Graphical user interface for previewing events using a selected field delimiter option
A graphical user interface allows a customer to specify delimiters and/or patterns that occur in event data and indicate the presence of a particular field. The graphical user interface applies a customer's delimiter specifications directly to event data and displays the resulting event data in real time. Delimiter specifications may be saved as configuration settings and systems in a distributed setting may use the delimiter specifications to extract field values as the systems process raw data into event data. Extracted field values are used to accelerate search queries that a system receives.
1. A method, comprising:
causing display of a graphical user interface that displays one or more field delimiter options specifying one or more delimiters, wherein a delimiter indicates a boundary of a field for which to identify a field value;
receiving a selection of a field delimiter option of the one or more field delimiter options;
in response to receiving a selection of the field delimiter option, causing display of an example event using the selected delimiter character as a delimiter for fields in the example event;
receiving a selection of a field in the example event; and
causing display, in the graphical user interface, of a preview of a set of events having the selected field parsed based on the selected field delimiter option.
2. The method of claim 1 , wherein the selected field delimiter option is a character.
3. The method of claim 1 , wherein the selected field delimiter option is a pattern of characters.
4. The method of claim 1 , further comprising:
receiving a selection confirming approval of the selected delimiter and field; and
based on the selection confirming approval of the selected delimiter and field, saving a corresponding delimiter extraction rule.
5. The method of claim 1 , wherein the graphical user interface that displays one or more field delimiter options specifying one or more delimiters is displayed based on a user selection of delimiters for use in specifying fields.
6. The method of claim 1 , further comprising receiving a user input field name for the selected field in the example event.
7. The method of claim 1 , further comprising filtering the previewed set of events based on a user selection.
8. The method of claim 1 , further comprising ordering the previewed set of events based on a user selection.
9. The method of claim 1 , wherein the selected field parsed based on the selected field delimiter option are highlighted by a selectable icon for editing.
10. A non-transitory computer readable storage medium, storing software instructions, which when executed by one or more processors cause performance of:
causing display of a graphical user interface that displays one or more field delimiter options specifying one or more delimiters, wherein a delimiter indicates a boundary of a field for which to identify a field value;
receiving a selection of a field delimiter option of the one or more field delimiter options;
in response to receiving a selection of the field delimiter option, causing display of an example event using the selected delimiter character as a delimiter for fields in the example event;
receiving a selection of a field in the example event; and
causing display, in the graphical user interface, of a preview of a set of events having the selected field parsed based on the selected field delimiter option.
11. The non-transitory computer readable storage medium of claim 10 , wherein the selected field delimiter option is a character.
12. The non-transitory computer readable storage medium of claim 10 , wherein the selected field delimiter option is a pattern of characters.
13. The non-transitory computer readable storage medium of claim 10 further comprising:
receiving a selection confirming approval of the selected delimiter and field; and
based on the selection confirming approval of the selected delimiter and field, saving a corresponding delimiter extraction rule.
14. The non-transitory computer readable storage medium of claim 10 , wherein the graphical user interface that displays one or more field delimiter options specifying one or more delimiters is displayed based on a user selection of delimiters for use in specifying fields.
15. The non-transitory computer readable storage medium of claim 10 further comprising receiving a user input field name for the selected field in the example event.
16. The non-transitory computer readable storage medium of claim 10 further comprising filtering the previewed set of events based on a user selection.
17. The non-transitory computer readable storage medium of claim 10 further comprising ordering the previewed set of events based on a user selection.
18. The non-transitory computer readable storage medium of claim 10 , wherein the selected field parsed based on the selected field delimiter option are highlighted by a selectable icon for editing.
19. A graphical user interface, comprising:
a first display area displaying one or more field delimiter options specifying one or more delimiters, wherein a delimiter indicates a boundary of a field for which to identify a field value;
a second display area displaying an example event using a delimiter character selected as a delimiter for fields in the example event, the example event displayed in response to receiving a selection of a field delimiter option of the one or more field delimiter options; and
a third display area displaying a preview of a set of events having a field, selected in the example event, parsed based on the selected field delimiter option.
20. The graphical user interface of claim 19 , wherein the first display area, the second display area, and the third display area are separate from one another.