Graphically Selectable Filter Parameters for Field Data in a Set of Machine Data

Abstract

The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 causing display of a graphical control for selecting a first field, from a plurality of fields, to be used in a graphical visualization, each field in the plurality of fields present in a set of machine data;   causing display of a second graphical control for selecting a filter for filtering data from the first field extracted from the set of machine data;   in response to receiving selection of the filter, filtering data from the first field extracted from the set of machine data using the filter;   causing display of the graphical visualization using the filtered data.   
     
     
         2 . The method of  claim 1 , wherein the second graphical display displays a plurality of filters, wherein the plurality of filters is selected for display based on the first field. 
     
     
         3 . The method of  claim 1 , wherein the second graphical display displays a plurality of filters, wherein the plurality of filters is selected for display based on the graphical visualization. 
     
     
         4 . The method of  claim 1 , wherein the second graphical display displays a plurality of filters, wherein the plurality of filters is selected for display based on the graphical visualization and the first field. 
     
     
         5 . The method of  claim 1 , wherein the filter specifies a range. 
     
     
         6 . The method of  claim 1 , wherein the filter is applied to data from two or more fields extracted from the set of machine data. 
     
     
         7 . The method of  claim 1 , wherein the filter identifies a subset of the set of machine data. 
     
     
         8 . The method of  claim 1 , further comprising:
 causing display of a third graphical control for selecting an aggregate function that is applied to the filtered data;   wherein the causing display of the graphical visualization uses one or more values obtained from applying the aggregate function to the filtered data.   
     
     
         9 . The method of  claim 1 , wherein the graphical visualization is a table. 
     
     
         10 . The method of  claim 1 , wherein the graphical visualization is a column chart. 
     
     
         11 . The method of  claim 1 , wherein the graphical visualization is a bar chart. 
     
     
         12 . The method of  claim 1 , wherein the graphical visualization is a scatter chart. 
     
     
         13 . The method of  claim 1 , wherein the graphical visualization is an area chart. 
     
     
         14 . The method of  claim 1 , wherein the graphical visualization is a line chart. 
     
     
         15 . The method of  claim 1 , wherein the graphical visualization is a pie chart. 
     
     
         16 . The method of  claim 1 , wherein the graphical visualization is a single value visualization. 
     
     
         17 . The method of  claim 1 , wherein the graphical visualization is a radial gauge. 
     
     
         18 . The method of  claim 1 , wherein the graphical visualization is a marker gauge. 
     
     
         19 . The method of  claim 1 , wherein the graphical visualization is a filler gauge.