US 11,816,321 B1
Enhancing extraction rules based on user feedback
Li Li, Richmond (CA); Yongxin Su, Richmond (CA); Ting Yuan, Waterloo (CA); Qian Jie Zhong, Vancouver (CA); and Yiyun Zhu, Vancouver (CA)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by SPLUNK INC., San Francisco, CA (US)
Filed on Jan. 31, 2019, as Appl. No. 16/264,517.
Int. Cl. G06F 3/04847 (2022.01); G06F 3/0482 (2013.01); G06F 16/245 (2019.01); G06F 16/25 (2019.01); G06N 20/00 (2019.01)
CPC G06F 3/04847 (2013.01) [G06F 3/0482 (2013.01); G06F 16/245 (2019.01); G06F 16/25 (2019.01); G06N 20/00 (2019.01)] 22 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
providing for display, via a graphical user interface, a plurality of extraction rules relevant to an event set and corresponding match rates, the plurality of extraction rules identified as relevant to the event set by determining a match rate for each extraction rule indicating a number of events of in the event set that match the extraction rule as compared to a total number of events in the event set, wherein each event in the event set is associated with a timestamp and includes a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment, and wherein each extraction rule, of the plurality of extraction rules, indicates how to extract a subportion of text from the portion of raw machine data in the event to produce a value for a field specified by the extraction rule;
receiving, via the graphical user interface, a selection of an extraction rule of the plurality of extraction rules;
providing for display, via the graphical user interface, a set of events matching the selected extraction rule;
receiving, via the graphical user interface, a modification applied to the displayed extraction rule and a modification applied to a field name associated with the set of events matching the selected extraction rule; and
providing the modifications, provided via the graphical user interface, into a machine learning model to enhance extraction rules available for performing subsequent data extraction, wherein the machine learning model uses the modifications to enhance the extraction rules by reordering extraction rules.