DETAILED ACTION
This office action is in response to the above identified application filed on January 15, 2026. The application contains claims 1-20.
Claims 1, 8-10, 15, and 18 are amended
Claims 1-20 are pending
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments and amendments filed on January 15, 2026 have been fully considered and the objections and rejections are updated accordingly.
Claim Rejections - 35 USC § 112
The amendments raise new issues. New 35 USC § 112(a) claim rejections and new claim objections have been made to reflect the issues that still remain upon entry of the amendments to the claims. Please see below for details.
Claim Rejections - 35 USC § 103
Applicant’s arguments with respect to the new limitations introduced with the amendments are addressed with new rationale.
Please refer to the updated 35 U.S.C. 103 rejections as set forth below for details.
Claim Objections
Claims 1, 8-10, and 15 are objected to because of the following informalities:
In the following claims, reference characters “JSON” should be enclosed within parentheses following the spelled-out version of the word or phrase being referenced so as to avoid confusion with other numbers or characters which may appear in the claims. See MPEP § 608.01(m).
Claim 1, line 21
Claim 8, line 8
Claim 10, line 23
Claim 15, line 19
Claim 9, line 7 and 9, respectively: reference characters “ID” should be enclosed within parentheses following the spelled-out version of the word or phrase being referenced so as to avoid confusion with other numbers or characters which may appear in the claims. See MPEP § 608.01(m).
Claim 9, line 2: “a rule-based engine”. Is this the same “rule-based engine” recited in the parent claim 1, line 7 or a different one?
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for pre-AIA the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claims 1, 10, and 15 each recite the limitation “wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a JSON response including the list of the one or more domain-specific filters that map to the search query”. The specification has no support for the claim that the structured response includes “the display format”. Therefore, claims 1, 10, and 15 are rejected under 35 U.S.C. 112(a).
Dependent claims 2-9, 11-14, and 16-20 are also rejected for inheriting the deficiency from their corresponding independent claims 1, 10, and 15, respectively.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Bigdelu et al. (US 20240143612 A1), in view of Prakash et al. (US 20190272296 A1).
With respect to claim 1,
Bigdelu teaches
a non-transitory computer-readable medium configured to store computer logic having instructions that, when executed, cause one or more processors ([0575]: a processor) to:
display a User Interface (UI) having a search request section and a dashboard section, and wherein the dashboard section is configured to display results of the search query (Fig. 7A; [0297]: GUI 700 corresponds to "a User Interface (UI)", a query editor panel 702 corresponds to "a search request section", and query results panel 708 corresponds to "a dashboard section" that displays query results);
upon receiving a search query from the admin via the search request section, retrieve log data from a private database associated with the enterprise, wherein the retrieval and display of the log data are confined to an enterprise environment according to search parameters parsed from the search query (Fig. 4D; [0201]: the vendor's administrator can query the system 102 for customer ID field value matches across the log data from the three systems 460, 462, 464 that are stored in the storage system 116, wherein storage system 116 corresponds to “a private database associated with the enterprise”, customer ID field value is an example of “search parameters”, and [0196]: in an enterprise security application such as SPLUNK® ENTERPRISE SECURITY, the search of the log data is confined to the enterprise); and
display the log data in the dashboard section of the UI according to a display format parsed from the search query (Fig. 7A; [0297]: display in query results panel 708 log data retrieved for the query in query editor panel 702. Fig. 17; [0428]: the user can identify the method of charting the metric in a search string),
wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a JSON response including the list of the one or more domain-specific filters that map to the search query ([0226]; [0259]; [0272]; [0331]: the model generator 528 can generate a query model 526 that can be a parsed representation of the query that identifies the various parts of the query with metadata and/or identifiers stored as a data structure and in a format that is more readily understood by a computing device. For example, the query model can be stored in a JSON format. [0046]: the system enables users to specify filter criteria in a query, such as criteria indicating certain keywords or having specific values in defined fields. As discussed above, the JSON structure stores the various parts identified from the query, which include filter criteria and a display format, consequently, the JSON structure includes both the filters and the display format).
