Splunk Inc.

Siegfried Puchbauer-Schnabel

Nicholas John Filippi

Carl S Yestrau

Vivian Shen

J Mathew Elting

Simon Foster Fishel

Cary Glen Noel

Michael Porath

Mathew Elting

Adam Jamison Oliner

Clark Eugene Mullen

Marshall Chalmers Agnew

Carl Sterling Yestrau

J Matthew Elting

Nicholas J Filippi

A system that enables a user to configure alert actions based on search results generated by a query is disclosed. During operation, the system presents an alert user interface (UI) to a user, wherein the alert UI enables the user to configure one or more alert actions to be performed based on the search results. Next, the system receives alert configuration information from the user through the alert UI, wherein the alert configuration information includes tokens representing parameters associated with the query and the search results. Then, while generating an alert associated with the search results, the system performs a token substitution operation that substitutes tokens in the alert configuration information with corresponding parameters from the search results to generate a payload that is communicated to alert-generating functionality. This token substitution allows the parameters to be used by the alert-generating functionality while performing the one or more alert actions.

Graphical user interface for alert configuration

Executing alert actions based on search query results

Provided are systems and methods for determining and displaying automatically binned information via a graphical user interface. A graphical user interface (GUI) may include a first graphical element representing a first metric value for a first time window and a second graphical element representing a second metric value for a second time window. An indication of a selection of the first time window may be received via the GUI. An updated GUI comprising a third graphical element representing a third metric value for the third time window and a fourth graphical element representing the fourth metric value for the fourth time window may be displayed, wherein the third time window and the fourth time window may be sub-ranges of the first time window.

Binning information associated with ranges of time

Embodiments of the disclosure are systems and methods for updating third party visualizations in response to a query. In one embodiment, a method is provided that includes receiving input data comprising events, where the events comprise time-stamped machine- generated data. The method also comprises receiving a modular visualization that includes a variable field associated with a visualization and instructions for rendering the visualization using the input data and the variable field. Further, the method comprises rendering the visualization based on the input data and a value associated with the variable field. Additionally, the method comprises updating the value of the variable field and obtaining updated input data using a search query that is generated using the updated value. The visualization is re-rendered based on the updated input data and the updated value.

Systems and methods for rendering a third party visualization in response to events received from search queries

A data intake and query system may store raw machine data that includes location information. A client system may include a user interface for searching the data intake and query system. The user interface allows a user to define a field search query and to define one or more ad-hoc boundary regions on a map. A combined query is transmitted to the data intake and query system, the combined query including both the field search query and location search information that is based on the ad-hoc boundary regions. The data intake and query system runs the combined query and returns responsive results, which are displayed at the client user interface.

Interactive location queries for raw machine data

The disclosed embodiments relate to a system that generates an alert based on information extracted from search results generated by a query. During operation, the system executes the query to generate the search results. The system also obtains configuration information for the alert, wherein the configuration information identifies information associated with the search results, and also specifies a trigger condition for the alert. Next, when the trigger condition for the alert is met, the system uses the configuration information to generate a payload containing the identified information associated with the search results. The system then invokes alert-generating functionality and provides the payload as input to the alert-generating functionality. This enables the alert-generating functionality to use the information from the search results while performing one or more alert actions association with the alert.

User configurable alert notifications applicable to search query results

In various implementations, search results corresponding to a search query are obtained. A data visualization is generated from the search results. The generated data visualization is pushed to a registered display of a display device, where the pushing causes presentation of the generated data visualization on the registered display. An alert configuration interface may be caused to be presented on a display management device. From the displayed alert configuration interface, user input indicating an assignment of a set of trigger conditions to a display alert may be received. The display alert can be pushed to the registered display based on determining the set of trigger conditions is satisfied. The pushed display alert may be presented over the data visualization on the registered display.

Pushing presented data visualizations to assigned displays

Embodiments of the disclosure are systems and methods for updating third party visualizations in response to a query. In one embodiment, a method is provided that includes receiving input data comprising events, where the events comprise time-stamped machine-generated data. The method also comprises receiving a modular visualization that includes a variable field associated with a visualization and instructions for rendering the visualization using the input data and the variable field. Further, the method comprises rendering the visualization based on the input data and a value associated with the variable field. Additionally, the method comprises updating the value of the variable field and obtaining updated input data using a search query that is generated using the updated value. The visualization is re-rendered based on the updated input data and the updated value.

Systems and methods for updating a third party visualization in response to a query

A modular visualization framework registers definitions for a variety of visualization types. The definitions are tagged with visualization characteristics. During a working session, likely interactive, a user identifies a search query used to produce data to be visualized. The working context, including the search query and data produced by its execution, is tagged for its visualization characteristics. Information about the working context, including its visualization characteristics, is then used to produce a customized list of candidates suited for the working context from which the user may select a visualization type.

Context-adaptive selection options in a modular visualization framework

Pushing data visualizations to registered displays

Configuring alerts related to performance problems or security issues in an information technology environment

Embodiments of the disclosure are systems and methods for providing third party visualizations. In one embodiment, a method is provided that includes receiving, via an API, computer-executable instructions configured to render a visualization using events and a variable field; rendering the visualization using the events; causing displaying of a graphical user interface (GUI) comprising a visualization panel and a variable element; receiving, via the variable element of the GUI, an indication of a first change in the value of the variable field to a first value; re-rendering the visualization using the events and the first value; and causing display of the GUI with an updated visualization panel and the variable element.

Growing community of inventors

San Francisco, CA, United States of America

Siegfried Puchbauer-Schnabel