Splunk Inc.
Dynamic search guidance for machine data indexing and search system

Abstract:

Disclosed is a guidance technique that can be applied to guide search and analysis of stored data by a user. The technique can include inputting from a user a portion of a search query expressed in a pipelined search language, at a system for indexing and searching machine data. The system generates and outputs search guidance for the user as the user builds the search query, by applying the portion of the query to an operation flow model, where the operation flow model represents a plurality of searches performable by the system. The operation flow model has been generated based on multi-user historical search data and includes a plurality of states, each representing a different group of related commands of the pipelined search language.