Abstract: Disclosed is a technique for generating a visualization module for use within a framework for generating for display an interactive visualization of event data based on a static visualization library. In an embodiment, a computer system receives from a developer instructions for formatting event data for use with a visualization library, and rendering the formatted event data with the visualization library. The computer system then generates a visualization module including the received instructions, the visualization module being executable by another computer system to generate and cause display of an interactive visualization of received event data, the interactive visualization being dynamically modifiable in response to a user input.

Abstract: A modular visualization framework registers definitions for a variety of visualization types. The definitions are tagged with visualization characteristics. During a working session, likely interactive, a user identifies a search query used to produce data to be visualized. The working context, including the search query and data produced by its execution, is tagged for its visualization characteristics. Information about the working context, including its visualization characteristics, is then used to produce a customized list of candidates suited for the working context from which the user may select a visualization type.

Abstract: Disclosed are a system and a method for providing user-interactive flow diagrams such as Sankey diagrams. In an embodiment, a machine data search and analysis system retrieves search results including a plurality of events in response to a search query, each of the events containing time-stamped data. The system identifies a plurality of nodes based on the time-stamped data of the events. Each of the events is indicative of a relationship between a starting node and an ending node. The system further causes display of an interactive flow diagram that includes the nodes and a plurality of flows. Each of the flows represents events that share a common relationship between a starting node and an ending node and visually connecting the starting node and the ending node.

Abstract: Disclosed is a framework for generating for display an interactive visualization of event data based on a static visualization library. In an embodiment, event data is received based on a user search query. A computer system implementing a visualization framework accesses a visualization library that includes instructions for rendering a static visualization based on input data. The computer system then processes the received event data with the visualization library to generate an interactive visualization of the received event data and causes display of the interactive visualization, the interactive visualization being dynamically modifiable in response to a user input.

Abstract: Disclosed are a system and a method for providing user-interactive parallel coordinates charts. In an embodiment, a machine data search and analysis system retrieves search results including a plurality of events, each of the events containing time-stamped data in response to a search query. The system identifies a plurality of characteristics from the data corresponding to the events. The system causes display of a multiple-dimensional chart (e.g., a parallel coordinates chart) depicting the data corresponding to the events. The multiple-dimensional chart includes a plurality of axes. Each of the axes corresponds to one of the identified characteristics. The multiple-dimensional chart further includes a plurality of poly lines representing the events. Each of the poly lines includes a plurality of vertices on the axes.

Abstract: Disclosed are a system and a method for providing user-interactive diagrams. In an embodiment, a machine data search and analysis system retrieving search results including a plurality, of events, in response to a search query. The system identifies a first characteristic type from data of the plurality of events as a horizontal dimension of a multidimensional chart, and a second characteristic type from the retrieved data as a vertical dimension of the multi-dimensional chart. The system causes display of the multi-dimensional chart indicative of the data of the plurality of events. The multi-dimensional chart includes a table of a plurality of objects. Each object of the plurality of objects represents one or more events that share a common value of the first characteristic type and share a common value of the second characteristic type.

Abstract: Disclosed are a system and a method for providing user-interactive parallel coordinates charts. In an embodiment, a machine data search and analysis system retrieves search results including a plurality of events, each of the events containing time-stamped data in response to a search query. The system identifies a plurality of characteristics from the data corresponding to the events. The system causes display of a multiple-dimensional chart (e.g., a parallel coordinates chart) depicting the data corresponding to the events. The multiple-dimensional chart includes a plurality of axes. Each of the axes corresponds to one of the identified characteristics. The multiple-dimensional chart further includes a plurality of poly lines representing the events. Each of the poly lines includes a plurality of vertices on the axes.

Abstract: Disclosed are a system and a method for providing user-interactive diagrams. In an embodiment, a machine data search and analysis system retrieving search results including a plurality of events, in response to a search query. The system identifies a first characteristic type from data of the plurality of events as a horizontal dimension of a multidimensional chart, and a second characteristic type from the retrieved data as a vertical dimension of the multi-dimensional chart. The system causes display of the multi-dimensional chart indicative of the data of the plurality of events. The multi-dimensional chart includes a table of a plurality of objects. Each object of the plurality of objects represents one or more events that share a common value of the first characteristic type and share a common value of the second characteristic type.

Abstract: Disclosed are a system and a method for providing user-interactive parallel coordinates charts. In an embodiment, a machine data search and analysis system retrieves search results including a plurality of events, each of the events containing time-stamped data in response to a search query. The system identifies a plurality of characteristics from the data corresponding to the events. The system causes display of a multiple-dimensional chart (e.g., a parallel coordinates chart) depicting the data corresponding to the events. The multiple-dimensional chart includes a plurality of axes. Each of the axes corresponds to one of the identified characteristics. The multiple-dimensional chart further includes a plurality of polylines representing the events. Each of the polylines includes a plurality of vertices on the axes.

Abstract: Disclosed are a system and a method for providing user-interactive flow diagrams such as Sankey diagrams. In an embodiment, a machine data search and analysis system retrieving search results including a plurality of events, in response to a search query. The system identifies a first characteristic type from data of the plurality of events as a horizontal dimension of a multi-dimensional chart, and a second characteristic type from the retrieved data as a vertical dimension of the multi-dimensional chart. The system causes display of the multi-dimensional chart indicative of the data of the plurality of events. The multi-dimensional chart includes a table of a plurality of objects. Each object of the plurality of objects represents one or more events that share a common value of the first characteristic type and share a common value of the second characteristic type.

Abstract: A modular visualization framework registers definitions for a variety of visualization types. The definitions are tagged with visualization characteristics. During a working session, likely interactive, a user identifies a search query used to produce data to be visualized. The working context, including the search query and data produced by its execution, is tagged for its visualization characteristics. Information about the working context, including its visualization characteristics, is then used to produce a customized list of candidates suited for the working context from which the user may select a visualization type.