Displaying Pie Charts of Event Data Using Pull-Down Menus

Abstract

The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

1 . A computer-implemented method, comprising:
 causing display of a graphical user interface that comprises a menu for selecting a field name for a characteristic of a graphical chart, the field name corresponding to a field present in at least a portion of a set of machine data;   in response to receiving a selection of a field name from the menu, creating a search result by performing a search across the set of machine data for one or more field values in a field associated with the selected field name;   causing display of the graphical chart using field values in the search result to populate the characteristic of the graphical chart.   
     
     
         2 . The method of  claim 1 , wherein causing display of the graphical chart further comprises:
 calculating one or more metrics using the one or more field values in the search result; and   plotting the graphical chart using the one or more metrics.   
     
     
         3 . The method of  claim 1 , wherein the graphical chart is a pie chart. 
     
     
         4 . The method of  claim 1 , wherein the graphical chart is a single value visualization. 
     
     
         5 . (canceled) 
     
     
         6 . The method of  claim 1 , wherein creating a search result by performing a search across the set of machine data further comprises:
 applying a late-binding schema to the set of machine data, the late-binding schema including the field.   
     
     
         7 . The method of  claim 1 , further comprising:
 causing display of a plurality of graphical charts in parallel rows.   
     
     
         8 . The method of  claim 1 , further comprising:
 causing display of a plurality of graphical charts in parallel columns.   
     
     
         9 . The method of  claim 1 , wherein creating a search result by performing a search across the set of machine data further comprises:
 creating one or more aggregate values across one or more distinct field values among the one or more field values;   modifying the search result to include the one or more distinct field values and the one or more aggregate values.   
     
     
         10 . The method of  claim 1 , wherein creating a search result by performing a search across the set of machine data further comprises:
 filtering the search result using a filtering criteria.   
     
     
         11 . An apparatus, comprising:
 a display formatter, implemented at least partially in hardware, that causes display of a graphical user interface that comprises a menu for selecting a field name for a characteristic of a graphical chart, the field name corresponding to a field present in at least a portion of a set of machine data;   a search processor, implemented at least partially in hardware, that in response to receiving a selection of a field name from the menu, creating a search result by performing a search across the set of machine data for one or more field values in a field associated with the selected field name;   wherein the display formatter causes display of the graphical chart using field values in the search result to populate the characteristic of the graphical chart.   
     
     
         12 . The apparatus of  claim 11 , further comprising:
 a metric calculator, implemented at least partially in hardware, that calculates one or more metrics using the one or more field values in the search result; and   wherein the display formatter plots the graphical chart using the one or more metrics.   
     
     
         13 . The apparatus of  claim 11 , wherein the graphical chart is a pie chart. 
     
     
         14 . The apparatus of  claim 11 , wherein the graphical chart is a single value visualization. 
     
     
         15 . The apparatus of  claim 11 , wherein the search processor further:
 creates one or more aggregate values across one or more distinct field values among the one or more field values;   modifies the search result to include the one or more distinct field values and the one or more aggregate values.   
     
     
         16 . One or more non-transitory computer-readable storage media,
 storing one or more sequences of instructions, which when executed by one or more processors cause performance of:   causing display of a graphical user interface that comprises a menu for selecting a field name for a characteristic of a graphical chart, the field name corresponding to a field present in at least a portion of a set of machine data;   in response to receiving a selection of a field name from the menu, creating a search result by performing a search across the set of machine data for one or more field values in a field associated with the selected field name;   causing display of the graphical chart using field values in the search result to populate the characteristic of the graphical chart.   
     
     
         17 . The one or more non-transitory computer-readable storage media of  claim 16 , wherein causing display of the graphical chart further comprises:
 calculating one or more metrics using the one or more field values in the search result; and   plotting the graphical chart using the one or more metrics.   
     
     
         18 . The one or more non-transitory computer-readable storage media of  claim 16 , wherein the graphical chart is a pie chart. 
     
     
         19 . The one or more non-transitory computer-readable storage media of  claim 16 , wherein the graphical chart is a single value visualization. 
     
     
         20 . The one or more non-transitory computer-readable storage media of  claim 16 , wherein creating a search result by performing a search across the set of machine data further comprises:
 creating one or more aggregate values across one or more distinct field values among the one or more field values;   modifying the search result to include the one or more distinct field values and the one or more aggregate values.