Graphically Selectable Aggregate Functions for Field Data in a Set of Machine Data

Abstract

The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 causing display of a graphical control for selecting a first field, from a plurality of fields, to be used in a graphical visualization, each field in the plurality of fields present in a set of machine data;   causing display of a second graphical control for selecting an aggregate function for application to data from the first field extracted from the set of machine data;   in response to receiving selection of the aggregate function, creating one or more values by applying the aggregate function to data from the first field extracted from the set of machine data;   causing display of the graphical visualization using the one or more values.   
     
     
         2 . The method of  claim 1 , wherein the second graphical display displays a plurality of aggregate functions, wherein the plurality of aggregate functions is selected for display based on the first field. 
     
     
         3 . The method of  claim 1 , wherein the second graphical display displays a plurality of aggregate functions, wherein the plurality of aggregate functions is selected for display based on the graphical visualization. 
     
     
         4 . The method of  claim 1 , wherein the second graphical display displays a plurality of aggregate functions, wherein the plurality of aggregate functions is selected for display based on the graphical visualization and the first field. 
     
     
         5 . The method of  claim 1 , wherein the aggregate function specifies a count. 
     
     
         6 . The method of  claim 1 , wherein the aggregate function specifies a sum. 
     
     
         7 . The method of  claim 1 , wherein the aggregate function specifies an average. 
     
     
         8 . The method of  claim 1 , wherein the aggregate function specifies a maximum. 
     
     
         9 . The method of  claim 1 , wherein the aggregate function specifies a minimum. 
     
     
         10 . The method of  claim 1 , wherein the aggregate function specifies a standard deviation. 
     
     
         11 . The method of  claim 1 , wherein the aggregate function specifies a list of distinct values. 
     
     
         12 . The method of  claim 1 , wherein the aggregate function specifies a count of distinct values. 
     
     
         13 . The method of  claim 1 , wherein the aggregate function specifies a first value. 
     
     
         14 . The method of  claim 1 , wherein the aggregate function specifies a last value. 
     
     
         15 . The method of  claim 1 , wherein the aggregate function specifies a duration. 
     
     
         16 . The method of  claim 1 , wherein the aggregate function specifies an earliest value. 
     
     
         17 . The method of  claim 1 , wherein the aggregate function specifies a latest value. 
     
     
         18 . The method of  claim 1 , further comprising:
 causing display of a third graphical control for selecting a filter;   wherein the creating one or more values applies the aggregate function to data filtered from the data from the first field extracted from the set of machine data using the filter.   
     
     
         19 . The method of  claim 1 , wherein the graphical visualization is a table. 
     
     
         20 . The method of  claim 1 , wherein the graphical visualization is a column chart. 
     
     
         21 . The method of  claim 1 , wherein the graphical visualization is a bar chart. 
     
     
         22 . The method of  claim 1 , wherein the graphical visualization is a scatter chart. 
     
     
         23 . The method of  claim 1 , wherein the graphical visualization is an area chart. 
     
     
         24 . The method of  claim 1 , wherein the graphical visualization is a line chart. 
     
     
         25 . The method of  claim 1 , wherein the graphical visualization is a pie chart. 
     
     
         26 . The method of  claim 1 , wherein the graphical visualization is a single value visualization. 
     
     
         27 . The method of  claim 1 , wherein the graphical visualization is a radial gauge. 
     
     
         28 . The method of  claim 1 , wherein the graphical visualization is a marker gauge. 
     
     
         29 . The method of  claim 1 , wherein the graphical visualization is a filler gauge.