Abstract: Systems and methods are described for generating metrics from real-time streaming log data. In order to generate the metrics, a metricization rule associated with the log data can be obtained. For example, the metricization rule may be obtained from a user. The metricization rule may include one or more field-value pairs that define how the metrics are generated from the log data. Preview metric data can be generated by applying the metricization rule to the log data. For example, the preview metric data may be displayed via a user interface. Further, the metricization rule can be accepted or approved by the user. Further, the additional log data can be ingested and based on determining that the metricization rule has been accepted, metric data may be generated by applying the metricization rule to the additional log data.

Abstract: Systems and methods are described for providing a user interface for display of metric data. A plurality of graphical controls can be displayed in the user interface to modify the generation of the metric data. For example, a first graphical control may enable a user to specify a processing criterion and a second graphical control may enable a user to specify an aggregation criterion and a grouping criterion. Based on the aggregation criterion, aggregated data can be generated from data processed using the processing criterion. The grouping criterion can be used to extract metric data from the aggregated data and a preview of the metric data can be displayed in the user interface.

Abstract: Systems and methods are disclosed for assigning a global parameter to one or more queries present in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also receives a selection of a global parameter, applies the global parameter to the first and second queries, receives a modification to the global parameter for the second query, and causes execution of the first query using the global parameter and of the second query using the modification.

Abstract: Systems and methods are disclosed for allowing a user to view query results associated with a time range that is different from a time range indicated by a query. For example, a user interface (UI) data manager can receive a request for a panel of a workbook with a query that identifies the first time range. The UI data manager can obtain the panel, including the query and query results, and cause display of a panel view corresponding to the panel. The displayed query results may not correspond to the same time range as the literal time range indicated by the query. Rather, the query results may be the query results generated during an earlier time range that corresponds to the last time the query was run.

Abstract: Systems and methods are disclosed for allowing a user to perform various actions in association with a panel. For example, a user interface (UI) data manager can cause display of, as part of a panel view associated with a panel, a user interface field that includes a query and a first display object that includes query results generated as a result of execution of the query. In response to a user input, the UI data manager can further cause display of a second display object that provides the user with a list of actions that can be performed in association with the panel. If a user selects an action, the UI data manager can perform the action and cause display of results of the action in the panel view. The UI data manager can further associate the results of the action with the panel corresponding to the panel view.

Abstract: A data stream processing system can receive a stream of data and display a portion of the stream to a user. The displayed streaming data can change over time as additional data is received as part of the stream. The data stream processing system can extract one or more field values rom data in the stream and generate filters based on the extracted information. The generated filters can be displayed to a user, and in response to an interaction with a generated filter, the data stream processing system can apply the selected filter to data in the data stream.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: Systems and methods are disclosed for performing multiple queries in a single graphical user interface (GUI) displayed in a client browser. The client browser causes the display of a first user interface field in a first area of the GUI, where the first user interface field can be used to enter or edit a first query. The client browser also causes first query results generated by a data intake and query system executing the first query to be displayed in the first area. The client browser further causes the display of a second user interface field in a second area of the GUI, where the second user interface field can be used to enter or edit a second query. The client browser also causes second query results generated by the data intake and query system executing the second query to be displayed in the second area.

Abstract: Systems and methods are disclosed for allowing a user to iteratively build a query. For example, a user interface (UI) data manager can obtain a child query entered or selected by a user. The child query may be a child query to a parent query, such that execution of the child query relies on the query results of the parent query. The UI data manager can associate an identifier corresponding to the query results of the parent query with the child query, and cause a data intake and query system to execute the second query using the identifier. The UI data manager can then instruct a client browser to display the query results provided by the data intake and query system in a graphical user interface (GUI) in an area separate from an area that displays the query results of the parent query.