted portion of the event record;

associating the timestamp with the event record; and

storing the timestamped event record in a data store.

17. The computing system of claim 14 , wherein the selection, via the timestamp selector, of the type of time information comprises input representing manipulating the moved timestamp selector to select one of a plurality of predefined types of time information available in association with the timestamp selector.

18. The computing system of claim 14 , wherein the selection, via the timestamp selector, of the type of time information comprises input representing manipulating the moved timestamp selector to select from a drop-down element of the timestamp selector one of a plurality of predefined types of time information available in the drop-down element of the timestamp selector.

19. One or more computer storage media having computer-executable instructions embodied thereon that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:

causing display of a set of event records comprising machine data;

receiving a selection, via the timestamp selector, of a type of time information corresponding with the selected portion of the event record; and

causing display of an indication that the selected portion of the event record corresponds with the type of time information selected via the timestamp selector.

20. The computer storage media of claim 19 , further comprising:

receiving input specifying a second type of time information to which the additional portion of the event record corresponds.

Assignments (4)

CHANGE OF NAME Recorded Jul 22, 2025

From: SPLUNK INC.

To: SPLUNK LLC

Reel/Frame 072170/0599 →

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025

From: SPLUNK LLC

To: CISCO TECHNOLOGY, INC.

Reel/Frame 072173/0058 →

CHANGE OF NAME Recorded Jan 6, 2025