Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: When a mobile device such as a smart phone comes within range of a location device, the mobile device inputs a location token from the location device and a travel token is created from a mobile device token and the location token. The mobile and location tokens may include data elements indicating not only identity, but also such other characteristics as an authorization or infection risk level. Tokens may be digitally signed, preferably with an independently verifiable signature that also encodes time. Mobile and location devices may be created and issued by a tracking service provider, which may also store tokens, analyze travel tokens with respect to a location's risk level, and update mobile device and location tokens to change a status of the mobile or location device.

Abstract: Systems and methods are disclosed for assigning a global parameter to one or more queries present in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also receives a selection of a global parameter, applies the global parameter to the first and second queries, receives a modification to the global parameter for the second query, and causes execution of the first query using the global parameter and of the second query using the modification.

Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: Systems and methods are disclosed for allowing a user to view query results associated with a time range that is different from a time range indicated by a query. For example, a user interface (UI) data manager can receive a request for a panel of a workbook with a query that identifies the first time range. The UI data manager can obtain the panel, including the query and query results, and cause display of a panel view corresponding to the panel. The displayed query results may not correspond to the same time range as the literal time range indicated by the query. Rather, the query results may be the query results generated during an earlier time range that corresponds to the last time the query was run.

Abstract: Systems and methods are disclosed for allowing a user to perform various actions in association with a panel. For example, a user interface (UI) data manager can cause display of, as part of a panel view associated with a panel, a user interface field that includes a query and a first display object that includes query results generated as a result of execution of the query. In response to a user input, the UI data manager can further cause display of a second display object that provides the user with a list of actions that can be performed in association with the panel. If a user selects an action, the UI data manager can perform the action and cause display of results of the action in the panel view. The UI data manager can further associate the results of the action with the panel corresponding to the panel view.

Abstract: A search and data analysis collaboration system is described. The search and data analysis collaboration system enables users to search for and process stored data, and further includes a home page component that can help guide users embarking on data analyses; a discovery component that enables users to discover what data is available for search and analysis; a search component that enables users to efficiently search accessible data and to iterate on search queries and corresponding results; a workbooks component that enables users to create aggregated collections of data analysis artifacts; and an actions component that enables users to configure various actions to be performed in response to analyses.

Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: When a mobile device such as a smart phone comes within range of a location device, the mobile device inputs a location token from the location device and a travel token is created from a mobile device token and the location token. The mobile and location tokens may include data elements indicating not only identity, but also such other characteristics as an authorization or infection risk level. Tokens may be digitally signed, preferably with an independently verifiable signature that also encodes time. Mobile and location devices may be created and issued by a tracking service provider, which may also store tokens, analyze travel tokens with respect to a location's risk level, and update mobile device and location tokens to change a status of the mobile or location device.

Abstract: A data stream processing system can receive a stream of data and display a portion of the stream to a user. The displayed streaming data can change over time as additional data is received as part of the stream. The data stream processing system can extract one or more field values rom data in the stream and generate filters based on the extracted information. The generated filters can be displayed to a user, and in response to an interaction with a generated filter, the data stream processing system can apply the selected filter to data in the data stream.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: A method for auditably tracking data objects is proposed.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: Systems and methods are disclosed for allowing a user to iteratively build a query. For example, a user interface (UI) data manager can obtain a child query entered or selected by a user. The child query may be a child query to a parent query, such that execution of the child query relies on the query results of the parent query. The UI data manager can associate an identifier corresponding to the query results of the parent query with the child query, and cause a data intake and query system to execute the second query using the identifier. The UI data manager can then instruct a client browser to display the query results provided by the data intake and query system in a graphical user interface (GUI) in an area separate from an area that displays the query results of the parent query.

Abstract: An event is registered in at least one node server in a directed data structure, which comprises a computationally linked series of nodes such that each node encodes information included in at least one preceding node. Within at least selected nodes of the directed data structure after at least one initial node, a representation of at least one history data structure is included and has a highest-level value computed based on inputs of lowest level input values, at least one said lowest level input value encoding node-specific information of at least one preceding node. In a verification phase, a purportedly valid lowest level input value is verified by recomputing the corresponding highest-level value from the representation of the history data structure included in the corresponding node.

Abstract: Parties communicate input values to a central entity by first decomposing them according to a chosen operation into share values, which are sent either directly or, in a transformed form such as being hashed and/or encrypted, via a bulletin board data structure, to respective nodes, such that no node receives the input value itself. The nodes then combine the share values using the operation and pass these respective node values to the central entity for computation of a global value. The operation of the parties and of the nodes may be made verifiable by aggregating the share values within a party or the received share values within a node using a data and computational structure such as a hash tree or skip list. Digital signing and timestamping may also be applied.

Abstract: Multi-party consent to performance of an action is securely registered by receiving from at least one consent requesting entity (CRE) a consent action request (CAR), which is matched with a consent policy. The policy may specify a plurality of consent voting entities (CVE), and direct confirmation of registration of an identity of each CVE in a blockchain. A consent request (CR) may then be issued to the CVEs. Consent request responses (CRRs) from the CVEs are then compared with at least one condition in the consent policy. A representation of a state of the CRRs is relative to the consent policy is registered in the blockchain. If the policy condition(s) is satisfied, a subject entity may be signaled to perform the action corresponding to the CAR, and a state indication of performance of the action may also be registered in the blockchain.

Abstract: Initial data is included in a data structure such as an initial container at an initial entity, along with rules and a data signature of at least a portion of the initial data and other container contents relating to the initial entity and the initial data. Each rule defines at least one condition governing the permissible transfer and processing of the initial data by other entities in a provenance chain. Each receiving entity creates a container of its own to encapsulate received containers, and, after optional processing of its own, such as adding or altering data and rules, digital signature for its container. The digital signatures may be obtained from a hash tree-based signing infrastructure that returns data signatures enabling recomputation of a logically uppermost value of the hash tree. A lineage map of any given container may also be displayed for analysis by a user.

Abstract: Data packets passing from a source to a destination in a network according to a Service Function Chain (SFC) are processed by an ordered sequence of at least one service function (SF). For each SF in the SFC in order, a current value of a function, such as a hash function, is recursively computed including, as input values, at least current identifying data that identifies a corresponding current one of the SFs, and a value of the function output from an immediately preceding SF. After computing the current value of the function for a selected SF in the SFC, the current value of the function is compared with an expected value. If the value of the function for the selected SF is the same as the expected value, the data packet is allowed to be transmitted to a subsequent processing stage; if not, then an error response action is taken.