Event View Selector

Abstract

An event view selector for a search user interface is described. In one or more implementations, a service may operate to collect and store data as events and apply a late binding schema to extract events that match the search criteria and provide search results for display via the search user interface. The search user interface exposes an event view selector operable to enable transitions between multiple different views of the events associated with different levels of detail. The views may include at least a raw view, a list view, and a table view. Responsive to receiving an indication of a view selected via the event view selector, the selected view may be exposed via the search user interface.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 causing display, in a user interface, of an event view selector enabling a user to select from among two or more display formats for displaying a plurality of events retrieved by a search of events, each event associated with a time stamp and including a portion of raw machine data, the two or more display formats including a table view that displays for each event in the plurality of events a value for each field in a set of fields, each event's value for a field extracted using an extraction rule from the portion of raw machine data included in that event;   receiving through the event view selector a selection of one of the display formats; and   causing display, in the user interface, of the plurality of the events in the selected display format.   
     
     
         2 . A method as described in  claim 1 , wherein the two or more display formats include a raw view configured to represent the portions of the raw machine data for events in a raw format. 
     
     
         3 . A method as described in  claim 1 , wherein the two or more display formats include a list view configured to represent the portion of raw machine data for events in a list in conjunction with the values for each field that are extracted. 
     
     
         4 . A method as described in  claim 1 , wherein the table view is configured to represent values for different fields in different columns and different events in different rows. 
     
     
         5 . A method as described in  claim 1 , wherein the table view is configured to display the values that are extracted for each field in the set of fields without concurrent display of the portions of raw machine data for the events. 
     
     
         6 . A method as described in  claim 1 , wherein the table view includes a docking header that displays field headers for each column of the table view, the docking header configured to dock such that the field headers remain visible as different groups of events are accessed via the table view. 
     
     
         7 . A method as described in  claim 1 , wherein one or more of the fields in the set of fields is selected via an event limited field picker available via the user interface. 
     
     
         8 . A method as described in  claim 1 , wherein one or more of the fields in the set of fields is selected by a user via interaction with fields listed in a side bar of the user interface. 
     
     
         9 . A method as described in  claim 1 , wherein one or more of the fields in the set of fields is selected by a user via interaction with an all fields option accessible via a search user interface to access a representation of all fields associated with the plurality of events obtained from the search of events. 
     
     
         10 . A method as described in  claim 1 , wherein one or more of the fields in the set of fields is preconfigured for inclusion in the set of fields. 
     
     
         11 . A method as described in  claim 1 , further comprising causing display of the plurality of the events in a first display format of the two or more display formats responsive to the search of events, wherein causing the display of the plurality of the events in the selected display format comprises causing a transition from the first display format to the selected display format. 
     
     
         12 . A method as described in  claim 1 , wherein causing the display of the plurality of the events in the selected display format comprises causing display of the plurality of the events in the selected display format responsive to interaction with the event view selector without presenting the plurality of the events in a different view prior to the interaction with the event view selector. 
     
     
         13 . A method as described in  claim 1 , wherein the search of events includes applying a late binding schema that specifies the extraction rules at search time to extract the values for fields from the plurality of events. 
     
     
         14 . A method as described in  claim 1 , wherein the raw machine data includes one or more of: unstructured data, log data, packet data, wire data, network data, performance measurements, or time-series data. 
     
     
         15 . A method as described in  claim 1 , wherein the event view selector comprises a list box element configured to provide a list of the multiple different display formats as selectable items and initiate display of the selected display format responsive to a selection of one of the selectable items from the list. 
     
     
         16 . One or more computer-readable storage media comprising instructions that are stored thereon that, responsive to execution by a computing device, cause the computing device to perform operations comprising:
 causing display, in a user interface, of an event view selector enabling a user to select from among two or more display formats for displaying a plurality of events retrieved by a search of events, each event associated with a time stamp and including a portion of raw machine data, the two or more display formats including a table view that displays for each event in the plurality of events a value for each field in a set of fields, each event's value for a field extracted using an extraction rule from the portion of raw machine data included in that event;
 receiving through the event view selector a selection of one of the display formats; and 
 causing display, in the user interface, of the plurality of the events in the selected display format. 
   
     
     
         17 . One or more computer-readable storage media as described in  claim 16 , wherein the table view is configured to represent values for different fields in different columns and different events in different rows. 
     
     
         18 . One or more computer-readable storage media as described in  claim 16 , wherein the table view is configured to display the values that are extracted for each field in the set of fields without concurrently display of the portions of raw machine data for the events. 
     
     
         19 . One or more computer-readable storage media as described in  claim 16 , wherein one or more of the fields in the set of fields is selected via an event limited field picker available via the user interface. 
     
     
         20 . One or more computer-readable storage media as described in  claim 16 , wherein one or more of the fields in the set of fields is preconfigured for inclusion in the set of fields. 
     
     
         21 . One or more computer-readable storage media as described in  claim 16 , wherein the instructions further cause the computing device to perform operations comprising:
 causing display of the plurality of the events in a first display format of the two or more display formats responsive to the search of events, wherein causing the display of the plurality of the events in the selected display format comprises causing a transition from the first display format to the selected display format.   
     
     
         22 . One or more computer-readable storage media as described in  claim 16 , wherein causing the display of the plurality of the events in the selected display format comprises causing display of the plurality of the events in the selected display format responsive to interaction with the event view selector without presenting the plurality of the events in a different view prior to the interaction with the event view selector. 
     
     
         23 . A system comprising:
 a processing system;   one or more computer-readable media storing instructions that when executed via the processing system, cause the system to perform operations including:
 causing display, in a user interface, of an event view selector enabling a user to select from among two or more display formats for displaying a plurality of events retrieved by a search of events, each event associated with a time stamp and including a portion of raw machine data, the two or more display formats including a table view that displays for each event in the plurality of events a value for each field in a set of fields, each event's value for a field extracted using an extraction rule from the portion of raw machine data included in that event;
 receiving through the event view selector a selection of one of the display formats; and 
 causing display, in the user interface, of the plurality of the events in the selected display format. 
 
   
     
     
         24 . A system as described in  claim 23 , wherein the two or more display formats include the table view and at least one of:
 a raw view configured to represent the portions of the raw machine data for events in a raw format; or   a list view configured to represent the portion of raw machine data for events in a list in conjunction with the values for each field that are extracted.   
     
     
         25 . A system as described in  claim 23 , wherein the table view is configured to represent values for different fields in different columns and different events in different rows. 
     
     
         26 . A system as described in  claim 23 , wherein the table view is configured to display the values that are extracted for each field in the set of fields without concurrent display of the portions of raw machine data for the events. 
     
     
         27 . A system as described in  claim 23 , wherein one or more of the fields in the set of fields is preconfigured for inclusion in the set of fields. 
     
     
         28 . A system as described in  claim 23 , wherein one or more of the fields in the set of fields is selected by a user via interaction with user instrumentalities accessible via the user interface to enable selection of fields. 
     
     
         29 . A system as described in  claim 23 , wherein the event view selector is configured to incorporate one or more of a list box element, a radio control, a slider control, a menu, icons representing the multiple different views, links, check boxes, tabs, or buttons configured to enable selections between the multiple different views. 
     
     
         30 . A system as described in  claim 23 , wherein the instructions further cause the system to perform operations comprising:
 causing display of the plurality of the events in a first display format of the two or more display formats responsive to the search of events, wherein causing the display of the plurality of the events in the selected display format comprises causing a transition from the first display format to the selected display format.