Invention Grant
- Patent Title: Optimizing search of an accelerated data model by enabling emitting of structured and unstructured fields from the data model
-
Application No.: US16527719Application Date: 2019-07-31
-
Publication No.: US11429608B2Publication Date: 2022-08-30
- Inventor: Karthikeyan Sabhanatarajan , David Ryan Marquardt , Steve Zhang , Nicholas Romito , Sophia Zhu
- Applicant: Splunk Inc.
- Applicant Address: US CA San Francisco
- Assignee: Splunk Inc.
- Current Assignee: Splunk Inc.
- Current Assignee Address: US CA San Francisco
- Main IPC: G06F16/24
- IPC: G06F16/24 ; G06F16/2453 ; G06F16/903

Abstract:
Embodiments of the present disclosure provide techniques for emitting structured and dynamic fields from an accelerated data model. The method comprises evaluating a query to search a data model, wherein the data model is defined by a set of events and at least one structured field from fields associated with the set of events. Each event comprises a time-stamped portion of raw machine data and is stored in a field searchable data store. A summarization table is associated with the data model and comprises a plurality of entries comprising reference values, wherein a respective summarization table entry comprises: the at least one structured field; a respective field value; and a reference value. The method further comprises accessing the set of events from the field searchable data store using the reference values in the summarization table and annotating the set of events with the at least one structured field and with at least one dynamic field from the fields associated with the set of events, wherein the at least one dynamic field is not defined in the data model.
Public/Granted literature
Information query