Graphical Display of Event Data Using Pull-Down Menus

Abstract

The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 creating a plurality of searchable, time-stamped events by determining a beginning and an end of each event of the plurality of searchable, time-stamped events within received raw data, wherein raw data included in each event retains its original format;   causing display of a first portion of a graphical user interface that comprises a first pull-down menu for selecting a field name for a first axis of a graphical chart displayed in a second portion of the graphical user interface, the field name corresponding to a field present in at least a portion of the searchable, time-stamped events;   causing display of a third portion of a graphical user interface that comprises a second pull-down menu for selecting an attribute for a second axis of the graphical chart displayed in the second portion of the graphical user interface, the attribute associated with field values in the field;   in response to receiving a selection of a field name from the first pull-down window, creating a search result by performing a search across the plurality of searchable, time-stamped events for one or more field values in a field associated with the selected field name and including the one or more field values in the search result;   causing display of the graphical chart in the second portion of the graphical user interface using field values in the search result to populate the first axis and the second axis.   
     
     
         2 . The method of  claim 1 , wherein causing display of the graphical chart further comprises:
 calculating one or more metrics using the one or more field values in the search result; and   plotting the graphical chart using the one or more metrics.   
     
     
         3 . The method of  claim 1 , wherein the graphical chart is a bar chart. 
     
     
         4 . The method of  claim 1 , wherein the graphical chart is a scatter chart. 
     
     
         5 . The method of  claim 1 , wherein the graphical chart is an area chart. 
     
     
         6 . The method of  claim 1 , wherein the graphical chart is a line chart. 
     
     
         7 . The method of  claim 1 , wherein the graphical chart is a radial gauge. 
     
     
         8 . The method of  claim 1 , wherein the graphical chart is a marker gauge. 
     
     
         9 . The method of  claim 1 , wherein the graphical chart is a filler gauge. 
     
     
         10 . The method of  claim 1 , wherein the raw data included in the events includes machine data. 
     
     
         11 . The method of  claim 1 , wherein the raw data included in the events includes unstructured data. 
     
     
         12 . The method of  claim 1 , wherein creating a search result by performing a search across the plurality of searchable, time-stamped events further comprises:
 applying a late-binding schema to the plurality of searchable, time-stamped events, the late-binding schema including the field.   
     
     
         13 . The method of  claim 1 , further comprising:
 causing display of a plurality of graphical charts in parallel rows in the second portion of the graphical user interface.   
     
     
         14 . The method of  claim 1 , further comprising:
 causing display of a plurality of graphical charts in parallel columns in the second portion of the graphical user interface.   
     
     
         15 . The method of  claim 1 , wherein creating a search result by performing a search across the plurality of searchable, time-stamped events further comprises:
 creating one or more aggregate values across one or more distinct field values among the one or more field values;   modifying the search result to include the one or more distinct field values and the one or more aggregate values.   
     
     
         16 . The method of  claim 1 , wherein creating a search result by performing a search across the plurality of searchable, time-stamped events further comprises:
 filtering the search result using a filtering criteria.   
     
     
         17 . An apparatus, comprising:
 an event creator, implemented at least partially in hardware, that creates a plurality of searchable, time-stamped events by determining a beginning and an end of each event of the plurality of searchable, time-stamped events within received raw data, wherein raw data included in each event retains its original format;   a display formatter, implemented at least partially in hardware, that causes display display of a first portion of a graphical user interface that comprises a first pull-down menu for selecting a field name for a first axis of a graphical chart displayed in a second portion of the graphical user interface, the field name corresponding to a field present in at least a portion of the searchable, time-stamped events;   wherein the display formatter causes display of a third portion of a graphical user interface that comprises a second pull-down menu for selecting an attribute for a second axis of the graphical chart displayed in the second portion of the graphical user interface, the attribute associated with field values in the field;   a search processor, implemented at least partially in hardware, that, in response to receiving a selection of a field name from the first pull-down window, creates a search result by performing a search across the plurality of searchable, time-stamped events for one or more field values in a field associated with the selected field name and including the one or more field values in the search result;   wherein the display formatter causes display of the graphical chart in the second portion of the graphical user interface using field values in the search result to populate the first axis and the second axis.   
     
     
         18 . The apparatus of  claim 17 , wherein the graphical chart is at least one of: bar chart, scatter chart, area chart, line chart, radial gauge, marker gauge, or filler gauge. 
     
     
         19 . One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
 creating a plurality of searchable, time-stamped events by determining a beginning and an end of each event of the plurality of searchable, time-stamped events within received raw data, wherein raw data included in each event retains its original format;   causing display of a first portion of a graphical user interface that comprises a first pull-down menu for selecting a field name for a first axis of a graphical chart displayed in a second portion of the graphical user interface, the field name corresponding to a field present in at least a portion of the searchable, time-stamped events;   causing display of a third portion of a graphical user interface that comprises a second pull-down menu for selecting an attribute for a second axis of the graphical chart displayed in the second portion of the graphical user interface, the attribute associated with field values in the field;   in response to receiving a selection of a field name from the first pull-down window, creating a search result by performing a search across the plurality of searchable, time-stamped events for one or more field values in a field associated with the selected field name and including the one or more field values in the search result;   causing display of the graphical chart in the second portion of the graphical user interface using field values in the search result to populate the first axis and the second axis.   
     
     
         20 . The one or more non-transitory computer-readable storage media of  claim 19 , wherein the graphical chart is at least one of: bar chart, scatter chart, area chart, line chart, radial gauge, marker gauge, or filler gauge.