1. An office tool assembly for removable attachment to a user, comprising:
a hanging cap with a top, an open end and a closed end and having a through hole defined in the top of the hanging cap and a transverse hole defined through the closed end for connecting with an attachment means to selectively hang the tool assembly onto the user or an object; and
a tool selectively receivable in the open end of the hanging cap and held in the hanging cap, the tool comprising:
an upper cover with a top and having a protrusion moveably mounted on the top of the upper cover and engaging the through hole in the hanging cap;
a bottom cover connected to the upper cover; and
a main mechanism mounted between the upper cover and the bottom cover.
2. The office tool as claimed in claim 1, wherein the main mechanism is a sharpening mechanism.
3. The office tool as claimed in claim 1 further comprising a biasing member mounted between the upper cover and the protrusion to support the protrusion moveable on the upper cover.
4. The office tool as claimed in claim 3, wherein the upper cover has a recess with a bottom defined in the top of the upper cover;
the protrusion is moveably received in the recess and has a bottom; and
the biasing member is received in the recess and has two ends abutting respectively against the bottoms of the recess and the protrusion.
5. The office tool as claimed in claim 4, wherein the protrusion has two hooks extending from the bottom of the protrusion; and
the upper cover has two holes defined in the bottom of the recess and engaging respectively with the hooks on the protrusion.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1-30. (canceled)
31. A method, comprising:
accessing, by one or more processing devices, a set of events, wherein each event in the set of events is associated with a time stamp and includes a portion of machine data indicative of performance or operation of an information technology environment;
accessing an object-scoring rule that (i) includes a search query that determines when events meet a triggering condition; (ii) identifies an object representing a component of the information technology environment, an application running in the information technology environment, or a person using a component in the information technology environment, and (iii) specifies a numerical contribution to a score for the object, the numerical contribution to be applied to the score based at least on part on a determination that the triggering condition is met;
executing the search query of the object-scoring rule against the set of events to determine if the triggering condition of the object-scoring rule is met;
based on determining that the triggering condition is met, generating a record of the numerical contribution specified in the object-scoring rule, the record associating the numerical contribution with a time indicator and indicating the object whose score should be affected by the contribution;
identifying, using one or more records of numerical contributions, a set of numerical contributions having associated time indicators falling within a defined time period; and
calculating the score for the object based on the set of numerical contributions, wherein the score indicates at least one of: an indication of a security risk posed by the component or person that the object represents, an indication of performance of the component of the information technology environment that the object represents, or an indication of performance of the application that the object represents.
32. The method of claim 31, wherein the portion of machine data in each event comprises raw machine data.
33. (canceled)
34. (canceled)
35. (canceled)
36. The method of claim 31, wherein the object-scoring rule statically identifies the object whose score should be adjusted when the triggering condition is met.
37. The method of claim 31, wherein the object-scoring rule variably identifies the object whose score should be adjusted when the triggering condition is met based on a value for a field in one or more particular events that caused the triggering condition to be met, the value for the field derived by applying an extraction rule or regular expression to the portion of machine data in the one or more particular events.
38. The method of claim 31, wherein the object-scoring rule statically identifies the numerical contribution to be applied to the score of the object.
39. The method of claim 31, wherein the object-scoring rule variably identifies the numerical contribution to be applied to the score of the object based on a value for a field in one or more particular events that caused the triggering condition to be met, the value for the field derived by applying an extraction rule or regular expression to the portion of machine data in the one or more particular events.
40. The method of claim 31, wherein the object-scoring rule variably identifies the numerical contribution to be applied to the score of the object based on a number of particular events that caused the triggering condition to be met.
41. The method of claim 31, wherein the triggering condition includes a value for a field in an event meeting specified criteria.
42. The method of claim 31, wherein the triggering condition includes an aggregate calculated for a field in events in the set of events meeting specified criteria.
43. The method of claim 31, wherein the triggering condition includes determining that a threshold number of events meets specified search criteria.
44. The method of claim 31, further comprising receiving a user request to create a negative score modifier associated with a particular time.
45. The method of claim 31, further comprising receiving a request to adjust the object’s score by a particular positive or negative amount.
46. The method of claim 31, further comprising causing displaying of a graphical interface enabling a user to generate the object-scoring rule.
47. The method of claim 31, wherein events in the set of events are derived from log data.
48. The method of claim 31, wherein events in the set of events are derived from network packet data.
49. (canceled)
50. (canceled)
51. (canceled)
52. (canceled)
53. (canceled)
54. The method of claim 31, further comprising:
causing display of object scores for a plurality of objects.
