GENERATION OF A DATA MODEL APPLIED TO QUERIES

摘要

Embodiments include generating data models that may give semantic meaning for unstructured or structured data that may include data generated and/or received by search engines, including a time series engine. A method includes generating a data model for data stored in a repository. Generating the data model includes generating an initial query string, executing the initial query string on the data, generating an initial result set based on the initial query string being executed on the data, determining one or more candidate fields from one or results of the initial result set, generating a candidate data model based on the one or more candidate fields, iteratively modifying the candidate data model until the candidate data model models the data, and using the candidate data model as the data model.

主权项

1. A method of accessing data, including:
accessing a data model structure, the data model structure comprising:
a set of time stamped events in a data store on a computing device, each event including a portion of unstructured data;a model schema that references fields that can be extracted, by an extraction rule or regular expression, from the unstructured data in the time stamped events without modifying the unstructured data; andone or more submodels; each of the submodels comprising:
a subset of the set of time stamped events that is smaller than the set;a submodel schema that inherits one or more fields referenced in the model schema; andthe submodel schema further references additional fields that can be extracted, by an extraction rule or regular expression, from the unstructured data in the time stamped events without modifying the unstructured data; receiving electronically a data request comprising reference to a submodel selected from the data model structure and a query to be performed against the subset referenced by the selected submodel; and identifying responsive events, including extracting values from at least some of the events in the subset at query time using the extraction rule or regular expression in the submodel schema without modifying the unstructured event and matching the extracted values to the query; returning at least some values from or derived from the fields in the responsive events referenced by the submodel schema.