US 11,907,244 B2
Modifying field definitions to include post-processing instructions
Michael Kinsely, San Francisco, CA (US); Alex Raitz, San Francisco, CA (US); John Robert Coates, San Francisco, CA (US); and Shirley Wu, San Francisco, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by SPLUNK INC., San Francisco, CA (US)
Filed on Jun. 29, 2022, as Appl. No. 17/809,837.
Application 17/809,837 is a continuation of application No. 15/885,809, filed on Jan. 31, 2018, granted, now 11,392,604.
Application 15/885,809 is a continuation of application No. 14/266,797, filed on Apr. 30, 2014, granted, now 9,922,102, issued on Mar. 20, 2018.
Claims priority of provisional application 61/934,446, filed on Jan. 31, 2014.
Claims priority of provisional application 61/860,761, filed on Jul. 31, 2013.
Prior Publication US 2022/0327137 A1, Oct. 13, 2022
Int. Cl. G06F 16/00 (2019.01); G06F 7/00 (2006.01); G06F 16/25 (2019.01)
CPC G06F 16/254 (2019.01) 20 Claims
OG exemplary drawing
 
1. A method comprising:
causing a user interface to be displayed that displays a list of a plurality of templates, each template of the plurality of templates including a set of rules for parsing fields from log files, each of the log files including raw data corresponding to a data item of a set of data items;
receiving a selection of a particular template from the list of the plurality of templates;
identifying at least one sample data item;
causing display of a preview of a set of field values with associated field names, the preview graphically depicting a segmentation of the set of field values with the associated field names, the set of field values and the associated field names parsed from the at least one sample data item using index positions and delimiters corresponding to respective associated field names included in a respective set of rules of the particular template;
causing display of a post-processing control;
receiving an input, via the post-processing control, to define a post-processing instruction in association with a particular field corresponding with a field value of the set of field values;
based on receiving the input, updating the particular template to create an updated rule from among the respective set of rules that is associated with the particular field corresponding with the field value, the updated rule including the post-processing instruction.