Child Query Execution via Parent Result Identifier
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data intake and query systems face challenges in efficiently searching and analyzing large sets of raw machine data due to the lack of user-friendly tools for visually identifying data subsets, despite advancements in storage capacity that allow for the retention of minimally processed data for later analysis.
Innovation Solution
A data intake and query system architecture that includes a flexible schema for extracting information from events, utilizing a late-binding schema for field-searchable data, and a graphical user interface for recommending query parameters and templates, enabling users to form and execute queries based on user interactions and previous query results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If tools are provided to search data systems separately and collect results over a network, then data analysis capability is improved, but user-friendliness and ease of visual identification deteriorate
Solution Approach 1:
The patent combines multiple separate data system searches into a single unified graphical interface. The system executes queries across multiple data systems simultaneously and presents results in one consolidated visual display, eliminating the need for users to manually search each system separately and collect results over a network.
Solution Approach 2:
The patent introduces an intermediary processing layer that receives user queries, automatically executes them across multiple data systems, and transforms the results into a user-friendly visual format. This intermediary handles the complexity of multi-system coordination while presenting a simple interface to users.
2Adaptability or versatility
If massive quantities of raw data are stored for later retrieval and analysis, then data flexibility and analysis scope are improved, but data processing complexity and time requirements worsen
Solution Approach 1:
The patent performs preliminary data processing and indexing when data is initially stored, creating searchable structures in advance. This preliminary action enables rapid retrieval and analysis of raw data later, reducing processing time while maintaining the ability to analyze all generated data.
3Speed
If pre-specified data items are extracted and stored to facilitate efficient retrieval, then data retrieval speed is improved, but data analysis scope and flexibility deteriorate
Solution Approach 1:
The patent segments data storage into multiple layers: pre-processed extracted data for fast retrieval of specific items, and complete raw data for comprehensive analysis. This segmentation allows the system to provide both rapid access to predefined data and the flexibility to analyze entire data sets when needed.
Data Source
AI summary
Systems and methods are disclosed for allowing a user to iteratively build a query. For example, a user interface (UI) data manager can obtain a child query entered or selected by a user. The child query may be a child query to a parent query, such that execution of the child query relies on the query results of the parent query. The UI data manager can associate an identifier corresponding to the query results of the parent query with the child query, and cause a data intake and query system to execute the second query using the identifier. The UI data manager can then instruct a client browser to display the query results provided by the data intake and query system in a graphical user interface (GUI) in an area separate from an area that displays the query results of the parent query.