Splunk Inc.

Cisco Technology, Inc.

Splunkinc.

Jason Szeto

David Marquardt

Jindrich Dinga

Jose Solis

Jesse Brandau Miller

Ledion Bitincka

Clint Sharp

Elizabeth Lin

Nima Haddadkaveh

Petter Eriksson

Kyle Champlin

Cory Chen

Patrick Schulz

Jesse Miller

Systems and methods are disclosed involving user interface (UI) search tools for locating data, including tools for summarizing indexed raw machine data that organize and present results to enable expansion and exploration of initial summarizations. The initial summarizations may be explored and refined to help users determine how to identify and best focus a search on data subsets of greater interest.

Data identification using inverted indexes

A software module ingests data into a data intake and query system. At least a portion of the data is cloud data. The software module includes an event type definition that specifies a type of data to be ingested by the software module, a first tag that associates ingested data of the event type with a data model, and a second tag that designates ingested data of the event type as cloud data. The ingested data is stored in a data repository, and subsequently a search query that includes the first tag and the second tag is executed against the data repository, to identify ingested cloud data that satisfies the search query and a first search constraint specified in the data model. A display device is caused to display a visualization based on the identified ingested cloud data that satisfies the search query.

Integration of cloud-based and non-cloud-based data in a data intake and query system

Data categorization using inverted indexes

Ingestion and processing of both cloud-based and non-cloud-based data by a data intake and query system

User interface search tool for identifying and summarizing data

Systems and methods are disclosed for sampling a set of data using inverted indexes in response to a user interaction with a user interface. Based on the user interaction with a displayed grouping of a summarization of a set of data, the system uses filter criteria corresponding to the grouping to review one or more inverted indexes and identify a sample of events for analysis. The system then accesses the sample of events and provides the results for display to a user.

Sampling data using inverted indexes in response to grouping selection

Systems and methods are disclosed for locating data and categorizing a set of data using inverted indexes. The inverted indexes include token entries and field-value pair entries, as well as event references that correspond to events that include raw machine data. Using filter criteria, the inverted indexes are identified. In turn, the inverted indexes are used to identify a set of events that satisfy the filter criteria. The identified set of events are categorized based on categorization criteria and provided for display to a user.

Locating and categorizing data using inverted indexes

Raw data in distributed servers is divided into groups of data called buckets containing raw data that have timestamps that fall within a specific time range. When a bucket becomes inactive a server can archive the bucket to an external storage system. The external storage system containing archived data may be specified in a search query. Archived data from the external storage system is obtained, processed, and a search performed on the processed archived data using the search query.

Searching archived data

User interface search tool for locating and summarizing data

Archiving indexed data

Growing community of inventors

Belmont, CA, United States of America

Jason Szeto