	US 11,860,881 B1
	Tracking event records across multiple search sessions
Steve Yu Zhang, San Francisco, CA (US); and Stephen Phillip Sorkin, San Francisco, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by SPLUNK Inc., San Francisco, CA (US)
Filed on Nov. 15, 2021, as Appl. No. 17/526,606.
Application 17/526,606 is a continuation of application No. 16/396,569, filed on Apr. 26, 2019, granted, now 11,176,146.
Application 16/396,569 is a continuation of application No. 16/041,550, filed on Jul. 20, 2018, granted, now 10,339,149, issued on Jul. 2, 2019.
Application 16/041,550 is a continuation of application No. 15/224,657, filed on Jul. 31, 2016, granted, now 10,061,821, issued on Aug. 28, 2018.
Application 15/224,657 is a continuation of application No. 14/815,978, filed on Aug. 1, 2015, granted, now 9,430,574, issued on Aug. 30, 2016.
Application 14/815,978 is a continuation of application No. 14/530,680, filed on Oct. 31, 2014, granted, now 9,129,028, issued on Sep. 8, 2015.
Application 14/530,680 is a continuation of application No. 14/158,421, filed on Jan. 17, 2014, granted, now 8,990,245, issued on Mar. 24, 2015.
Application 14/158,421 is a continuation of application No. 13/660,845, filed on Oct. 25, 2012, granted, now 8,751,529, issued on Jun. 10, 2014.
Application 13/660,845 is a continuation of application No. 13/223,167, filed on Aug. 31, 2011, abandoned.
Claims priority of provisional application 61/452,591, filed on Mar. 14, 2011.
Int. Cl. G06F 16/00 (2019.01); G06F 16/2457 (2019.01); G06F 16/22 (2019.01); G06F 16/24 (2019.01); G06F 16/182 (2019.01); G06F 16/248 (2019.01); G06F 16/33 (2019.01); G06F 16/951 (2019.01); G06F 16/23 (2019.01); G06F 16/2455 (2019.01); G06F 16/2458 (2019.01); G06F 16/9038 (2019.01); G06F 16/9535 (2019.01); G06F 16/9032 (2019.01); H04L 41/0604 (2022.01); H04L 41/22 (2022.01); H04L 67/1097 (2022.01)

CPC G06F 16/24578 (2019.01) [G06F 16/182 (2019.01); G06F 16/22 (2019.01); G06F 16/2322 (2019.01); G06F 16/24 (2019.01); G06F 16/248 (2019.01); G06F 16/2455 (2019.01); G06F 16/2471 (2019.01); G06F 16/2477 (2019.01); G06F 16/24553 (2019.01); G06F 16/24554 (2019.01); G06F 16/24575 (2019.01); G06F 16/334 (2019.01); G06F 16/9038 (2019.01); G06F 16/90328 (2019.01); G06F 16/951 (2019.01); G06F 16/9535 (2019.01); H04L 41/0604 (2013.01); H04L 41/22 (2013.01); H04L 67/1097 (2013.01)]

16 Claims

1. A computer-implemented method, comprising:

receiving, at a first computing device, a search query to be performed on a set of event records accessible by the first computing device;

searching, by the first computing device, the set of event records using the search query;

determining a set of event identifiers associated with respective event records of the set of event records accessible by the first computing device, wherein the respective event records satisfied the search query, wherein each event record comprises a portion of raw data related to an operation or activity in an information technology environment, and wherein each event identifier uniquely identifies a corresponding event record and enables subsequently locating the corresponding event record accessible by the first computing device without searching the set of event records;

outputting the set of event identifiers and corresponding computing device identifier onto a network, the computing device identifier identifying the first computing device for accessing the set of event records;

in response to a request to view underlying raw data associated with a particular event identifier of the set of event identifiers, receiving, at the first computing device in accordance with the corresponding computing device identifier, the particular event identifier;

obtaining, from the set of event records, a particular event record associated with the particular event identifier, the particular event record comprising a first portion of raw data related to an operation or activity in the information technology environment; and

outputting the first portion of raw data from the particular event record onto the network.