Extraction Rule Feedback for Real-Time Event Record Verification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The rapid increase in machine-generated data production creates large, unstructured datasets that are difficult to analyze efficiently, leading to challenges in determining effective extraction rules, which can result in improper or omitted value extraction.

Innovation Solution

A system that enables real-time display of event records with an indication of previously provided extraction rules, allowing users to generate or manually enter extraction rules, and emphasizes relevant text fields using techniques such as highlighting or dimming, facilitating efficient analysis of large datasets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual analysis of large unstructured datasets is performed to determine extraction rules, then extraction accuracy may be improved, but time consumption and analysis effort increase significantly

Engineering Contradiction:
Improveextraction accuracyVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system applies feedback by displaying extracted field values back to users with visual emphasis (highlighting or dimming) to allow verification and refinement of extraction rules. This iterative feedback loop enables users to quickly assess extraction accuracy and adjust rules without manually analyzing entire datasets, resolving the contradiction between extraction precision and analysis time.

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The patent uses visual emphasis techniques including highlighting and dimming to draw user attention to extracted field values. This visual feedback mechanism allows users to rapidly verify extraction accuracy across large datasets without reading each value in detail, significantly reducing analysis time while maintaining extraction precision.

Inventive Principle:
Principle #32Color changes

2Loss of information

If comprehensive extraction rules are applied to extract all possible field values, then data extraction completeness is improved, but system complexity and processing overhead increase

Engineering Contradiction:
Improveextraction completenessVSAvoidsystem complexity
Core Design Contradiction:
Loss of informationVSDevice complexity

Solution Approach 1:

The system extracts only the specific field values that match defined extraction rules from unstructured data, rather than processing and analyzing the entire dataset. This selective extraction approach ensures completeness of relevant information while avoiding the complexity of comprehensive data processing.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments unstructured data into distinct field values based on extraction rules, allowing the system to handle complex extraction tasks through multiple simple, targeted rules rather than one complex processing system, thereby reducing overall system complexity.

Inventive Principle:
Principle #1Segmentation

3Productivity

If real-time display of extracted fields with visual emphasis is implemented, then user verification efficiency is improved, but processing time and computational resources increase

Engineering Contradiction:
Improveverification efficiencyVSAvoidprocessing resources
Core Design Contradiction:
ProductivityVSUse of energy by stationary object

Solution Approach 1:

The system uses visual emphasis techniques (highlighting or dimming) to draw user attention to extracted field values in real-time display. This approach enables efficient user verification by allowing rapid visual scanning without requiring users to read and analyze each value in detail, achieving high verification efficiency with minimal additional processing resources.

Inventive Principle:
Principle #32Color changes

Solution Approach 2:

The patent applies partial action by emphasizing only the extracted field values rather than processing or displaying all data with equal emphasis. This selective visual processing maintains real-time verification efficiency while consuming minimal computational resources.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentUS20260029988A1Updating event records based on user edited extraction rule
Publication Date: 2026.01.29 SPLUNK INC
  • US20260029988A1 patent drawing
  • US20260029988A1 patent drawing
  • US20260029988A1 patent drawing

AI summary

Embodiments are directed towards real time display of event records with an indication of previously provided extraction rules. A plurality of extraction rules may be provided to the system, such as automatically generated and/or user created extraction rules. These extraction rules may include regular expressions. A plurality of event records may be displayed to the user, such that text in a field defined by an extraction rule is emphasized in the display of the event record. The same emphasis may be provided for text in overlapping fields, or the emphasis may be somewhat different for different fields. The user interface may enable a user to select a portion of text of an event record, such as by rolling-over or clicking on an emphasized part of the event record. By selecting the portion of the event record, the interface may display each extraction rule associated with the selected portion.