Real time indication of previously extracted data fields for regular expressions
    11.
    发明授权
    Real time indication of previously extracted data fields for regular expressions 有权
    用于正则表达式的以前提取的数据字段的实时指示

    公开(公告)号:US08751963B1

    公开(公告)日:2014-06-10

    申请号:US13748391

    申请日:2013-01-23

    Applicant: Splunk Inc.

    CPC classification number: G06F7/24 G06F17/30551

    Abstract: Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion.

    Abstract translation: 实施例针对具有先前提供的提取规则的指示的事件记录的实时显示。 可以向系统提供多个提取规则,诸如自动生成和/或用户创建的提取规则。 这些提取规则可以包括正则表达式。 可以向用户显示多个事件记录,使得在事件记录的显示中强调由提取规则定义的字段中的文本。 对于重叠字段中的文本可以提供相同的重点,或者对于不同领域的重点可能有些不同。 用户界面可以使得用户能够选择事件记录的文本的一部分,例如通过滚动或点击事件记录的被强调部分。 通过选择事件记录的部分,界面可以显示与所选部分相关联的每个提取规则。

    Real time display of data field values based on manual editing of regular expressions
    12.
    发明授权
    Real time display of data field values based on manual editing of regular expressions 有权
    基于手动编辑正则表达式实时显示数据字段值

    公开(公告)号:US08682906B1

    公开(公告)日:2014-03-25

    申请号:US13748313

    申请日:2013-01-23

    Applicant: Splunk Inc.

    Abstract: Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

    Abstract translation: 实施例涉及基于诸如正则表达式的至少一个提取规则来实时显示事件记录和提取的值。 可以使用用户界面来使用户能够自动生成提取规则和/或手动输入提取规则。 可以使用户手动编辑先前提供的提取规则,这可以导致更新的提取值的实时显示。 提取规则可以用于从多个记录中的每一个提取值,包括非结构化机器数据的事件记录。 可以针对每个唯一提取的值确定统计量,并且可以实时地向用户显示。 用户界面还可以使用户能够选择至少一个唯一的提取值来显示包括与所选择的值匹配的提取值的那些事件记录。

    Indexing preview
    13.
    发明授权
    Indexing preview 有权
    索引预览

    公开(公告)号:US08515963B1

    公开(公告)日:2013-08-20

    申请号:US13662337

    申请日:2012-10-26

    Applicant: Splunk Inc.

    Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

    Abstract translation: 实施例针对在将对应的索引数据添加到索引存储之前预览从索引数据原始数据生成的结果。 可以从预览数据源接收原始数据。 在可以建立一组初始配置信息之后,可以将预览数据提交给索引处理流水线。 预览应用可以基于预览索引数据和配置信息生成预览结果。 预览结果可能可以预览索引应用程序如何处理数据。 如果预览结果不可接受,则可以修改配置信息。 预览应用程序可以修改配置信息,直到生成的预览结果可以接受。 如果配置信息是可接受的,则预览数据可以在一个或多个索引存储中被处理和索引。

    Determining events associated with a value

    公开(公告)号:US10579648B2

    公开(公告)日:2020-03-03

    申请号:US15582668

    申请日:2017-04-29

    Applicant: SPLUNK, Inc.

    Abstract: Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

    Determining Rules Based on Text
    17.
    发明申请

    公开(公告)号:US20170255695A1

    公开(公告)日:2017-09-07

    申请号:US15582671

    申请日:2017-04-29

    Applicant: SPLUNK, Inc.

    Abstract: Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

    Previewing parsed raw data using a graphical user interface
    19.
    发明授权
    Previewing parsed raw data using a graphical user interface 有权
    使用图形用户界面预览解析的原始数据

    公开(公告)号:US09442981B2

    公开(公告)日:2016-09-13

    申请号:US14929332

    申请日:2015-10-31

    Applicant: Splunk Inc.

    Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

    Abstract translation: 实施例针对在将对应的索引数据添加到索引存储之前预览从索引数据原始数据生成的结果。 可以从预览数据源接收原始数据。 在可以建立一组初始配置信息之后,可以将预览数据提交给索引处理流水线。 预览应用可以基于预览索引数据和配置信息生成预览结果。 预览结果可能可以预览索引应用程序如何处理数据。 如果预览结果不可接受,则可以修改配置信息。 预览应用程序可以修改配置信息,直到生成的预览结果可以接受。 如果配置信息是可接受的,则预览数据可以在一个或多个索引存储中被处理和索引。

    Real time display of statistics and values for selected regular expressions
    20.
    发明授权
    Real time display of statistics and values for selected regular expressions 有权
    实时显示所选正则表达式的统计信息和值

    公开(公告)号:US09152929B2

    公开(公告)日:2015-10-06

    申请号:US13748360

    申请日:2013-01-23

    Applicant: SPLUNK INC.

    Abstract: Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

    Abstract translation: 实施例涉及基于诸如正则表达式的至少一个提取规则来实时显示事件记录和提取的值。 可以使用用户界面来使用户能够自动生成提取规则和/或手动输入提取规则。 可以使用户手动编辑先前提供的提取规则,这可以导致更新的提取值的实时显示。 提取规则可以用于从多个记录中的每一个提取值,包括非结构化机器数据的事件记录。 可以针对每个唯一提取的值确定统计量,并且可以实时地向用户显示。 用户界面还可以使用户能够选择至少一个唯一的提取值来显示包括与所选择的值匹配的提取值的那些事件记录。

Patent Agency Ranking