DETAILED ACTION
This office action is in response to the above identified application filed on May 17, 2026. The application contains claims 1-20.
Claims 1, 8, 10, and 15 are amended
Claim 9 is cancelled
Claims 1-8 and 10-20 are pending
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on May 17, 2026 has been entered.
Response to Arguments
Applicant's arguments and amendments filed on May 17, 2026 have been fully considered and the objections and rejections are updated accordingly.
Claim Objections
In view of the amendments to the claims, the claim objections are withdrawn.
Claim Rejections - 35 USC § 112
In view of the amendments to Applicant’s arguments, the claim rejections are withdrawn.
Claim Rejections - 35 USC § 103
Applicant’s arguments with respect to the new limitations introduced with the amendments are addressed with new prior art and rationale.
Please refer to the updated 35 U.S.C. 103 rejections as set forth below for details.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Bigdelu et al. (US 20240143612 A1), in view of Prakash et al. (US 20190272296 A1), and in further view of Kilinc et al. (US 11922942 B1).
With respect to claim 1,
Bigdelu teaches
a non-transitory computer-readable medium configured to store computer logic having instructions that, when executed, cause one or more processors ([0575]: a processor) to:
display a User Interface (UI) having a search request section and a dashboard section, and wherein the dashboard section is configured to display results of the search query (Fig. 7A; [0297]: GUI 700 corresponds to "a User Interface (UI)", a query editor panel 702 corresponds to "a search request section", and query results panel 708 corresponds to "a dashboard section" that displays query results);
upon receiving a search query from the admin via the search request section, retrieve log data from a private database associated with the enterprise, wherein the retrieval and display of the log data are confined to an enterprise environment according to search parameters parsed from the search query (Fig. 4D; [0201]: the vendor's administrator can query the system 102 for customer ID field value matches across the log data from the three systems 460, 462, 464 that are stored in the storage system 116, wherein storage system 116 corresponds to “a private database associated with the enterprise”, customer ID field value is an example of “search parameters”, and [0196]: in an enterprise security application such as SPLUNK® ENTERPRISE SECURITY, the search of the log data is confined to the enterprise); and
display the log data in the dashboard section of the UI according to a display format parsed from the search query (Fig. 7A; [0297]: display in query results panel 708 log data retrieved for the query in query editor panel 702. Fig. 17; [0428]: the user can identify the method of charting the metric in a search string),
wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a response including the list of the one or more domain-specific filters that map to the search query ([0226]; [0259]; [0272]; [0331]: the model generator 528 can generate a query model 526 that can be a parsed representation of the query that identifies the various parts of the query with metadata and/or identifiers stored as a data structure and in a format that is more readily understood by a computing device. For example, the query model can be stored in a JSON format. [0046]: the system enables users to specify filter criteria in a query, such as criteria indicating certain keywords or having specific values in defined fields. As discussed above, the JSON structure stores the various parts identified from the query, which include filter criteria and a display format, consequently, the JSON structure includes both the filters and the display format),
Bigdelu does not teach
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data,
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID.
Prakash teaches
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter a search query using natural language". Fig. 2; [0056]: determining 220 the database query by applying natural language processing to the string to parse the string into words and determine natural language syntax data (e.g., part-of-speech tags and/or syntax tree data) for the words of the string through comparing and matching them to known patterns corresponding to database query syntax, wherein natural language processing corresponds to “a rule-based engine” because it is based on pattern matching, i.e., rules. Fig. 2; [0057]; Fig. 1; [0050]: present 230, via the user interface, respective text representations for tokens in the sequence of tokens as shown in Fig. 1 so that a user may interact with the user interface to edit the database query by adding, deleting, or replacing tokens in the database query, wherein 132, 134, 136, 138, and 140 correspond to “one or more domain-specific filters” and 140 corresponds to "a timeframe". The limitation “a customized security report comprising enterprise log data” is not functionally involved in the claimed process because the claimed process would have been performed the same regardless of the type of data of the search results. In addition, it is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention to customize search platforms to retrieve information of different types),
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu to incorporate the teachings of Prakash to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data. Doing so would provide for transparency of a translation process and enable collection of feedback on translations of strings to database queries to correct or improve the database query and/or to improve the translation system for better translating future strings to respective database queries as taught by Prakash ([0057]).
