Text-Based Table Manipulation for Event Search Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern data centers face challenges in processing and analyzing large volumes of unstructured machine-generated data due to difficulties in applying semantic meaning and indexing, leading to inefficient search and data retrieval processes.
Innovation Solution
A text-based table manipulation system is introduced, allowing users to interactively select data items in a table format, generate contextually relevant command options, and modify search queries directly, which are then executed to update the search results dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If data is maintained in unstructured form to preserve more data for later use, then data completeness is improved, but indexing and searching operations become difficult
Solution Approach 1:
The patent segments unstructured data into structured event records with standardized fields (timestamp, host, source, event code, message, etc.). This segmentation allows the data to maintain completeness while enabling efficient indexing and searching operations on specific fields without requiring complex full-text search on unstructured data.
Solution Approach 2:
The patent introduces an intermediary processing layer that transforms unstructured data into a semi-structured event format. This intermediary representation preserves the original data content while adding structured metadata and fields that facilitate efficient querying, indexing, and analysis without losing information.
2Loss of information
If search results are provided in large volume, then completeness of information is improved, but user interpretation becomes difficult
Solution Approach 1:
The patent segments search results into organized event tables with distinct columns for different attributes (time, host, source, event code, message). This segmentation allows users to quickly scan and interpret specific aspects of the data without being overwhelmed by the full volume of unstructured information.
Solution Approach 2:
The patent applies local quality by providing different levels of data detail and organization in different parts of the interface. Summary statistics and aggregated views provide high-level insights, while detailed event tables provide granular information, allowing users to interpret data at the appropriate level of detail for their needs.
3Quantity of substance
If data processing is performed to reduce data size, then storage efficiency is improved, but data availability for future use is reduced
Solution Approach 1:
The patent extracts only the essential and most frequently queried fields from the original data (timestamp, host, source, event code, message) and structures them for efficient storage and retrieval. This extraction reduces data size for common operations while preserving the ability to access and analyze the extracted fields without requiring the full original data structure.
Data Source
AI summary
A search interface is displayed in a table format that includes one or more columns, each column including data items of an event attribute, the data items being of a set of events, and a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column. Based on a user selecting a portion of the textual representation in a corresponding cell, a list of options is displayed that corresponds to the selected portion of the textual representation. Furthermore, one or more commands are added to a search query that corresponds to the set of events, the one or more commands being based on at least an option that is selected from the list of options and the selected portion of the textual representation in the corresponding cell.