Bigdelu does not teach
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data,
Prakash teaches
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter a search query using natural language". Fig. 2; [0056]: determining 220 the database query by applying natural language processing to the string to parse the string into words and determine natural language syntax data (e.g., part-of-speech tags and/or syntax tree data) for the words of the string through comparing and matching them to known patterns corresponding to database query syntax, wherein natural language processing corresponds to “a rule-based engine” because it is based on pattern matching, i.e., rules. Fig. 2; [0057]; Fig. 1; [0050]: present 230, via the user interface, respective text representations for tokens in the sequence of tokens as shown in Fig. 1 so that a user may interact with the user interface to edit the database query by adding, deleting, or replacing tokens in the database query, wherein 132, 134, 136, 138, and 140 correspond to “one or more domain-specific filters” and 140 corresponds to "a timeframe". The limitation “a customized security report comprising enterprise log data” is not functionally involved in the claimed process because the claimed process would have been performed the same regardless of the type of data of the search results. In addition, it is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention to customize search platforms to retrieve information of different types),
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu to incorporate the teachings of Prakash to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data. Doing so would provide for transparency of a translation process and enable collection of feedback on translations of strings to database queries to correct or improve the database query and/or to improve the translation system for better translating future strings to respective database queries as taught by Prakash ([0057]).
With respect to claim 2,
As discussed in claim 1, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to display an Insights tab, a Logs tab, and a Chat tab in the search request section of the UI, wherein the Insights tab allows the admin to select a general view of web insights in the dashboard section, wherein the Logs tab allows the admin to select a general view of data logs in the dashboard section, and wherein the Chat tab allows the admin to open a query input element in the search request section of the UI (Fig. 17; [0426]: a summary section 1710 displays “a general view of web insights in the dashboard section”, e.g., CPU or memory usage over time, hence, corresponds to the function of "an Insights tab", second log representation 1706 displays “a general view of data logs in the dashboard section”, hence, corresponds to the function of "a Logs tab". Fig. 7A; [0297]: query editor panel 702 “open a query input element in the search request section of the UI” to receive a user query, hence, corresponds to the function of “a Chat tab”. Even though the reference does not explicitly teach invoking each functionality by a different tab, doing so would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention. This is evidenced in the use of different tabs “Search”, “Datasets”, “Report”, “Alerts”, and “Dashboards” in Fig. 17),
Prakash further teaches
the query input element allowing the admin to enter the search query using natural language (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter the search query using natural language").
With respect to claim 3,
As discussed in claim 2, Bigdelu and Prakash teach all the limitations therein.
Prakash further teaches
the non-transitory computer-readable medium of claim 2, wherein the instructions further cause the one or more processors to display a microphone icon in the query input element to allow the admin to selectively switch between a text entry mode and a voice entry mode (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, wherein the voice icon corresponds to “a microphone icon” and the existence of both a text-receiving area and a voice icon portion on the search bar 120 and a user has the option of enter a search string via either text or voice teach “selectively switch between a text entry mode and a voice entry mode”).
With respect to claim 4,
As discussed in claim 3, Bigdelu and Prakash teach all the limitations therein.
Prakash further teaches
the non-transitory computer-readable medium of claim 3, wherein, when the query input element is in the voice entry mode, the instructions further cause the one or more processors to convert voice input into text using a Natural Language Processing (NLP) technique executed by a machine learning model trained on enterprise log queries and network security terminology ([0055]: a user may have entered the string in the user interface (e.g., a web page) by typing (e.g., using a keyboard) or by speaking (e.g., using a microphone and speech recognition module), wherein speech recognition is a part of natural language processing (NLP) technique. Fig. 5; [0145]: use a machine learning module (e.g., including a neural network) that has been trained to parse and classify words of a natural language phrases in a string. “a machine learning model trained on …” data from the field it will be used in is implicit).
