Granted Patent B1

US 12,271,428 · App. 17/816,337 · Granted Apr 8, 2025

Inventors: Christopher Bolognese (Vancouver, CA); Finlay Cannon (Vancouver, CA); Eli Clein (San Francisco, CA); Umesh Dinkar (Vancouver, CA); Thomas Haggie (Victoria, CA); Barbara Janczer (San Francisco, CA); Elizabeth Li (Fremont, CA); Clark Eugene Mullen (San Mateo, CA); Viet Quoc Nguyen (Oakland, CA); Faya Peng (San Francisco, CA); Ioan Popa (Fremont, CA); Abid Salahi (Vancouver, CA); Keng-Ming Sheu (Port Coquitlam, CA); Tulika Thakur (Vancouver, CA); Justin Lew (Burnaby, CA); Jonathan Ng (Vancouver, CA); Jacob Sebastian Stark (San Jose, CA)

Assignee: Splunk Inc.

G06F16/904G06F3/04845G06F16/90335

Abstract

Claims (82)

1. A method, comprising:

displaying, via a graphical user interface generated using a user interface system, a first chart based on a first search-related statement of a plurality of search-related statements of a data processing package, wherein the data processing package is stored in a semantic processing system communicatively coupled with the user interface system, wherein each search-related statement of the plurality of search-related statements comprises one or more executable query commands of a query language identifying a respective set of data and a manner of processing the respective set of data;

receiving, via the graphical user interface, an indication to adjust a parameter of the first chart;

receiving an indication to execute the data processing package;

responsive to the indication to execute the data processing package, generating a second search-related statement of the plurality of search-related statements based on the indication to adjust the parameter of the first chart and the first search-related statement;

appending the second search-related statement to the data processing package to form a transitory data processing package;

determining a portion of the transitory data processing package to execute;

communicating the portion of the transitory data processing package to a query system communicatively coupled with the user interface system for execution;

receiving results from the query system;

displaying, via the graphical user interface, a second chart based on the results;

communicating the transitory data processing package to the semantic processing system;

responsive to communicating the transitory data processing package to the semantic processing system, receiving a data processing package model from the semantic processing system, wherein the data processing package model includes:

a statement model corresponding to the second search-related statement, and

at least one command model corresponding to at least one executable query command of the second search-related statement;

generating, based on the at least one command model, at least one action model;

generating, based on the at least one action model, at least one model display object, wherein the at least one model display object includes a description of an action performed on at least a portion of the set of data associated with the second search related statement in response to the at least one executable query command; and

causing the graphical user interface to display:

a package editor panel and a models panel,

wherein the second search-related statement is displayed within the package editor panel,

wherein the package editor panel enables editing of the second search-related statement,

wherein editing the second search-related statement in the package editor panel causes an update to the models panel,

wherein the at least one model display object is displayed within the models panel,

wherein the models panel enables editing of the at least one model display object, and

wherein editing the at least one model display object in the models panel causes an update to the second search-related statement in the package editor panel.

2. The method of claim 1 , wherein receiving the indication to adjust the parameter of the first chart comprises receiving, via the graphical user interface, a command token corresponding to a command to use to process the set of data associated with the first search-related statement and generate the results.

3. The method of claim 1 , wherein receiving the indication to adjust the parameter of the first chart comprises receiving, via the graphical user interface, a data field identifier associated with a data field to use to group the set of data associated with the first search-related statement and generate the results.

4. The method of claim 1 , wherein receiving the indication to adjust the parameter of the first chart comprises receiving, via the graphical user interface, a time range to use to identify the set of data associated with the first search-related statement and generate the results.

5. The method of claim 1 , wherein receiving the indication to execute the data processing package comprises receiving an indication that a user interacted with a display object associated with executing a search.

6. The method of claim 1 , further comprising, appending one or more search limits to the data processing package to form the transitory data processing package.

