Splunk Inc.

Apple Inc.

Alice Emily Neels

Marc Vincent Robichaud

Steve Yu Zhang

Stephen Phillip Sorkin

Archana Sulochana Ganapathi

Simon Foster Fishel

Sundar Vasan

Divanny I Lamas

Nicholas K Jong

Embodiments include generating data models that may give semantic meaning for unstructured or structured data that may include data generated and/or received by search engines, including a time series engine. A method includes generating a data model for data stored in a repository. Generating the data model includes generating an initial query string, executing the initial query string on the data, generating an initial result set based on the initial query string being executed on the data, determining one or more candidate fields from one or results of the initial result set, generating a candidate data model based on the one or more candidate fields, iteratively modifying the candidate data model until the candidate data model models the data, and using the candidate data model as the data model.

Data model selection and application based on data sources

The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

Generating reports from unstructured data

Graphical display of field values extracted from machine data

A processing device performs a preliminary grouping of data items in a dataset to define one or more clusters and for each cluster, identifies a set of search terms for a search query that would retrieve data items in the cluster upon execution of the search query against the dataset.

Identification of relevant data events by use of clustering

Graphical controls for selecting criteria based on fields present in event data

Generation of a search query to approximate replication of a cluster of events

Embodiments are directed towards determining and tracking metadata for the generation of visualizations of requested data. A user may request data by providing a query that may be employed to search for the requested data. The query may include a plurality of commands, which may be employed in a pipeline to perform the search and to generate a table of the requested data. In some embodiments, each command may be executed to perform an action on a set of data. The execution of a command may generate one or more columns to append and/or insert into the table of requested data. Metadata for each generated column may be determined based on the actions performed by executing the commands. The table of requested data and the column metadata may be employed to generate and display a visualization of at least a portion of the requested data to a user.

Associating metadata with results produced by applying a pipelined search command to machine data in timestamped events

Text correction processing is disclosed. An initial score is assigned to each of a plurality of candidate sequences of one or more characters, based at least in part on a keyboard geometry-based value associated with the received user input with respect to the candidate key. Further processing is performed with respect to a subset of the candidate sequences having the highest initial score(s) to determine for each candidate sequence in the subset a refined score. A candidate sequence is selected for inclusion in a result set based at least in part on a determination that a refined score of the selected candidate is higher than an initial score of one or more candidate sequences that are not included in the subset and with respect to which the further processing has not been performed.

Text correction processing

Generation of a data model applied to object queries

Fields may be discovered in events that are returned in response to an initial search. The events may comprise portions of raw data. Furthermore, the fields may be defined by extraction rules for extracting values from corresponding portions of raw data. The displaying of a graphical user interface (GUI) may be caused where the GUI enables a user to select or enter criteria for a subset of the discovered fields without entering a search query in a search bar. At least one criterion for at least one field from the subset of the discovered fields may be received through a portion of the GUI that does not include a search bar for entering a search query. The events returned in response to the initial search query may be caused to be filtered based on the received criterion.

Growing community of inventors

San Francisco, CA, United States of America

Alice Emily Neels