Splunk Inc.

Other

David Carasso

Micah James Delfino

Stephen Phillip Sorkin

Marc Vincent Robichaud

Jesse Brandau Miller

Mitchell Blank, Jr

Eric Timothy Woo

Johnvey Hwang

Leonid Budchenko

Robin Kumar Das

Andre David Stechert

Michael Joseph Baum

Erik M Swan

Brian Philip Murphy

Brad Hall

Rory Greene

Catherine Anne Hanson

Nick Mealy

Nicholas Christian Mealy

Christina Noren

The technology disclosed relates to formulating and refining field extraction rules that are used at query time on raw data with a late-binding schema. The field extraction rules identify portions of the raw data, as well as their data types and hierarchical relationships. These extraction rules are executed against very large data sets not organized into relational structures that have not been processed by standard extraction or transformation methods. By using sample events, a focus on primary and secondary example events help formulate either a single extraction rule spanning multiple data formats, or multiple rules directed to distinct formats. Selection tools mark up the example events to indicate positive examples for the extraction rules, and to identify negative examples to avoid mistaken value selection. The extraction rules can be saved for query-time use, and can be incorporated into a data model for sets and subsets of event data.

Using anchors to generate extraction rules

Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

Facilitating event creation via previews

Generating anonymized data from events are disclosed. Via a graphical user interface (GUI), an output dataset mode for an anonymized output dataset is received. The output dataset mode is stored or an active stream. The output dataset mode in anonymization configuration information. An anonymized output dataset is produced in accordance with the anonymization configuration information, where the output dataset comprises information related to at least a portion of a plurality of events, wherein the plurality of events each comprise a timestamp and a portion of machine data. Further, the GUI to displays the anonymized output dataset.

Machine data anonymization

Event selection via graphical user interface control

Providing extraction results for a particular field

Components of a system for generating anonymized data from timestamped event data are disclosed. The generation of anonymized data is performed in accordance with an anonymization configuration. The anonymization configuration includes information regarding the source of the event data, particulars about the anonymization process that transforms the clear event data from the source into an anonymized form, and particulars about the destination and characteristics for the output dataset. A graphical user interface permits development of anonymization configurations in an interactive, iterative way. The configured anonymizer employs methods and options to produce anonymized data with superior usability as a substitute for real world data, including a mode to effectively emulate live data streams.

Growing community of inventors

San Francisco, CA, United States of America

David Carasso