With respect to claim 5,
As discussed in claim 2, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 2, wherein, when the Logs tab is selected, the instructions further cause the one or more processors to display at least a timeframe selection field, an activity-type selection field, and a display format selection field in the search request section of the UI, the timeframe selection field allowing the admin to select a timeframe corresponding to security event detection windows, the activity-type selection field allowing the admin to select a type of enterprise network or security activity to be displayed in the dashboard section, and the display format selection field allowing the admin to select one of a table, a line graph, a pie chart, a list, and bar graph defining a manner in which results of retrieving the log data are displayed ([0406]: the processing system may cause a GUI to be displayed on the client device and may populate the GUI with the selectable parameters, including one or more time ranges, i.e., “a timeframe selection field”. [0363]: a user may select a particular portion of the metric data displayed via the GUI (e.g., a metric associated with a particular source, a metric associated with a particular sourcetype, a metric associated with a particular time range, a particular metric, etc.), i.e., “activity-type selection field”. The limitations “… corresponding to security event detection windows” and “to select a type of enterprise network or security activity” are non-functional descriptive language that are not functionally involved in the claimed process; the process would have been performed the same regardless, and customizing the fields displayed on the UI for different purposes is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention. Fig. 17; [0428]-[0429]: the interface 1700 may include a charting element to accept user input in the form of one or more methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric).
With respect to claim 6,
As discussed in claim 1, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the log data includes any of user transactions, network security issues, and data traffic parameters ([0201]: log data include user activity that corresponds to "user transactions". [0044]; [0046]: log data include network packet data that corresponds to "data traffic parameters").
With respect to claim 7,
As discussed in claim 1, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to display one or more previously searched queries (Fig. 15; [0416]: saved queries 1518)
Prakash further teaches
and one or more suggested queries in the search request section of the UI for selection by an authorized user (Fig. 1; [0048]: suggested tokens menu 160 for use in the database query).
With respect to claim 8,
As discussed in claim 1, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to display a Filters Applied list in the search request section of the UI, the Filters Applied list including a Graph Type filter, a Client IP filter, a Time filter, and a Unit filter to help the admin validate the interpretation of the search query, wherein the filters are applied specifically to log data retrieved from a private enterprise database (Fig. 7C: 706 displays filters applied list. [0406]: time ranges correspond to “a Time filter”. [0106]: IP address. Fig. 17; [0428]-[0429]: methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric, i.e., “a Graph Type filter”. [0062]: network performance measurements, i.e., “a Unit filter”. [0350]: the data intake and query system 102 can ingest log data (e.g., the log data including raw machine data)),
wherein the Filters Applied list is populated from a structured response generated by the rule-based engine, the structured response comprising a JSON response including a list of the filters that map to the search query, and wherein the instructions further cause the one or more processors to receive feedback from the admin regarding accuracy of one or more of the filters in the Filters Applied list to improve subsequent interpretations of search queries (Fig. 15; [0407]; [0416]-[0417]: a parameter section 1510 in Fig. 5 can enable a user to apply the parameters defined in the parameter section 1510 via the processing system to generate and execute a query via the first implementation element 1514 and reset the parameters defined in the parameter section 1510 via the second implementation element 1516, wherein both cases enable “the admin” to provide “feedback” “regarding accuracy of the filters … to improve subsequent interpretations of search queries“).
With respect to claim 9,
As discussed in claim 1, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, further comprising an Application Programming Interface (API) and a rule-based engine configured to operate with the UI to process the natural language for interpreting the search query and to filter the search query according to searchable characteristics of the private database ([0048]: apply extraction rules to filter search results, wherein API is implicitly taught and processing the natural language for interpreting the search query is taught by Prakash as discussed above),
wherein the rule-based engine is configured to perform a database lookup to obtain an ID for a dynamic filter value including at least one of a user, a location, or a department, and wherein the API is configured to build an API request for retrieving the log data using the obtained ID (Fig. 4D; [0201]: obtain the order number and corresponding customer ID number of the person placing the order and query for customer ID field value matches across the log data from the three systems 460, 462, 464, wherein the API is implicitly taught as discussed above).
