Performing data extraction using modified extraction rules
Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.
1 . A computer-implemented method, comprising:
selecting a portion of raw data from at least one data source;
causing display of an extraction rule associated with the portion of raw data from the at least one data source;
extracting at least one value from the portion of raw data using the extraction rule;
causing display, via a graphical user interface, of a plurality of searchable, time stamped event records and the at least one value extracted from the portion of raw data based on the extraction rule, the at least one value displayed via a particular searchable, time-stamped event record among the plurality of searchable, time-stamped events records, wherein each searchable, time-stamped event record includes a corresponding time-stamp and plurality of field values; and
in response to user input received via the graphical user interface, processing first raw data from the at least one data source using a modified extraction rule to perform data extraction in association with the first raw data including at least some data associated with at least two of the displayed plurality of searchable, time-stamped event records;
wherein the method is performed by one or more computing devices.
2 . The method of claim 1 , wherein the extraction rule includes a regular expression.
3 . The method of claim 1 , wherein the portion of raw data includes log data.
4 . The method of claim 1 , wherein the at least one value extracted from the portion of raw data is visually emphasized within the graphical user interface.
5 . The method of claim 1 , wherein the modified extraction rule is modified based on user modification of the extraction rule.
6 . The method of claim 1 , wherein the modified extraction rule is modified based on a user selection of a first value displayed via the graphical user interface.
7 . The method of claim 1 , further comprising:
identifying a set of unique field values that would be extracted by applying the extraction rule; and
displaying one or more unique field values in the set of unique field values.
8 . The method of claim 1 , wherein the extraction rule is created by a user.
9 . The method of claim 1 further comprising causing display of a set of values extracted via the modified extraction rule.
10 . A system comprising:
at least one network device, comprising:
a processor; and
a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including:
selecting a portion of raw data from at least one data source;
causing display of an extraction rule associated with the portion of raw data from the at least one data source;
extracting at least one value from the portion of raw data using the extraction rule;
causing display, via a graphical user interface, of a plurality of searchable, time stamped event records and the at least one value extracted from the portion of raw data based on the extraction rule, the at least one value displayed via a particular searchable, time-stamped event record among the plurality of searchable, time-stamped events records, wherein each searchable, time-stamped event record includes a corresponding time-stamp and plurality of field values; and
in response to user input received via the graphical user interface, processing first raw data from the at least one data source using a modified extraction rule to perform data extraction in association with the first raw data including at least some data associated with at least two of the displayed plurality of searchable, time-stamped event records.
11 . The system of claim 10 , wherein the operations further include causing display of a set of values extracted via the modified extraction rule.
12 . The system of claim 10 , wherein the extraction rule includes a regular expression.
13 . The system of claim 10 , wherein the portion of raw data includes log data.
14 . The system of claim 10 , wherein the at least one value extracted from the portion of raw data is visually emphasized within the graphical user interface.
15 . The system of claim 10 , wherein the modified extraction rule is modified based on user modification of the extraction rule.
16 . The system of claim 10 , wherein the modified extraction rule is modified based on a user selection of a first value displayed via the graphical user interface.
17 . The system of claim 10 , wherein the extraction rule is created by a user.
18 . A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:
select a portion of raw data from at least one data source;
cause display of an extraction rule associated with the portion of raw data from the at least one data source;
extract at least one value from the portion of raw data using the extraction rule;
cause display, via a graphical user interface, of a plurality of searchable, time stamped event records and the at least one value extracted from the portion of raw data based on the extraction rule, the at least one value displayed via a particular searchable, time-stamped event record among the plurality of searchable, time-stamped events records, wherein each searchable, time-stamped event record includes a corresponding time-stamp and plurality of field values; and
in response to user input received via the graphical user interface, process first raw data from the at least one data source using a modified extraction rule to perform data extraction in association with the first raw data including at least some data associated with at least two of the displayed plurality of searchable, time-stamped event records;
wherein the method is performed by one or more computing devices.
19 . The computer-program product of claim 18 , wherein the instructions are further configured to cause the data processing apparatus to:
identify a set of unique field values that would be extracted by applying the extraction rule; and
display one or more unique field values in the set of unique field values.
20 . The computer-program product of claim 18 , wherein
the at least two of the displayed plurality of searchable, time-stamped event records includes the particular searchable, time-stamped event record.