Bigdelu and Prakash do not teach
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID.
Kilinc teaches
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID (Fig. 1; Col. 6, lines 9-67; Col. 7, lines 1-19: the question and answer component 161 in communication with the NLU component 160 may send the text data 150, which represents a user utterance or text input, to a knowledge graph to determine an appropriate response. Fig. 3; Col. 11, lines 27-48: the question and answer component 161 may use data stored in data structure 300 as shown in Fig. 3 to determine the account ID associated with the device ID and where in memory to locate the knowledge graph(s) associated with the device ID and/or account ID and use it to retrieve the response to the user query. Checking the data structure 300 to obtain the account ID associated with the device ID corresponds to “a database lookup” that obtains the account ID, which corresponds to “an identifier (ID)” for “a user”. The question and answer component 161 in communication with the NLU component 160 performs the functions of “the rule-based engine” and the “API”. “build an API request for retrieving the log data using the obtained ID” is inherently taught).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu and Prakash to incorporate the teachings of Kilinc to configure the rule-based engine to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and configure an Application Programming Interface (API) operating with the rule-based engine to build an API request for retrieving the log data using the obtained ID. Doing so would determine that the device ID of input device 110 is associated with the user account ID of user 101 which is, in turn, associated with organization A. In other words, natural language processing system 120 may determine that user 101 and/or input device 110 has access privileges to the knowledge graph associated with organization A. As such, question and answer component 161 of natural language processing system 120 may send the input natural language data (e.g., the parsed user query) to the knowledge graph associated with organization A and may employ a bottom-up NLU strategy to attempt to generate response data as taught by Kilinc (Col. 7, lines 2-19).
With respect to claim 2,
As discussed in claim 1, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to display an Insights tab, a Logs tab, and a Chat tab in the search request section of the UI, wherein the Insights tab allows the admin to select a general view of web insights in the dashboard section, wherein the Logs tab allows the admin to select a general view of data logs in the dashboard section, and wherein the Chat tab allows the admin to open a query input element in the search request section of the UI (Fig. 17; [0426]: a summary section 1710 displays “a general view of web insights in the dashboard section”, e.g., CPU or memory usage over time, hence, corresponds to the function of "an Insights tab", second log representation 1706 displays “a general view of data logs in the dashboard section”, hence, corresponds to the function of "a Logs tab". Fig. 7A; [0297]: query editor panel 702 “open a query input element in the search request section of the UI” to receive a user query, hence, corresponds to the function of “a Chat tab”. Even though the reference does not explicitly teach invoking each functionality by a different tab, doing so would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention. This is evidenced in the use of different tabs “Search”, “Datasets”, “Report”, “Alerts”, and “Dashboards” in Fig. 17),
Prakash further teaches
the query input element allowing the admin to enter the search query using natural language (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter the search query using natural language").
With respect to claim 3,
As discussed in claim 2, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Prakash further teaches
the non-transitory computer-readable medium of claim 2, wherein the instructions further cause the one or more processors to display a microphone icon in the query input element to allow the admin to selectively switch between a text entry mode and a voice entry mode (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, wherein the voice icon corresponds to “a microphone icon” and the existence of both a text-receiving area and a voice icon portion on the search bar 120 and a user has the option of enter a search string via either text or voice teach “selectively switch between a text entry mode and a voice entry mode”).
With respect to claim 4,
As discussed in claim 3, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Prakash further teaches
the non-transitory computer-readable medium of claim 3, wherein, when the query input element is in the voice entry mode, the instructions further cause the one or more processors to convert voice input into text using a Natural Language Processing (NLP) technique executed by a machine learning model trained on enterprise log queries and network security terminology ([0055]: a user may have entered the string in the user interface (e.g., a web page) by typing (e.g., using a keyboard) or by speaking (e.g., using a microphone and speech recognition module), wherein speech recognition is a part of natural language processing (NLP) technique. Fig. 5; [0145]: use a machine learning module (e.g., including a neural network) that has been trained to parse and classify words of a natural language phrases in a string. “a machine learning model trained on …” data from the field it will be used in is implicit).
