Abstract: Systems and methods are described for generating metrics from real-time streaming log data. In order to generate the metrics, a metricization rule associated with the log data can be obtained. For example, the metricization rule may be obtained from a user. The metricization rule may include one or more field-value pairs that define how the metrics are generated from the log data. Preview metric data can be generated by applying the metricization rule to the log data. For example, the preview metric data may be displayed via a user interface. Further, the metricization rule can be accepted or approved by the user. Further, the additional log data can be ingested and based on determining that the metricization rule has been accepted, metric data may be generated by applying the metricization rule to the additional log data.

Abstract: Systems and methods are described for providing a user interface for display of metric data. A plurality of graphical controls can be displayed in the user interface to modify the generation of the metric data. For example, a first graphical control may enable a user to specify a processing criterion and a second graphical control may enable a user to specify an aggregation criterion and a grouping criterion. Based on the aggregation criterion, aggregated data can be generated from data processed using the processing criterion. The grouping criterion can be used to extract metric data from the aggregated data and a preview of the metric data can be displayed in the user interface.

Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: An improved data intake and query system that can perform and display ingest-time and search-time field extraction, redaction, copy, and/or categorization is described herein. As described herein, ingest-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by a log observer system of the data intake and query system on raw machine data as the raw machine data is ingested or received from a publisher. As described herein, search-time field extraction, redaction, copy, and/or categorization may refer to field or field value extraction, redaction, copy, and/or categorization that is performed by the log observer system and/or other components of the improved data intake and query system on historical raw machine data that has already been ingested and indexed by the improved data intake and query system.

Abstract: A data stream processing system can receive a stream of data and display a portion of the stream to a user. The displayed streaming data can change over time as additional data is received as part of the stream. The data stream processing system can extract one or more field values rom data in the stream and generate filters based on the extracted information. The generated filters can be displayed to a user, and in response to an interaction with a generated filter, the data stream processing system can apply the selected filter to data in the data stream.