Splunk Inc.

Cisco Technology, Inc.

Nima Haddadkaveh

Clint Sharp

Ledion Bitincka

Elizabeth Lin

Jason Szeto

Petter Eriksson

Arjun Iyer

Yuchen Zhao

Jesse Miller

A search support system allows a customer to browse data contained in files stored on an external storage system. The search support system allows a customer to specify data processing tasks to be performed on raw data retrieved from a file stored on the external storage system. The customer specifies each data processing task and the search support system performs each task as it is selected by the customer on raw data retrieved from the file. The search support system concurrently displays the results of each data processing task in real time in a graphical user interface. The search support system saves the customer's settings as a late binding schema that can be applied to raw data retrieved from the external storage system in order to parse the raw data and to create, index, and search timestamped events derived from the raw data.

File browser user interface

Raw data in distributed servers is divided into groups of data called buckets containing raw data that have timestamps that fall within a specific time range. When a bucket becomes inactive a server can archive the bucket to an external storage system. The external storage system containing archived data may be specified in a search query. Archived data from the external storage system is obtained, processed, and a search performed on the processed archived data using the search query.

Searching archived data

In one aspect, a regular expression is automatically generated based on user input for fields that are desired to be extracted from log lines. The input may be received by user through an interface provided by a machine such as a controller. The input may identify one or more fields within a log line that should be extracted. Multiple instances of potential regular expression portions may be generated based on the user input, and different portions are combined together to determine if they achieve the desired extraction. Once a complete regular expression is generated based on user input, a user may provide additional input to identify examples or counterexamples of log line fields that satisfy or don't satisfy the user's intended extraction.

Automatic generation of regular expression based on log line data

Archiving indexed data

Growing community of inventors

San Francisco, CA, United States of America

Nima Haddadkaveh