Patent ID: 8909656

Claim:
A computing system comprising: a network interface that is coupled to a data network for receiving and transmitting one or more packet flows; a processor; and one or more stored program instructions configured for execution by the processor in order to cause the computing system to: create and store in computer memory a first filter chain indicating one or more first membership criteria; apply the first filter chain to a data set to identify: one or more first data items that satisfy the first membership criteria; one or more second data items that do not satisfy the first membership criteria; transmit the one or more first data items and the one or more second data items to a client computer configured to display the one or more first data items in a first filter view in a first graphically demarcated area and the one or more second data items in a second filter view in a second graphically demarcated area, wherein the first filter view comprises one or more of a histogram view, a scatterplot view, a timeline view, a percentile view, a treemap view, a spectrum view, a list view, or a view comprising values plotted within an x-axis and a y-axis; receive a user selection of the first graphically demarcated area and the second graphically demarcated area; determine one or more second membership criteria; create a second filter chain based on the first filter chain and the second membership criteria; apply the second filter chain to the data set to identify: one or more third data items that satisfy the second membership criteria and do not satisfy the first membership criteria, and one or more fourth data items that do not satisfy the first membership criteria and do not satisfy the second membership criteria; transmit the one or more first data items, the one or more third data items, and the one or more fourth data items, wherein the client computer is configured to display the one or more first data items in the first graphically demarcated area and the one or more third data items and the one or more fourth data items in the second graphically demarcated area, and wherein the one or more first data items, the one or more third data items, and the one or more fourth data items comprise a same number of data items as the data set, and wherein at least some of the one or more first data items, the one or more third data items, and the one or more fourth data items are dynamically updated in response to updates to data in the data set.