US 11,836,148 B1
Data source correlation user interface
Paul Boster, San Francisco, CA (US); Keith Kramer, San Francisco, CA (US); Cary Noel, San Francisco, CA (US); and Isabelle Park, San Mateo, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Apr. 30, 2021, as Appl. No. 17/246,452.
Application 17/246,452 is a continuation of application No. 16/264,562, filed on Jan. 31, 2019, granted, now 10,997,192.
Int. Cl. G06F 16/248 (2019.01); G06F 16/25 (2019.01); G06F 3/04842 (2022.01)
CPC G06F 16/248 (2019.01) [G06F 16/252 (2019.01); G06F 3/04842 (2013.01)] 21 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
determining a first field from a first plurality of fields associated with a first set of records, each record of the first set of records having one or more fields from the first plurality of fields, wherein the first set of records are associated with a first data source;
determining a second field from a second plurality of fields associated with a second set of records, each record of the second set of records having one or more fields from the second plurality of fields, where the second set of records are associated with a second data source that is different from the first data source;
identifying a first record from the first set of records that includes a first value for the first field;
identifying a second record from the second set of records that includes a second value for the second field;
determining, by a computing system and independent of user input specifying that the first value corresponds to the second value, whether the first value corresponds to the second value;
computing, using a result of determining whether the first value corresponds to-the second value, a number of records from the first set of records that can be correlated with one or more records from the second set of records; and
generating a display indicating, based in part on the result of determining whether the first value corresponds to the second value, a potential correlation between the first field of the first set of records and the second field of the second set of records, the display including the first field, the second field, the first value, and the second value, wherein the display associates the first value with the first field and the second value with the second field, wherein the display further includes an input enabling a user to verify that the first field of the first set of records and the second field of the second set of records are correlated, and wherein the display further includes an indication of the number of records from the first set of records that can be correlated with one or more records from the second set of records;
obtaining the input from the user verifying that the first field of the first set of records and the second field of the second set of records are correlated; and
processing a query associated with the first and second sets of records according to the verified correlation.