7. A computing system, comprising:

memory; and

one or more processing devices coupled to the memory and configured to:

display, via a graphical user interface generated using a user interface system, a first chart based on a first search-related statement of a plurality of search-related statements of a data processing package, wherein the data processing package is stored in a semantic processing system communicatively coupled with the user interface system, wherein each search-related statement of the plurality of search-related statements comprises one or more executable query commands of a query language identifying a respective set of data and a manner of processing the respective set of data;

receive, via the graphical user interface, an indication to adjust a parameter of the first chart;

receive an indication to execute the data processing package;

responsive to the indication to execute the data processing package, generate a second search-related statement of the plurality of search-related statements based on the indication to adjust the parameter of the first chart and the first search-related statement;

append the second search-related statement to the data processing package to form a transitory data processing package;

determine a portion of the transitory data processing package to execute;

communicate the portion of the transitory data processing package to a query system for execution;

receive results from the query system;

display, via the graphical user interface, a second chart based on the results;

communicate the transitory data processing package to the semantic processing system;

responsive to communication of the transitory data processing package to the semantic processing system, receive a data processing package model from the semantic processing system, wherein the data processing package model includes:

a statement model corresponding to the second search-related statement, and

at least one command model corresponding to at least one executable query command of the second search-related statement;

generate, based on the at least one command model, at least one action model;

generate, based on the at least one action model, at least one model display object, wherein the at least one model display object includes a description of an action performed on at least a portion of the set of data associated with the second search related statement in response to the at least one executable query command; and

cause the graphical user interface to display:

a package editor panel and a models panel,

wherein the second search-related statement is displayed within the package editor panel,

wherein the package editor panel enables editing of the second search-related statement,

wherein editing the second search-related statement in the package editor panel causes an update to the models panel,

wherein the at least one model display object is displayed within the models panel,

wherein the models panel enables editing of the at least one model display object, and

wherein editing the at least one model display object in the models panel causes an update to the second search-related statement in the package editor panel.

8. The computing system of claim 7 , wherein to receive the indication to adjust the parameter of the first chart, the one or more processing devices are configured to receive, via the graphical user interface, a command token corresponding to a command to use to process the set of data associated with the first search-related statement and generate the results.

9. The computing system of claim 7 , wherein to receive the indication to adjust the parameter of the first chart, the one or more processing devices are configured to receive, via the graphical user interface, a data field identifier associated with a data field to use to group the set of data associated with the first search-related statement and generate the results.

10. The computing system of claim 7 , wherein to receive the indication to adjust the parameter of the first chart, the one or more processing devices are configured to receive, via the graphical user interface, a time range to use to identify the set of data associated with the first search-related statement and generate the results.

11. The computing system of claim 7 , wherein to receive the indication to execute the data processing package, the one or more processing devices are configured to receive an indication that a user interacted with a display object associated with executing a search.

12. Non-transitory computer-readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:

display, via a graphical user interface generated using a user interface system, a first chart based on a first search-related statement of a plurality of search-related statements a data processing package, wherein the data processing package is stored in a semantic processing system communicatively coupled with the user interface system, wherein each search-related statement of the plurality of search-related statements comprises one or more executable query commands of a query language identifying a respective set of data and a manner of processing the respective set of data;

receive, via the graphical user interface, an indication to adjust a parameter of the first chart;

receive an indication to execute the data processing package;

responsive to the indication to execute the data processing package, generate a second search-related statement of the plurality of search-related statements based on the indication to adjust the parameter of the first chart and the first search-related statement;

append the second search-related statement of the plurality of search-related statements to the data processing package to form a transitory data processing package;

determine a portion of the transitory data processing package to execute;

communicate the portion of the transitory data processing package to a query system communicatively coupled with the user interface system for execution;

receive results from the query system;

display, via the graphical user interface, a second chart based on the results; communicate the transitory data processing package to the semantic processing system;

responsive to communication of the transitory data processing package to the semantic processing system, receive a data processing package model from the semantic processing system, wherein the data processing package model includes:

a statement model corresponding to the second search-related statement, and

at least one command model corresponding to at least one executable query command of the second search-related statement;

generate, based on the at least one command model, at least one action model;

generate, based on the at least one action model, at least one model display object, wherein the at least one model display object includes a description of an action performed on at least a portion of the set of data associated with the second search related statement in response to the at least one executable query command; and

cause the graphical user interface to display:

a package editor panel and a models panel,

wherein the second search-related statement is displayed within the package editor panel,

wherein the package editor panel enables editing of the second search-related statement,

wherein editing the second search-related statement in the package editor panel causes an update to the models panel,

wherein the at least one model display object is displayed within the models panel,

wherein the models panel enables editing of the at least one model display object, and

wherein editing the at least one model display object in the models panel causes an update to the second search-related statement in the package editor panel.

Assignments (3)

Continuity (1)

References Cited (244)