With respect to claim 5,
As discussed in claim 2, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 2, wherein, when the Logs tab is selected, the instructions further cause the one or more processors to display at least a timeframe selection field, an activity-type selection field, and a display format selection field in the search request section of the UI, the timeframe selection field allowing the admin to select a timeframe corresponding to security event detection windows, the activity-type selection field allowing the admin to select a type of enterprise network or security activity to be displayed in the dashboard section, and the display format selection field allowing the admin to select one of a table, a line graph, a pie chart, a list, and bar graph defining a manner in which results of retrieving the log data are displayed ([0406]: the processing system may cause a GUI to be displayed on the client device and may populate the GUI with the selectable parameters, including one or more time ranges, i.e., “a timeframe selection field”. [0363]: a user may select a particular portion of the metric data displayed via the GUI (e.g., a metric associated with a particular source, a metric associated with a particular sourcetype, a metric associated with a particular time range, a particular metric, etc.), i.e., “activity-type selection field”. The limitations “… corresponding to security event detection windows” and “to select a type of enterprise network or security activity” are non-functional descriptive language that are not functionally involved in the claimed process; the process would have been performed the same regardless, and customizing the fields displayed on the UI for different purposes is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention. Fig. 17; [0428]-[0429]: the interface 1700 may include a charting element to accept user input in the form of one or more methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric).
With respect to claim 6,
As discussed in claim 1, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the log data includes any of user transactions, network security issues, and data traffic parameters ([0201]: log data include user activity that corresponds to "user transactions". [0044]; [0046]: log data include network packet data that corresponds to "data traffic parameters").
With respect to claim 7,
As discussed in claim 1, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to display one or more previously searched queries (Fig. 15; [0416]: saved queries 1518)
Prakash further teaches
and one or more suggested queries in the search request section of the UI for selection by an authorized user (Fig. 1; [0048]: suggested tokens menu 160 for use in the database query).
With respect to claim 8,
As discussed in claim 1, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the non-transitory computer-readable medium of claim 1, wherein the instructions further cause the one or more processors to display a Filters Applied list in the search request section of the UI, the Filters Applied list including a Graph Type filter, a Client IP filter, a Time filter, and a Unit filter to help the admin validate the interpretation of the search query, wherein the filters are applied specifically to log data retrieved from a private enterprise database (Fig. 7C: 706 displays filters applied list. [0406]: time ranges correspond to “a Time filter”. [0106]: IP address. Fig. 17; [0428]-[0429]: methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric, i.e., “a Graph Type filter”. [0062]: network performance measurements, i.e., “a Unit filter”. [0350]: the data intake and query system 102 can ingest log data (e.g., the log data including raw machine data)),
wherein the Filters Applied list is populated from a structured response generated by the rule-based engine, the structured response comprising the response including a list of the filters that map to the search query, and wherein the instructions further cause the one or more processors to receive feedback from the admin regarding accuracy of one or more of the filters in the Filters Applied list to improve subsequent interpretations of search queries (Fig. 15; [0407]; [0416]-[0417]: a parameter section 1510 in Fig. 5 can enable a user to apply the parameters defined in the parameter section 1510 via the processing system to generate and execute a query via the first implementation element 1514 and reset the parameters defined in the parameter section 1510 via the second implementation element 1516, wherein both cases enable “the admin” to provide “feedback” “regarding accuracy of the filters … to improve subsequent interpretations of search queries“).
