Abstract: Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be easily and rapidly modified by modification to the first component, without requiring modification to the second component. The first component may be implemented locally at a client device, while the second component is implemented remotely. While modification of the second component may require privileges of a remote location, a user of a client device may modify the first component while maintaining interoperability and compatibility with the second component, thereby enabling the end user to modify functionality of the multi-component application. In some instances, different versions of a first component are provided, and an end user of a client device is enabled to specify which version of the first component should be used.

Abstract: Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

Abstract: Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

Abstract: Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be easily and rapidly modified by modification to the first component, without requiring modification to the second component. The first component may be implemented locally at a client device, while the second component is implemented remotely. While modification of the second component may require privileges of a remote location, a user of a client device may modify the first component while maintaining interoperability and compatibility with the second component, thereby enabling the end user to modify functionality of the multi-component application. In some instances, different versions of a first component are provided, and an end user of a client device is enabled to specify which version of the first component should be used.

Abstract: Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be modified by modification of the first component, potentially without requiring modification of the second component. However, some functionalities added to application may require modifications to both the first and second component. To maintain compatibility between components, the first component can be configured to detect versioning information of a second component, and adjust its functionality to disable functions unavailable due to lack of compatibility with a current version of the second component. The first component can notify an end user of any such lack of compatibility, and potentially instruct the end user in updating the second component.

Abstract: Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

Abstract: Disclosed is a technique for generating a visualization module for use within a framework for generating for display an interactive visualization of event data based on a static visualization library. In an embodiment, a computer system receives from a developer instructions for formatting event data for use with a visualization library, and rendering the formatted event data with the visualization library. The computer system then generates a visualization module including the received instructions, the visualization module being executable by another computer system to generate and cause display of an interactive visualization of received event data, the interactive visualization being dynamically modifiable in response to a user input.

Abstract: A modular visualization framework registers definitions for a variety of visualization types. The definitions are tagged with visualization characteristics. During a working session, likely interactive, a user identifies a search query used to produce data to be visualized. The working context, including the search query and data produced by its execution, is tagged for its visualization characteristics. Information about the working context, including its visualization characteristics, is then used to produce a customized list of candidates suited for the working context from which the user may select a visualization type.

Abstract: Disclosed is a framework for generating for display an interactive visualization of event data based on a static visualization library. In an embodiment, event data is received based on a user search query. A computer system implementing a visualization framework accesses a visualization library that includes instructions for rendering a static visualization based on input data. The computer system then processes the received event data with the visualization library to generate an interactive visualization of the received event data and causes display of the interactive visualization, the interactive visualization being dynamically modifiable in response to a user input.

Abstract: Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be easily and rapidly modified by modification to the first component, without requiring modification to the second component. The first component may be implemented locally at a client device, while the second component is implemented remotely. While modification of the second component may require privileges of a remote location, a user of a client device may modify the first component while maintaining interoperability and compatibility with the second component, thereby enabling the end user to modify functionality of the multi-component application. In some instances, different versions of a first component are provided, and an end user of a client device is enabled to specify which version of the first component should be used.

Abstract: Systems and methods are disclosed for providing a multi-component application, including a first and second component. A client device may be provisioned with the application in a manner that, from the point of view of an end user, is similar to access a single component application. A user may use a client device to attempt to access a second component to provide the application. The second component can instruct the client device to first obtain a first component from a different network location. The client device can obtain the first component and execute the first component to use the second component, thereby providing the multi-component application. Other than submission of an initial request to access the application, provisioning of the multi-component application may be programmatic and potentially invisible to an end user, thereby providing an experience similar to accessing a single component application.

Abstract: A modular visualization framework registers definitions for a variety of visualization types. The definitions are tagged with visualization characteristics. During a working session, likely interactive, a user identifies a search query used to produce data to be visualized. The working context, including the search query and data produced by its execution, is tagged for its visualization characteristics. Information about the working context, including its visualization characteristics, is then used to produce a customized list of candidates suited for the working context from which the user may select a visualization type.