Previewing an extraction rule for raw machine data and modifying the rule through counter-example

Abstract

Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

1 . A computer-implemented method, comprising:
 accessing in memory a set of events, each event identified by an associated time stamp and including a portion of raw data from machine data;   transmitting for display a user interface including a first event and a plurality of second events of the set of events;   receiving data indicating a selected portion of text within the first event;   automatically determining a field extraction rule that extracts as a field value the selected portion of text when the field extraction rule is applied to the first event; and   transmitting for display an updated user interface that includes the second events and that indicates a field value for each second event that would be extracted by applying the extraction rule to the second event.   
     
     
         2 . The method of  claim 1 , wherein the first event includes unstructured data. 
     
     
         3 . The method of  claim 1 , further comprising:
 receiving a rejection of an indicated field value of a second event, indicating that the rejected field value in the second event does not comprise a desired value to extract from the second event; and   modifying the field extraction rule such that the modified field extraction rule would extract the selected portion of text within the first event when the field extraction rule is applied and would not extract the rejected field value in the second event.   
     
     
         4 . The method of  claim 1 , further comprising:
 receiving a selected portion of text within a second event that is not indicated as being selected by the field extraction rule; and   modifying the field extraction rule such that the modified field extraction rule would extract the selected portion of text within the first event when the modified field extraction rule is applied and would also extract the selected portion of text within the second event when the modified field extraction rule is applied to the second event.   
     
     
         5 . The method of  claim 1 , wherein the field extraction rule comprises a regular expression. 
     
     
         6 . The method of  claim 1 , further comprising:
 displaying natural language representing the field extraction rule;   receiving an edit to the natural language;   determining a modified field extraction rule corresponding to the edited natural language; and   determining values for the field corresponding to the modified field extraction rule.   
     
     
         7 . The method of  claim 1 , further comprising determining a data type of the selected portion of text within the first event, and wherein determining the field extraction rule that extracts as the field value from the selected portion of text within the first event further comprises extracting a value of the data type as the value of the field for at least one other event. 
     
     
         8 . The method of  claim 1 , further comprising:
 receiving an indication that a value is to serve as a counter example for the field; and   modifying the field extraction rule to bias against identifying the counter-example value as a value for the field.   
     
     
         9 . A network device that is operative for generating extraction rules, comprising:
 a transceiver that is operative to communicate over a network;   a memory that is operative to store at least instructions; and   a processor device that is operative to execute instructions that enable actions, including:
 accessing in memory a set of events, each event identified by an associated time stamp; 
 wherein each event in the set of events includes a portion of raw data from machine data; 
 transmitting for display a user interface including a first event and a plurality of second events of the set of events; 
 receiving data indicating a selection of a portion of text within the first event; 
 automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and 
 transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event. 
   
     
     
         10 . The network device of  claim 9 , wherein the first event includes machine data. 
     
     
         11 . The network device of  claim 9 , wherein the first event includes unstructured data. 
     
     
         12 . The network device of  claim 9 , wherein storing the plurality of events includes indexing each event of the plurality of events. 
     
     
         13 . The network device of  claim 9 , wherein the actions further comprise:
 receiving an indication that a desired value of the field for the second event does not comprise the indicated value of the field for the second event; and   modifying the field extraction rule such that the modified field extraction rule would extract the selection of the portion of text when the field extraction rule is applied to the first event and would extract a value of the field for the second event that is different from the indicated value of the field for the second event when the field extraction rule is applied to the second event.   
     
     
         14 . The network device of  claim 9 , wherein the actions further comprise:
 receiving a selection of a portion of text within the second event; and   modifying the field extraction rule such that the modified field extraction rule would extract the selection of the portion of text within the first event when the field extraction rule is applied to the first event and would extract the selection of the portion of text within the second event when the field extraction rule is applied to the second event.   
     
     
         15 . The network device of  claim 9 , wherein the field extraction rule comprises a regular expression. 
     
     
         16 . The network device of  claim 9 , wherein the actions further comprise:
 displaying natural language representing the field extraction rule; receiving an edit to the natural language;   determining a modified field extraction rule corresponding to the edited natural language; and   determining values for the field corresponding to the modified field extraction rule.   
     
     
         17 . The network device of  claim 9 , wherein the actions further comprise determining a data type of the selection of the portion of text within the first event, and wherein determining the field extraction rule that extracts as the value of the field the selection of the portion of text within the first event comprises determining that the field extraction rule would extract a value comprising the data type as the value of the field for at least one other event. 
     
     
         18 . A processor readable non-transitive storage media that includes instructions for generating extraction rules over a network, wherein execution of the instructions by a processor device enables actions, comprising:
 accessing in memory a set of events, each event identified by an associated time stamp;   wherein each event in the set of events includes a portion of raw data from machine data;   transmitting for display a user interface including a first event and a plurality of second events of the set of events;   receiving data indicating a selection of a portion of text within the first event;   automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and   transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event.   
     
     
         19 . The media of  claim 18 , wherein the first event includes machine data. 
     
     
         20 . The media of  claim 18 , wherein the first event includes unstructured data. 
     
     
         21 . The media of  claim 18 , wherein storing the plurality of events includes indexing each event of the plurality of events. 
     
     
         22 . The media of  claim 18 , wherein the actions further comprise:
 receiving an indication that a desired value of the field for the second event does not comprise the indicated value of the field for the second event; and   modifying the field extraction rule such that the modified field extraction rule would extract the selection of the portion of text when the field extraction rule is applied to the first event and would extract a value of the field for the second event that is different from the indicated value of the field for the second event when the field extraction rule is applied to the second event.   
     
     
         23 . The media of  claim 18 , wherein the actions further comprise:
 receiving a selection of a portion of text within the second event; and   modifying the field extraction rule such that the modified field extraction rule would extract the selection of the portion of text within the first event when the field extraction rule is applied to the first event and would extract the selection of the portion of text within the second event when the field extraction rule is applied to the second event.   
     
     
         24 . The media of  claim 18 , wherein the field extraction rule comprises a regular expression. 
     
     
         25 . The media of  claim 18 , wherein the actions further comprise:
 displaying natural language representing the field extraction rule; receiving an edit to the natural language;   determining a modified field extraction rule corresponding to the edited natural language; and   determining values for the field corresponding to the modified field extraction rule.   
     
     
         26 . The media of  claim 18 , wherein the actions further comprise determining a data type of the selection of the portion of text within the first event, and wherein determining the field extraction rule that extracts as the value of the field the selection of the portion of text within the first event comprises determining that the field extraction rule would extract a value comprising the data type as the value of the field for at least one other event. 
     
     
         27 . A system that is arranged for generating extraction rules over a network, comprising:
 a server device, including:
 a transceiver that is operative to communicate over the network; 
 a memory that is operative to store at least instructions; and 
 a processor device that is operative to execute instructions that enable actions, including:
 accessing in memory a set of events, each event identified by an associated time stamp; 
 wherein each event in the set of events includes a portion of raw data from machine data; 
 transmitting for display a user interface including a first event and a plurality of second events of the set of events; 
 receiving data indicating a selection of a portion of text within the first event; 
 automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and 
 transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event. 
 
   
     
     
         28 . The system of  claim 27 , wherein the first event includes machine data.