Analyzing a modified query to determine data on which to execute the modified query
A method includes causing display to a user of at least one event of a first result set from a first pipelined search on events at an event source. Each event comprises a time stamp and a portion of machine data. A selection of a command is received from the user. The selection is to extend the first pipelined search with the selected command in a second pipelined search. The system selects between the first result set and the event source for execution of the second pipelined search based on an analysis of the selected command and at least one command of the first pipelined search. Based on the selecting being of the first result set, display to the user is caused of at least one event of a second result set from the execution of the second pipelined search on the first result set.
1 . A computer-implemented method for executing search queries, the method comprising:
identifying an indication of a command selected to modify a query comprising a pipeline query language;
analyzing at least one command of the modified query to determine whether to execute the modified query on an event source having a set of events and whether to execute the modified query on a result set from a previous search performed on the set of events at the event source using the query, wherein each event of the set of events comprises a portion of raw machine data;
based on the determination, executing, by at least one processor, the modified query on the set of events of the event source or the result set from the previous search performed on the set of events at the event source; and
causing display of at least one event of a second result set from the execution of the modified query.
2 . The computer-implemented method of claim 1 , wherein the query corresponds with a plurality of commands represented in a command entry list, and the determining is based on metadata of at least one command entry in the command entry list.
3 . The computer-implemented method of claim 1 , further comprising receiving a selection of the command to use to modify the query, wherein the selection of the command is of an option of a plurality of selectable options in an option menu, each selectable option corresponding to one or more of a plurality of selectable commands.
4 . The computer-implemented method of claim 1 , further comprising:
assigning the result set as a search point prior to identifying the indication of the command selected to modify the query;
determining to retain the result set as the search point, wherein the determining is of the result set based on the determining to retain the result set as the search point.
5 . The computer-implemented method of claim 1 , further comprising:
receiving a selection of the command, the selection being to extend the query with the selected command to generate the modified query;
selecting between the result set and the set of events of the event source for execution of the modified query based on an analysis of at least the selected command; and
based on the selecting being of the result set, causing display of at least one event of a new result set from the execution of the modified query on the result set.
6 . The computer-implemented method of claim 1 , wherein at a time of the execution of the modified query on the result set, the event source includes at least one more event incorporated into the set of events than at a time of execution of the previous search performed using the query.
7 . The computer-implemented method of claim 1 , wherein each event of the set of events comprises a time stamp and the portion of machine data reflects security-related information of at least one computing system.
8 . The computer-implemented method of claim 1 , wherein the modified query comprises the pipeline query language.
9 . The computer-implemented method of claim 1 further comprising generating the modified query based on the command selected.
10 . The computer-implemented method of claim 1 , wherein the at least one command analyzed comprises the command selected to modify the query.
11 . One or more non-transitory computer-readable media having instructions stored thereon, the instructions, when executed by at least one processor of a computing device, to cause the computing device to perform a method comprising:
identifying an indication of a command selected to modify a query comprising a pipeline query language;
analyzing at least one command of the modified query to determine whether to execute the modified query on an event source having a set of events and whether to execute the modified query on a result set from a previous search performed on the set of events at the event source using the query, wherein each event of the set of events comprises a portion of raw machine data;
based on the determination, executing, by at least one processor, the modified query on the set of events of the event source or the result set from the previous search performed on the set of events at the event source; and
causing display of at least one event of a second result set from the execution of the modified query.
12 . The one or more computer-readable media of claim 11 , further comprising receiving a selection of the command to use to modify the query, wherein the selection of the command is of an option of a plurality of selectable options in an option menu, each selectable option corresponding to one or more of a plurality of selectable commands.
13 . The one or more computer-readable media of claim 11 , further comprising:
assigning the result set as a search point prior to identifying the indication of the command selected to modify the query;
determining to retain the result set as the search point, wherein the determining is of the result set based on the determining to retain the result set as the search point.
14 . The one or more computer-readable media of claim 11 , further comprising:
receiving a selection of the command, the selection being to extend the query with the selected command in the modified query;
selecting between the result set and the set of events of the event source for execution of the modified query based on an analysis of the selected command; and
based on the selecting being of the result set, causing display of at least one event of a new result set from the execution of the modified query on the result set.
15 . The one or more computer-readable media of claim 11 , wherein at a time of the execution of the modified query on the result set, the event source includes at least one more event incorporated into the set of events than at a time of execution of the previous search performed using the query.
16 . The one or more computer-readable media of claim 11 , wherein the modified query comprises the pipeline query language.
17 . A system comprising:
at least one processor; and
memory having instructions stored thereon, the instructions, executable by the at least one processor to cause the system to perform a method comprising:
identifying an indication of a command selected to modify a query comprising a pipeline query language;
analyzing at least one command of the modified query to determine whether to execute the modified query on an event source having a set of events and whether to execute the modified query on a result set from a previous search performed on the set of events at the event source using the query, wherein each event of the set of events comprises a portion of raw machine data;
based on the determination, executing, by at least one processor, the modified query on the set of events of the event source or the result set from the previous search performed on the set of events at the event source; and
causing display of at least one event of a second result set from the execution of the modified query.
18 . The system of claim 17 , wherein modified query applies a late-binding schema.
19 . The system of claim 17 , wherein the at least one command analyzed comprises the command selected to modify the query.