With respect to claim 10,
Bigdelu teaches
a system (Abstract: systems) comprising:
one or more processors ([0575]: a processor), and
a memory device (Fig. 5; [0211]: memory) configured to store a computer program having instructions that, when executed, enable the one or more processors to:
display a User Interface (UI) having a search request section and a dashboard section, and wherein the dashboard section is configured to display results of the search query (Fig. 7A; [0297]: GUI 700 corresponds to "a User Interface (UI)", a query editor panel 702 corresponds to "a search request section", and query results panel 708 corresponds to "a dashboard section" that displays query results);
upon receiving a search query from the admin via the search request section, retrieve log data from a private database associated with the enterprise, wherein the retrieval and display of the log data are confined to an enterprise environment according to search parameters parsed from the search query (Fig. 4D; [0201]: the vendor's administrator can query the system 102 for customer ID field value matches across the log data from the three systems 460, 462, 464 that are stored in the storage system 116, wherein storage system 116 corresponds to “a private database associated with the enterprise” and customer ID field value is an example of “search parameters”, and [0196]: in an enterprise security application such as SPLUNK® ENTERPRISE SECURITY, the search of the log data is confined to the enterprise); and
display the log data in the dashboard section of the UI according to a display format parsed from the search query (Fig. 7A; [0297]: display in query results panel 708 log data retrieved for the query in query editor panel 702. Fig. 17; [0428]: the user can identify the method of charting the metric in a search string),
wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a response including the list of the one or more domain-specific filters that map to the search query ([0226]; [0259]; [0272]; [0331]: the model generator 528 can generate a query model 526 that can be a parsed representation of the query that identifies the various parts of the query with metadata and/or identifiers stored as a data structure and in a format that is more readily understood by a computing device. For example, the query model can be stored in a JSON format. [0046]: the system enables users to specify filter criteria in a query, such as criteria indicating certain keywords or having specific values in defined fields. As discussed above, the JSON structure stores the various parts identified from the query, which include filter criteria and a display format, consequently, the JSON structure includes both the filters and the display format),
Bigdelu does not teach
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data,
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID.
Prakash teaches
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter a search query using natural language". Fig. 2; [0056]: determining 220 the database query by applying natural language processing to the string to parse the string into words and determine natural language syntax data (e.g., part-of-speech tags and/or syntax tree data) for the words of the string through comparing and matching them to known patterns corresponding to database query syntax, wherein natural language processing corresponds to “a rule-based engine” because it is based on pattern matching, i.e., rules. Fig. 2; [0057]; Fig. 1; [0050]: present 230, via the user interface, respective text representations for tokens in the sequence of tokens as shown in Fig. 1 so that a user may interact with the user interface to edit the database query by adding, deleting, or replacing tokens in the database query, wherein 132, 134, 136, 138, and 140 correspond to “one or more domain-specific filters” and 140 corresponds to "a timeframe". The limitation “a customized security report comprising enterprise log data” is not functionally involved in the claimed process because the claimed process would have been performed the same regardless of the type of data of the search results. In addition, it is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention to customize search platforms to retrieve information of different types),
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu to incorporate the teachings of Prakash to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data. Doing so would provide for transparency of a translation process and enable collection of feedback on translations of strings to database queries to correct or improve the database query and/or to improve the translation system for better translating future strings to respective database queries as taught by Prakash ([0057]).
Bigdelu and Prakash do not teach
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID.
Kilinc teaches
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID (Fig. 1; Col. 6, lines 9-67; Col. 7, lines 1-19: the question and answer component 161 in communication with the NLU component 160 may send the text data 150, which represents a user utterance or text input, to a knowledge graph to determine an appropriate response. Fig. 3; Col. 11, lines 27-48: the question and answer component 161 may use data stored in data structure 300 as shown in Fig. 3 to determine the account ID associated with the device ID and where in memory to locate the knowledge graph(s) associated with the device ID and/or account ID and use it to retrieve the response to the user query. Checking the data structure 300 to obtain the account ID associated with the device ID corresponds to “a database lookup” that obtains the account ID, which corresponds to “an identifier (ID)” for “a user”. The question and answer component 161 in communication with the NLU component 160 performs the functions of “the rule-based engine” and the “API”. “build an API request for retrieving the log data using the obtained ID” is inherently taught).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu and Prakash to incorporate the teachings of Kilinc to configure the rule-based engine to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and configure an Application Programming Interface (API) operating with the rule-based engine to build an API request for retrieving the log data using the obtained ID. Doing so would determine that the device ID of input device 110 is associated with the user account ID of user 101 which is, in turn, associated with organization A. In other words, natural language processing system 120 may determine that user 101 and/or input device 110 has access privileges to the knowledge graph associated with organization A. As such, question and answer component 161 of natural language processing system 120 may send the input natural language data (e.g., the parsed user query) to the knowledge graph associated with organization A and may employ a bottom-up NLU strategy to attempt to generate response data as taught by Kilinc (Col. 7, lines 2-19).
