Patent ID: 11886502
Assignee: SPLUNK INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 14:
15. A computing system comprising:
a processor; and
computer storage memory having computer-executable instructions stored thereon which, when executed by the processor, configure the computing system to:
select a first portion of raw data from a set of raw data from at least one data source, the set of raw data including the first portion of raw data and a second portion of raw data different from the first portion of raw data;
cause display of one or more selectable parsing rules;
receive a first user input selecting a particular parsing rule among the one or more selectable parsing rules, the particular parsing rule to be applied to the first portion of raw data;
parse the selected first portion of raw data into one or more sets of parsed data using the particular parsing rule, each set of parsed data including raw data from the selected portion of raw data;
cause display, via a graphical user interface, of at least a portion of the one or more sets of parsed data of the selected first portion of raw data;
in response to receiving a second user input indicating the displayed at least the portion of the one or more sets of parsed data is satisfactory, process raw data from the selected first portion of raw data from the set of raw data using the particular parsing rule to create a first set of searchable, time-stamped events and processing additional raw data from the second portion of raw data of the set of raw data using the particular parsing rule to create a second set of searchable, time-stamped events, wherein the additional raw data from the second portion of raw data is different from the raw data from the selected first portion of raw data; and
store the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in an index store, wherein the first set of searchable, time-stamped events and the second set of searchable, time-stamped events in the index store are used to service search queries received from a search engine.