With respect to claim 10,
Bigdelu teaches
a system (Abstract: systems) comprising:
one or more processors ([0575]: a processor), and
a memory device (Fig. 5; [0211]: memory) configured to store a computer program having instructions that, when executed, enable the one or more processors to:
display a User Interface (UI) having a search request section and a dashboard section, and wherein the dashboard section is configured to display results of the search query (Fig. 7A; [0297]: GUI 700 corresponds to "a User Interface (UI)", a query editor panel 702 corresponds to "a search request section", and query results panel 708 corresponds to "a dashboard section" that displays query results);
upon receiving a search query from the admin via the search request section, retrieve log data from a private database associated with the enterprise, wherein the retrieval and display of the log data are confined to an enterprise environment according to search parameters parsed from the search query (Fig. 4D; [0201]: the vendor's administrator can query the system 102 for customer ID field value matches across the log data from the three systems 460, 462, 464 that are stored in the storage system 116, wherein storage system 116 corresponds to “a private database associated with the enterprise” and customer ID field value is an example of “search parameters”, and [0196]: in an enterprise security application such as SPLUNK® ENTERPRISE SECURITY, the search of the log data is confined to the enterprise); and
display the log data in the dashboard section of the UI according to a display format parsed from the search query (Fig. 7A; [0297]: display in query results panel 708 log data retrieved for the query in query editor panel 702. Fig. 17; [0428]: the user can identify the method of charting the metric in a search string),
wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a JSON response including the list of the one or more domain-specific filters that map to the search query ([0226]; [0259]; [0272]; [0331]: the model generator 528 can generate a query model 526 that can be a parsed representation of the query that identifies the various parts of the query with metadata and/or identifiers stored as a data structure and in a format that is more readily understood by a computing device. For example, the query model can be stored in a JSON format. [0046]: the system enables users to specify filter criteria in a query, such as criteria indicating certain keywords or having specific values in defined fields. As discussed above, the JSON structure stores the various parts identified from the query, which include filter criteria and a display format, consequently, the JSON structure includes both the filters and the display format).
Bigdelu does not teach
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data,
Prakash teaches
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter a search query using natural language". Fig. 2; [0056]: determining 220 the database query by applying natural language processing to the string to parse the string into words and determine natural language syntax data (e.g., part-of-speech tags and/or syntax tree data) for the words of the string through comparing and matching them to known patterns corresponding to database query syntax, wherein natural language processing corresponds to “a rule-based engine” because it is based on pattern matching, i.e., rules. Fig. 2; [0057]; Fig. 1; [0050]: present 230, via the user interface, respective text representations for tokens in the sequence of tokens as shown in Fig. 1 so that a user may interact with the user interface to edit the database query by adding, deleting, or replacing tokens in the database query, wherein 132, 134, 136, 138, and 140 correspond to “one or more domain-specific filters” and 140 corresponds to "a timeframe". The limitation “a customized security report comprising enterprise log data” is not functionally involved in the claimed process because the claimed process would have been performed the same regardless of the type of data of the search results. In addition, it is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention to customize search platforms to retrieve information of different types),
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu to incorporate the teachings of Prakash to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data. Doing so would provide for transparency of a translation process and enable collection of feedback on translations of strings to database queries to correct or improve the database query and/or to improve the translation system for better translating future strings to respective database queries as taught by Prakash ([0057]).
With respect to claim 11,
As discussed in claim 10, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the system of claim 10, wherein the instructions further enable the one or more processors to display an Insights tab, a Logs tab, and a Chat tab in the search request section of the UI, wherein the Insights tab allows the admin to select a general view of web insights in the dashboard section, wherein the Logs tab allows the admin to select a general view of data logs in the dashboard section, and wherein the Chat tab allows the admin to open a query input element in the search request section of the UI (Fig. 17; [0426]: a summary section 1710 displays “a general view of web insights in the dashboard section”, e.g., CPU or memory usage over time, hence, corresponds to the function of "an Insights tab", second log representation 1706 displays “a general view of data logs in the dashboard section”, hence, corresponds to the function of "a Logs tab". Fig. 7A; [0297]: query editor panel 702 “open a query input element in the search request section of the UI” to receive a user query, hence, corresponds to the function of “a Chat tab”. Even though the reference does not explicitly teach invoking each functionality by a different tab, doing so would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention. This is evidenced in the use of different tabs “Search”, “Datasets”, “Report”, “Alerts”, and “Dashboards” in Fig. 17),
Prakash further teaches
the query input element allowing the admin to enter the search query using natural language (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter the search query using natural language").