With respect to claim 11,
As discussed in claim 10, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the system of claim 10, wherein the instructions further enable the one or more processors to display an Insights tab, a Logs tab, and a Chat tab in the search request section of the UI, wherein the Insights tab allows the admin to select a general view of web insights in the dashboard section, wherein the Logs tab allows the admin to select a general view of data logs in the dashboard section, and wherein the Chat tab allows the admin to open a query input element in the search request section of the UI (Fig. 17; [0426]: a summary section 1710 displays “a general view of web insights in the dashboard section”, e.g., CPU or memory usage over time, hence, corresponds to the function of "an Insights tab", second log representation 1706 displays “a general view of data logs in the dashboard section”, hence, corresponds to the function of "a Logs tab". Fig. 7A; [0297]: query editor panel 702 “open a query input element in the search request section of the UI” to receive a user query, hence, corresponds to the function of “a Chat tab”. Even though the reference does not explicitly teach invoking each functionality by a different tab, doing so would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention. This is evidenced in the use of different tabs “Search”, “Datasets”, “Report”, “Alerts”, and “Dashboards” in Fig. 17),
Prakash further teaches
the query input element allowing the admin to enter the search query using natural language (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter the search query using natural language").
With respect to claim 12,
As discussed in claim 11, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Prakash further teaches
the system of claim 11, wherein the instructions further cause the one or more processors to display a microphone icon in the query input element to allow the admin to switch between a text entry mode and a voice entry mode (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, wherein the voice icon corresponds to “a microphone icon”).
With respect to claim 13,
As discussed in claim 12, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Prakash further teaches
the system of claim 12, wherein, when the query input element is in the voice entry mode, the instructions further cause the one or more processors to convert voice input into text using a Natural Language Processing (NLP) technique ([0055]: a user may have entered the string in the user interface (e.g., a web page) by typing (e.g., using a keyboard) or by speaking (e.g., using a microphone and speech recognition module), wherein speech recognition is a part of natural language processing (NLP) technique).
With respect to claim 14,
As discussed in claim 11, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the system of claim 11, wherein, when the Logs tab is selected, the instructions further cause the one or more processors to display at least a timeframe selection field, an activity-type selection field, and a display format selection field in the search request section of the UI, the timeframe selection field allowing the admin to select a timeframe during which network activities occurred, the activity-type selection field allowing the admin to select a type of network activity to be displayed in the dashboard section, and the display format selection field allowing the admin to select one of a table, a line graph, a pie chart, a list, and bar graph defining a manner in which results of retrieving the log data are displayed ([0406]: the processing system may cause a GUI to be displayed on the client device and may populate the GUI with the selectable parameters, including one or more time ranges, i.e., “a timeframe selection field”. [0363]: a user may select a particular portion of the metric data displayed via the GUI (e.g., a metric associated with a particular source, a metric associated with a particular sourcetype, a metric associated with a particular time range, a particular metric, etc.), i.e., “activity-type selection field”. Fig. 17; [0428]-[0429]: the interface 1700 may include a charting element to accept user input in the form of one or more methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric).
