Splunk Inc.
GRAPHICAL USER INTERFACE FOR PARSING EVENTS USING A DESIGNATED FIELD DELIMITER

Abstract:

A graphical user interface allows a customer to specify delimiters and/or patterns that occur in event data and indicate the presence of a particular field. The graphical user interface applies a customer's delimiter specifications directly to event data and displays the resulting event data in real time. Delimiter specifications may be saved as configuration settings and systems in a distributed setting may use the delimiter specifications to extract field values as the systems process raw data into event data. Extracted field values may be used to accelerate search queries that a system receives.