With respect to claim 12,
As discussed in claim 11, Bigdelu and Prakash teach all the limitations therein.
Prakash further teaches
the system of claim 11, wherein the instructions further cause the one or more processors to display a microphone icon in the query input element to allow the admin to switch between a text entry mode and a voice entry mode (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, wherein the voice icon corresponds to “a microphone icon”).
With respect to claim 13,
As discussed in claim 12, Bigdelu and Prakash teach all the limitations therein.
Prakash further teaches
the system of claim 12, wherein, when the query input element is in the voice entry mode, the instructions further cause the one or more processors to convert voice input into text using a Natural Language Processing (NLP) technique ([0055]: a user may have entered the string in the user interface (e.g., a web page) by typing (e.g., using a keyboard) or by speaking (e.g., using a microphone and speech recognition module), wherein speech recognition is a part of natural language processing (NLP) technique).
With respect to claim 14,
As discussed in claim 11, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the system of claim 11, wherein, when the Logs tab is selected, the instructions further cause the one or more processors to display at least a timeframe selection field, an activity-type selection field, and a display format selection field in the search request section of the UI, the timeframe selection field allowing the admin to select a timeframe during which network activities occurred, the activity-type selection field allowing the admin to select a type of network activity to be displayed in the dashboard section, and the display format selection field allowing the admin to select one of a table, a line graph, a pie chart, a list, and bar graph defining a manner in which results of retrieving the log data are displayed ([0406]: the processing system may cause a GUI to be displayed on the client device and may populate the GUI with the selectable parameters, including one or more time ranges, i.e., “a timeframe selection field”. [0363]: a user may select a particular portion of the metric data displayed via the GUI (e.g., a metric associated with a particular source, a metric associated with a particular sourcetype, a metric associated with a particular time range, a particular metric, etc.), i.e., “activity-type selection field”. Fig. 17; [0428]-[0429]: the interface 1700 may include a charting element to accept user input in the form of one or more methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric).
With respect to claim 15,
Bigdelu teaches
a method (Abstract: methods) comprising steps of:
displaying a User Interface (UI) having a search request section and a dashboard section, and wherein the dashboard section is configured to display results of the search query (Fig. 7A; [0297]: GUI 700 corresponds to "a User Interface (UI)", a query editor panel 702 corresponds to "a search request section", and query results panel 708 corresponds to "a dashboard section" that displays query results);
upon receiving a search query from the admin via the search request section, retrieving log data from a private database associated with the enterprise, wherein the retrieval and display of the log data are confined to an enterprise environment according to search parameters parsed from the search query (Fig. 4D; [0201]: the vendor's administrator can query the system 102 for customer ID field value matches across the log data from the three systems 460, 462, 464 that are stored in the storage system 116, wherein storage system 116 corresponds to “a private database associated with the enterprise” and customer ID field value is an example of “search parameters”, and [0196]: in an enterprise security application such as SPLUNK® ENTERPRISE SECURITY, the search of the log data is confined to the enterprise); and
displaying the log data in the dashboard section of the UI according to a display format parsed from the search query (Fig. 7A; [0297]: display in query results panel 708 log data retrieved for the query in query editor panel 702. Fig. 17; [0428]: the user can identify the method of charting the metric in a search string),
wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a JSON response including the list of the one or more domain-specific filters that map to the search query ([0226]; [0259]; [0272]; [0331]: the model generator 528 can generate a query model 526 that can be a parsed representation of the query that identifies the various parts of the query with metadata and/or identifiers stored as a data structure and in a format that is more readily understood by a computing device. For example, the query model can be stored in a JSON format. [0046]: the system enables users to specify filter criteria in a query, such as criteria indicating certain keywords or having specific values in defined fields. As discussed above, the JSON structure stores the various parts identified from the query, which include filter criteria and a display format, consequently, the JSON structure includes both the filters and the display format).