With respect to claim 15,
Bigdelu teaches
a method (Abstract: methods) comprising steps of:
displaying a User Interface (UI) having a search request section and a dashboard section, and wherein the dashboard section is configured to display results of the search query (Fig. 7A; [0297]: GUI 700 corresponds to "a User Interface (UI)", a query editor panel 702 corresponds to "a search request section", and query results panel 708 corresponds to "a dashboard section" that displays query results);
upon receiving a search query from the admin via the search request section, retrieving log data from a private database associated with the enterprise, wherein the retrieval and display of the log data are confined to an enterprise environment according to search parameters parsed from the search query (Fig. 4D; [0201]: the vendor's administrator can query the system 102 for customer ID field value matches across the log data from the three systems 460, 462, 464 that are stored in the storage system 116, wherein storage system 116 corresponds to “a private database associated with the enterprise” and customer ID field value is an example of “search parameters”, and [0196]: in an enterprise security application such as SPLUNK® ENTERPRISE SECURITY, the search of the log data is confined to the enterprise); and
displaying the log data in the dashboard section of the UI according to a display format parsed from the search query (Fig. 7A; [0297]: display in query results panel 708 log data retrieved for the query in query editor panel 702. Fig. 17; [0428]: the user can identify the method of charting the metric in a search string),
wherein parsing the natural language by the rule-based engine comprises generating a structured response including the one or more domain-specific filters and the display format, and wherein the structured response comprises a response including the list of the one or more domain-specific filters that map to the search query ([0226]; [0259]; [0272]; [0331]: the model generator 528 can generate a query model 526 that can be a parsed representation of the query that identifies the various parts of the query with metadata and/or identifiers stored as a data structure and in a format that is more readily understood by a computing device. For example, the query model can be stored in a JSON format. [0046]: the system enables users to specify filter criteria in a query, such as criteria indicating certain keywords or having specific values in defined fields. As discussed above, the JSON structure stores the various parts identified from the query, which include filter criteria and a display format, consequently, the JSON structure includes both the filters and the display format),
Bigdelu does not teach
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data,
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID.
Prakash teaches
wherein the search request section is configured to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter a search query using natural language". Fig. 2; [0056]: determining 220 the database query by applying natural language processing to the string to parse the string into words and determine natural language syntax data (e.g., part-of-speech tags and/or syntax tree data) for the words of the string through comparing and matching them to known patterns corresponding to database query syntax, wherein natural language processing corresponds to “a rule-based engine” because it is based on pattern matching, i.e., rules. Fig. 2; [0057]; Fig. 1; [0050]: present 230, via the user interface, respective text representations for tokens in the sequence of tokens as shown in Fig. 1 so that a user may interact with the user interface to edit the database query by adding, deleting, or replacing tokens in the database query, wherein 132, 134, 136, 138, and 140 correspond to “one or more domain-specific filters” and 140 corresponds to "a timeframe". The limitation “a customized security report comprising enterprise log data” is not functionally involved in the claimed process because the claimed process would have been performed the same regardless of the type of data of the search results. In addition, it is within the purview of one of ordinary skill in the art before the effective filing date of the claimed invention to customize search platforms to retrieve information of different types),
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu to incorporate the teachings of Prakash to allow an admin associated with an enterprise to enter a search query using natural language, wherein the natural language is parsed by a rule-based engine to generate one or more domain-specific filters including at least a timeframe, an activity type, a client identifier, or a unit of measure, wherein the UI further displays a Filters Applied list of the domain-specific filters to enable the admin to validate or modify an interpretation of the search query, wherein the domain-specific filters define a customized security report comprising enterprise log data. Doing so would provide for transparency of a translation process and enable collection of feedback on translations of strings to database queries to correct or improve the database query and/or to improve the translation system for better translating future strings to respective database queries as taught by Prakash ([0057]).
Bigdelu and Prakash do not teach
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID.
Kilinc teaches
and wherein the rule-based engine is further configured to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and wherein an Application Programming Interface (API)operating with the rule-based engine is configured to build an API request for retrieving the log data using the obtained ID (Fig. 1; Col. 6, lines 9-67; Col. 7, lines 1-19: the question and answer component 161 in communication with the NLU component 160 may send the text data 150, which represents a user utterance or text input, to a knowledge graph to determine an appropriate response. Fig. 3; Col. 11, lines 27-48: the question and answer component 161 may use data stored in data structure 300 as shown in Fig. 3 to determine the account ID associated with the device ID and where in memory to locate the knowledge graph(s) associated with the device ID and/or account ID and use it to retrieve the response to the user query. Checking the data structure 300 to obtain the account ID associated with the device ID corresponds to “a database lookup” that obtains the account ID, which corresponds to “an identifier (ID)” for “a user”. The question and answer component 161 in communication with the NLU component 160 performs the functions of “the rule-based engine” and the “API”. “build an API request for retrieving the log data using the obtained ID” is inherently taught).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Bigdelu and Prakash to incorporate the teachings of Kilinc to configure the rule-based engine to perform a database lookup to obtain an identifier (ID) for a dynamic filter value including at least one of a user, a location, or a department, and configure an Application Programming Interface (API) operating with the rule-based engine to build an API request for retrieving the log data using the obtained ID. Doing so would determine that the device ID of input device 110 is associated with the user account ID of user 101 which is, in turn, associated with organization A. In other words, natural language processing system 120 may determine that user 101 and/or input device 110 has access privileges to the knowledge graph associated with organization A. As such, question and answer component 161 of natural language processing system 120 may send the input natural language data (e.g., the parsed user query) to the knowledge graph associated with organization A and may employ a bottom-up NLU strategy to attempt to generate response data as taught by Kilinc (Col. 7, lines 2-19).
