Abstract: Systems and methods are described for generation of a query using a non-textual input. For example, the query can be generated using a point and click input. A selection of a data source can be identified and an initial query can be automatically generated based on the selection of the data source. A graphical user interface can be displayed and populated with one or more selectable parameters based on the initial query. A selection of the one or more selectable parameters can be received as a non-textual input and a query can be automatically generated based on the selection. For example, a query for execution by a data intake and query system can be generated based on the selection. The query can be provided to the data intake and query system. The data intake and query system may then execute the query on a set of data.

Abstract: Systems and methods are described for generation of queries for execution by a separate system. In order establish a connection with the separate system, credentials can be obtained. For example, the credentials may be based on a user identifier and/or a login identifier. Indices can be identified that correspond to the credentials and a query can be identified that includes a selection of at least one of the indices. For example, the query may identify a set of log data ingested and indexed by the separate system. A request that includes the query, the credentials, and a connection identifier can be communicated to the separate system. In response to the request, a set of data can be received from the separate system. The set of data can be provided to a computing device. For example, the set of data can be provided to a computing device providing the query.

Abstract: Systems and methods are described for generating metrics from real-time streaming log data. In order to generate the metrics, a metricization rule associated with the log data can be obtained. For example, the metricization rule may be obtained from a user. The metricization rule may include one or more field-value pairs that define how the metrics are generated from the log data. Preview metric data can be generated by applying the metricization rule to the log data. For example, the preview metric data may be displayed via a user interface. Further, the metricization rule can be accepted or approved by the user. Further, the additional log data can be ingested and based on determining that the metricization rule has been accepted, metric data may be generated by applying the metricization rule to the additional log data.

Abstract: Systems and methods are described for providing a user interface for display of metric data. A plurality of graphical controls can be displayed in the user interface to modify the generation of the metric data. For example, a first graphical control may enable a user to specify a processing criterion and a second graphical control may enable a user to specify an aggregation criterion and a grouping criterion. Based on the aggregation criterion, aggregated data can be generated from data processed using the processing criterion. The grouping criterion can be used to extract metric data from the aggregated data and a preview of the metric data can be displayed in the user interface.

Abstract: Systems and methods are disclosed for assigning a global parameter to one or more queries present in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also receives a selection of a global parameter, applies the global parameter to the first and second queries, receives a modification to the global parameter for the second query, and causes execution of the first query using the global parameter and of the second query using the modification.

Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: Systems and methods are disclosed for allowing a user to view query results associated with a time range that is different from a time range indicated by a query. For example, a user interface (UI) data manager can receive a request for a panel of a workbook with a query that identifies the first time range. The UI data manager can obtain the panel, including the query and query results, and cause display of a panel view corresponding to the panel. The displayed query results may not correspond to the same time range as the literal time range indicated by the query. Rather, the query results may be the query results generated during an earlier time range that corresponds to the last time the query was run.

Abstract: Systems and methods are disclosed for allowing a user to perform various actions in association with a panel. For example, a user interface (UI) data manager can cause display of, as part of a panel view associated with a panel, a user interface field that includes a query and a first display object that includes query results generated as a result of execution of the query. In response to a user input, the UI data manager can further cause display of a second display object that provides the user with a list of actions that can be performed in association with the panel. If a user selects an action, the UI data manager can perform the action and cause display of results of the action in the panel view. The UI data manager can further associate the results of the action with the panel corresponding to the panel view.

Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: A data stream processing system can receive a stream of data and display a portion of the stream to a user. The displayed streaming data can change over time as additional data is received as part of the stream. The data stream processing system can extract one or more field values rom data in the stream and generate filters based on the extracted information. The generated filters can be displayed to a user, and in response to an interaction with a generated filter, the data stream processing system can apply the selected filter to data in the data stream.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: Systems and methods are disclosed for allowing a user to iteratively build a query. For example, a user interface (UI) data manager can obtain a child query entered or selected by a user. The child query may be a child query to a parent query, such that execution of the child query relies on the query results of the parent query. The UI data manager can associate an identifier corresponding to the query results of the parent query with the child query, and cause a data intake and query system to execute the second query using the identifier. The UI data manager can then instruct a client browser to display the query results provided by the data intake and query system in a graphical user interface (GUI) in an area separate from an area that displays the query results of the parent query.