Splunk Inc.

Yiyun Zhu

Yongxin Su

Ting Yuan

Qian Jie Zhong

Li Li

Jindrich Dinga

Mei Chun Yeh

Jacob Sebastian Stark

Hasti Khaki

Soomee Kang

Jeff Sredni

Chung-Han Tsai

Embodiments of the present invention are directed to enhancing extraction rules utilizing user feedback. In embodiments, a set of extraction rules relevant to an event set are provided for display. Thereafter, a selection of an extraction rule is received and, in response, a set of events matching the selected extraction rule is provided for display. A modification, for example provided by a user, in association with the extraction rule or the set of events is received. Such a modification is then used (e.g., via machine learning) to enhance extraction rules available for performing subsequent data extraction.

Enhancing extraction rules based on user feedback

Display screen or portion thereof having a graphical user interface

Embodiments of the present invention are directed to validating extraction rules. In embodiments, a set of events for which field extraction is desired is obtained. Thereafter, an extraction rule is applied to the set of events to extract fields of the events. The application of the extraction rule can be monitored to determine that the applied extraction rule is invalid. Based on the applied extraction rule being invalid, a new extraction rule can be generated to apply to the set of events.

Inferring sourcetype based on match rates for rule packages

Extraction rule validation

Growing community of inventors

Vancouver, Canada

Yiyun Zhu