Parallel Display of Multiple Graphical Indicators Representing Differing Search Criteria Evaluated Across a Plurality of Events

摘要

A visualization can include a set of swim lanes, each swim lane representing information about an event type. An event type can be specified, e.g., as those events having certain keywords and/or having specified value(s) for specified field(s). The swim lane can plot when (within a time range) events of the associated event type occurred. Specifically, each such event can be assigned to a bucket having a bucket time matching the event time. A swim lane can extend along a timeline axis in the visualization, and the buckets can be positioned at a point along the axis that represents the bucket time. Thus, the visualization may indicate whether events were clustered at a point in time. Because the visualization can include a plurality of swim lanes, the visualization can further indicate how timing of events of a first type compare to timing of events of a second type.

主权项

1. A method, comprising:
causing display of a representation of a timeline; concurrently causing display along the representation of the timeline of at least one graphical indicator that represents a first set of events among a plurality of events, wherein the first set of events is associated with a time frame within a time period represented by the timeline, each event in the first set of events has an associated event time that occurs within the associated time frame, the at least one graphical indicator is displayed at a position along the representation of the timeline corresponding to the associated time frame; causing display of a second at least one graphical indicator that represents a second set of events among the plurality of events, the second at least one graphical indicator displayed in a display area that is parallel with a display area in which the at least one graphical indicator is displayed; wherein the first set of events was generated by a first search query executed against the plurality of events and the second set of events was generated by a second search query executed against the plurality of events, search criteria in the first search query differing from search criteria in the second search query; wherein the method is performed by one or more computing devices.