Interactive timeline displays of event data

Abstract

Techniques and mechanisms are disclosed that enable a data intake and query system to generate and cause display of circular timelines of timestamped event data. As used herein, a circular timeline generally refers to a graphical display of timestamped events stored by a data intake and query system, wherein the timestamped events may be displayed as arcs of one or more concentric circles and located in a circular timeline area according to a chronological ordering associated with the events. One or more display attributes of each arc may further depend on other data associated with the corresponding events. For example, each arc of a circular time may be displayed at a particular radial distance, with a particular thickness, using a particular shading and/or color, etc., depending on various data values associated with the one or more events represented by the arc.

1 . (canceled) 
     
     
         2 . A computer-implemented method comprising:
 causing display, on a computing device, of a first graphical user interface that comprises a portion of a circle and a plurality of graphical indications, wherein the portion of the circle represents a period of time defined by a first radial location and a second radial location, wherein each graphical indication of the plurality of graphical indications graphically depicts a start timestamp at a first location within the portion of the circle and an end timestamp at a second location within the portion of the circle, wherein the start timestamp and the end timestamp are associated with a respective event; and   in response to a selection of a subset of the portion of the circle, causing display, on the computing device, of a second graphical user interface that comprises at least one of the plurality of graphical indications.   
     
     
         3 . The computer-implemented method of  claim 2 , wherein the first radial location corresponds to a first time of the period of time and the second radial location corresponds to a second time of the period of time. 
     
     
         4 . The computer-implemented method of  claim 2 , wherein each of the plurality of graphical indications comprises a line. 
     
     
         5 . The computer-implemented method of  claim 2 , wherein each of the plurality of graphical indications comprises a circular sector of the portion of the circle. 
     
     
         6 . The computer-implemented method of  claim 2 , wherein the subset of the portion of the circle is a first subset of the portion of the circle, the method further comprising, in response to a selection of a second subset of the portion of the circle, causing display, on the computing device, of a third graphical user interface. 
     
     
         7 . The computer-implemented method of  claim 2 , wherein the subset of the portion of the circle is a first subset of the portion of the circle and the at least one of the plurality of graphical indications is a first graphical indication of the plurality of graphical indications, the method further comprising, in response to a selection of a second subset of the portion of the circle, causing display, on the computing device, of a third graphical user interface that comprises a second graphical indication of the plurality of graphical indications. 
     
     
         8 . The computer-implemented method of  claim 2 , wherein at least two of the plurality of graphical indications overlap and overlapping graphical indications are displayed with different colors. 
     
     
         9 . The computer-implemented method of  claim 2 , wherein each of the plurality of graphical indications is associated with a respective set of display attributes, and wherein each set of display attributes varies for each graphical indication is based on a corresponding data value associated with an event represented by the respective graphical indication. 
     
     
         10 . The computer-implemented method of  claim 2 , wherein each of the plurality of graphical indications is displayed within the portion of the circle at a radial distance that corresponds to a value associated with an event represented by the respective graphical indication. 
     
     
         11 . The computer-implemented method of  claim 2 , wherein the at least one of the plurality of graphical indications corresponds to one or more events, the one or more events including a value indicating a bandwidth measurement of a network request, a package size of the network request, or a geographic location, and wherein the at least one of the plurality of graphical indications has a display attribute that changes based on the value of the one or more events. 
     
     
         12 . The computer-implemented method of  claim 2 , wherein the first radial location and the second radial location are user-defined. 
     
     
         13 . The computer-implemented method of  claim 2 , wherein an event associated with a graphical indication from the plurality of graphical indications is parsed from machine data received from a data source, and the event includes a portion of the machine data. 
     
     
         14 . The computer-implemented method of  claim 2 , further comprising:
 updating the first graphical user interface based at least in part on the selection of the subset of the portion of the circle, wherein updating the first graphical user interface comprises:
 updating the first radial location; and 
 updating the second radial location. 
   
     
     
         15 . The method of  claim 2 , further comprising:
 receiving a user input for a direct visual adjustment of the first radial location to a new position;   adjusting the portion of the circle based on the direct visual adjustment;   updating the period of time based on the new position of the first radial location after the direct visual adjustment; and   updating display of the first graphical user interface based on the updated period of time after the direct visual adjustment.   
     
     
         16 . A computing device comprising:
 a processor; and   a memory having instructions executable by the processor to cause the computing device to:
 cause display, on a computing device, of a first graphical user interface that comprises a portion of a circle and a plurality of graphical indications, wherein the portion of the circle represents a period of time defined by a first radial location and a second radial location, wherein each graphical indication of the plurality of graphical indications graphically depicts a start timestamp at a first location within the portion of the circle and an end timestamp at a second location within the portion of the circle, wherein the start timestamp and the end timestamp are associated with a respective event; and 
 in response to a selection of a subset of the portion of the circle, cause display, on the computing device, of a second graphical user interface that comprises at least one of the plurality of graphical indications. 
   
     
     
         17 . The computing device of  claim 16 , wherein the first radial location corresponds to a first time of the period of time and the second radial location corresponds to a second time of the period of time. 
     
     
         18 . The computing device of  claim 16 , wherein each of the plurality of graphical indications comprises a circular sector of the portion of the circle. 
     
     
         19 . Non-transitory computer-readable media including computer-executable instructions that, when executed by a computing system, cause the computing system to:
 cause display, on a computing device, of a first graphical user interface that comprises a portion of a circle and a plurality of graphical indications, wherein the portion of the circle represents a period of time defined by a first radial location and a second radial location, wherein each graphical indication of the plurality of graphical indications graphically depicts a start timestamp at a first location within the portion of the circle and an end timestamp at a second location within the portion of the circle, wherein the start timestamp and the end timestamp are associated with a respective event; and   in response to a selection of a subset of the portion of the circle, cause display, on the computing device, of a second graphical user interface that comprises at least one of the plurality of graphical indications.   
     
     
         20 . The non-transitory computer-readable media of  claim 19 , wherein the first radial location corresponds to a first time of the period of time and the second radial location corresponds to a second time of the period of time. 
     
     
         21 . The non-transitory computer-readable media of  claim 19 , wherein each of the plurality of graphical indications comprises a circular sector of the portion of the circle.