MULTI-LANE TIME-SYNCHED VISUALIZATIONS OF MACHINE DATA EVENTS

摘要

A visualization can include a set of swim lanes, each swim lane representing information about an event type. An event type can be specified, e.g., as those events having certain keywords and/or having specified value(s) for specified field(s). The swim lane can plot when (within a time range) events of the associated event type occurred. Specifically, each such event can be assigned to a bucket having a bucket time matching the event time. A swim lane can extend along a timeline axis in the visualization, and the buckets can be positioned at a point along the axis that represents the bucket time. Thus, the visualization may indicate whether events were clustered at a point in time. Because the visualization can include a plurality of swim lanes, the visualization can further indicate how timing of events of a first type compare to timing of events of a second type.

主权项

1. A method, comprising:
displaying a representation of a timeline; concurrently displaying along the representation of the timeline at least one graphical indicator that represents a first set of events among a plurality of sets of events, wherein the first set of events is associated with a time frame within a time period represented by the timeline, each event in the first set of events has an associated event time that occurs within the associated time frame, the at least one graphical indicator is displayed at a position along the representation of the timeline corresponding to the associated time frame, and one or more events in the first set of events includes at least one of: raw data, machine data, unstructured data, or transformed raw data; wherein the method is performed by one or more computing devices.