Bigdelu does not teach
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data,
Prakash teaches
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter a search query using natural language". Fig. 2; [0056]: determining 220 the database query by applying natural language processing to the string to parse the string into words and determine natural language syntax data (e.g., part-of-speech tags and/or syntax tree data) for the words of the string through comparing and matching them to known patterns corresponding to database query syntax, wherein natural language processing corresponds to “a rule-based engine” because it is based on pattern matching, i.e., rules. Fig. 2; [0057]; Fig. 1; [0050]: present 230, via the user interface, respective text representations for tokens in the sequence of tokens as shown in Fig. 1 so that a user may interact with the user interface to edit the database query by adding, deleting, or replacing tokens in the database query, wherein 132, 134, 136, 138, and 140 correspond to “one or more domain-specific filters” and 140 corresponds to "a timeframe". The limitation “a customized security report comprising enterprise log data” is not functionally involved in the claimed process because the claimed process would have been performed the same regardless of the type of data of the search results. In addition, it is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention to customize search platforms to retrieve information of different types),
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu to incorporate the teachings of Prakash to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data. Doing so would provide for transparency of a translation process and enable collection of feedback on translations of strings to database queries to correct or improve the database query and/or to improve the translation system for better translating future strings to respective database queries as taught by Prakash ([0057]).
With respect to claim 16,
As discussed in claim 15, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, wherein the log data includes any of user transactions, network security issues, and data traffic parameters ([0201]: log data include user activity that corresponds to "user transactions". [0044]; [0046]: log data include network packet data that corresponds to "data traffic parameters").
With respect to claim 17,
As discussed in claim 15, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of displaying one or more previously searched queries (Fig. 15; [0416]: saved queries 1518)
Prakash further teaches
and one or more suggested queries in the search request section of the UI for selection by an authorized user (Fig. 1; [0048]: suggested tokens menu 160 for use in the database query).
With respect to claim 18,
As discussed in claim 15, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of displaying a Filters Applied list in the search request section of the UI, the Filters Applied list including a Graph Type filter, a Client IP filter, a Time filter, and a Unit filter to help the admin validate the interpretation of the search query (Fig. 7C: 706 displays filters applied list. [0406]: time ranges correspond to “a Time filter”. [0106]: IP address. Fig. 17; [0428]-[0429]: methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric, i.e., “a Graph Type filter”. [0062]: network performance measurements, i.e., “a Unit filter”).
With respect to claim 19,
As discussed in claim 15, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of operating with an Application Programming Interface (API) and a rule-based engine configured to process the natural language for interpreting the search query and to filter the search query according to searchable characteristics of the private database ([0048]: apply extraction rules to filter search results, wherein API is implicitly taught and processing the natural language for interpreting the search query is taught by Prakash as discussed above).
With respect to claim 20,
As discussed in claim 15, Bigdelu and Prakash teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of displaying an Insights tab, a Logs tab, and a Chat tab in the search request section of the UI, wherein the Insights tab allows the admin to select a general view of web insights in the dashboard section, wherein the Logs tab allows the admin to select a general view of data logs in the dashboard section, and wherein the Chat tab allows the admin to open a query input element in the search request section of the UI (Fig. 17; [0426]: a summary section 1710 displays “a general view of web insights in the dashboard section”, e.g., CPU or memory usage over time, hence, corresponds to the function of "an Insights tab", second log representation 1706 displays “a general view of data logs in the dashboard section”, hence, corresponds to the function of "a Logs tab". Fig. 7A; [0297]: query editor panel 702 “open a query input element in the search request section of the UI” to receive a user query, hence, corresponds to the function of “a Chat tab”. Even though the reference does not explicitly teach invoking each functionality by a different tab, doing so would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention. This is evidenced in the use of different tabs “Search”, “Datasets”, “Report”, “Alerts”, and “Dashboards” in Fig. 17),
Prakash further teaches
the query input element allowing the admin to enter the search query using natural language (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter the search query using natural language").
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to XIAOQIN HU whose telephone number is (571)272-1792. The examiner can normally be reached on Monday-Friday 7:00am-3:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Charles Rones can be reached on (571) 272-4085. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/XIAOQIN HU/Examiner, Art Unit 2168
/CHARLES RONES/Supervisory Patent Examiner, Art Unit 2168