With respect to claim 16,
As discussed in claim 15, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, wherein the log data includes any of user transactions, network security issues, and data traffic parameters ([0201]: log data include user activity that corresponds to "user transactions". [0044]; [0046]: log data include network packet data that corresponds to "data traffic parameters").
With respect to claim 17,
As discussed in claim 15, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of displaying one or more previously searched queries (Fig. 15; [0416]: saved queries 1518)
Prakash further teaches
and one or more suggested queries in the search request section of the UI for selection by an authorized user (Fig. 1; [0048]: suggested tokens menu 160 for use in the database query).
With respect to claim 18,
As discussed in claim 15, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of displaying a Filters Applied list in the search request section of the UI, the Filters Applied list including a Graph Type filter, a Client IP filter, a Time filter, and a Unit filter to help the admin validate the interpretation of the search query (Fig. 7C: 706 displays filters applied list. [0406]: time ranges correspond to “a Time filter”. [0106]: IP address. Fig. 17; [0428]-[0429]: methods of charting the metric, including a bar graph, a line graph, a symbolical representation, a numerical summarization, a textual representation, or any representation and/or summarization of the metric, i.e., “a Graph Type filter”. [0062]: network performance measurements, i.e., “a Unit filter”).
With respect to claim 19,
As discussed in claim 15, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of operating with an Application Programming Interface (API) and a rule-based engine configured to process the natural language for interpreting the search query and to filter the search query according to searchable characteristics of the private database ([0048]: apply extraction rules to filter search results, wherein API is implicitly taught and processing the natural language for interpreting the search query is taught by Prakash as discussed above).
With respect to claim 20,
As discussed in claim 15, Bigdelu and Prakash and Kilinc teach all the limitations therein.
Bigdelu further teaches
the method of claim 15, further comprising the step of displaying an Insights tab, a Logs tab, and a Chat tab in the search request section of the UI, wherein the Insights tab allows the admin to select a general view of web insights in the dashboard section, wherein the Logs tab allows the admin to select a general view of data logs in the dashboard section, and wherein the Chat tab allows the admin to open a query input element in the search request section of the UI (Fig. 17; [0426]: a summary section 1710 displays “a general view of web insights in the dashboard section”, e.g., CPU or memory usage over time, hence, corresponds to the function of "an Insights tab", second log representation 1706 displays “a general view of data logs in the dashboard section”, hence, corresponds to the function of "a Logs tab". Fig. 7A; [0297]: query editor panel 702 “open a query input element in the search request section of the UI” to receive a user query, hence, corresponds to the function of “a Chat tab”. Even though the reference does not explicitly teach invoking each functionality by a different tab, doing so would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention. This is evidenced in the use of different tabs “Search”, “Datasets”, “Report”, “Alerts”, and “Dashboards” in Fig. 17),
Prakash further teaches
the query input element allowing the admin to enter the search query using natural language (Fig. 1; [0049]: the display region 110 includes a search bar 120 that enables a user to enter a string of text by typing or a voice icon portion (not shown in FIG. 1) of the search bar 120 that enables a user to enter the text of string by speaking, i.e., "enter the search query using natural language").
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to XIAOQIN HU whose telephone number is (571)272-1792. The examiner can normally be reached on Monday-Friday 7:00am-3:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Charles Rones can be reached on (571) 272-4085. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/XIAOQIN HU/Examiner, Art Unit 2168
/CHARLES RONES/Supervisory Patent Examiner, Art Unit 2168
Prosecution Insights