55. The method of claim 31, further comprising:
causing display of object scores for a plurality of objects in a descending order of score.
56. A computer-readable non-transitory storage medium comprising executable instructions that, when executed by one or more processing devices, cause the processing devices to perform operations comprising:
accessing, by the processing devices, a set of events, wherein each event in the set of events is associated with a time stamp and includes a portion of machine data indicative of performance or operation of an information technology environment;
accessing an object-scoring rule that (i) includes a search query that determines when events meet a triggering condition; (ii) identifies an object representing a component of the information technology environment, an application running in the information technology environment, or a person using a component in the information technology environment, and (iii) specifies a numerical contribution to a score for the object, the numerical contribution to be applied to the score based at least on part on a determination that the triggering condition is met;
executing the search query of the object-scoring rule against the set of events to determine if the triggering condition of the object-scoring rule is met;
based on determining that the triggering condition is met, generating a record of the numerical contribution specified in the object-scoring rule, the record associating the numerical contribution with a time indicator and indicating the object whose score should be affected by the contribution;
identifying, using one or more records of numerical contributions, a set of numerical contributions having associated time indicators falling within a defined time period; and
calculating the score for the object based on the set of numerical contributions, wherein the score indicates at least one of: an indication of a security risk posed by the component or person that the object represents, an indication of performance of the component of the information technology environment that the object represents, or an indication of performance of the application that the object represents.
57. (canceled)
58. The computer-readable non-transitory storage medium of claim 56,
wherein the object-scoring rule variably identifies the object whose score should be adjusted when the triggering condition is met based on a value for a field in one or more particular events that caused the triggering condition to be met, the value for the field derived by applying an extraction rule or regular expression to the portion of machine data in the one or more particular events.
59. A computer system, comprising:
a memory; and
one or more processing devices, coupled to the memory, to:
access a set of events, wherein each event in the set of events is associated with a time stamp and includes a portion of machine data indicative of performance or operation of an information technology environment;
access an object-scoring rule that (i) includes a search query that determines when events meet a triggering condition; (ii) identifies an object representing a component of the information technology environment, an application running in the information technology environment, or a person using a component in the information technology environment, and (iii) specifies a numerical contribution to a score for the object, the numerical contribution to be applied to the score based at least on part on a determination that the triggering condition is met;
execute the search query of the object-scoring rule against the set of events to determine if the triggering condition of the object-scoring rule is met;
based on determining that the triggering condition is met, generate a record of the numerical contribution specified in the object-scoring rule, the record associating the numerical contribution with a time indicator and indicating the object whose score should be affected by the contribution;
identify, using one or more records of numerical contributions, a set of numerical contributions having associated time indicators falling within a defined time period; and
calculate the score for the object based on the set of numerical contributions, wherein the score indicates at least one of: an indication of a security risk posed by the component or person that the object represents, an indication of performance of the component of the information technology environment that the object represents, or an indication of performance of the application that the object represents.
60. The computer system of claim 59, wherein the object-scoring rule variably identifies the object whose score should be adjusted when the triggering condition is met based on a value for a field in one or more particular events that caused the triggering condition to be met, the value for the field derived by applying an extraction rule or regular expression to the portion of machine data in the one or more particular events.
61. The method of claim 31, wherein executing the search query comprises applying a late binding schema to the set of events, and further comprising:
receiving a selection of a second time period;
determining a second set of numerical contributions, wherein each of the numerical contribution in the second set of numerical contributions has an associated time indicator falling within the second time period, wherein the associated time indicator specifies a time of occurrence of the triggering condition; and
adjusting the score for the object based on an aggregation of the numerical contributions of the second set of numerical contributions.
62. The method of claim 31, wherein executing the search query comprises applying a late binding schema to the set of events.
63. The method of claim 31, wherein executing the search query comprises using an extraction rule or regular expression to the portion of machine data in an event to derive a value for a field.
64. The method of claim 31, wherein the time indicator specifies a time of occurrence of the triggering condition.
65. The method of claim 31, wherein the numerical contribution is proportional to a number of occurrences of the triggering condition.
66. The method of claim 31, wherein the numerical contribution is proportional to a metric associated with a certain activity of the component, the person or the application represented by the object.
67. The method of claim 31, further comprising: sending a message comprising the score for the object.
68. The method of claim 31, further comprising: executing a shell script having a parameter defined based on the score for the object.
69. The method of claim 31, further comprising: causing display of at least a portion of the machine data that triggered the object-scoring rule.