公开(公告)号：US11269808B1

公开(公告)日：2022-03-08

申请号：US16717961

申请日：2019-12-17

Applicant: SPLUNK INC.

Inventor： Hong Yuan ,  Alexander Binkin ,  Zi Liang Chen ,  Bradford Lovering ,  Dinesh Sharma

IPC: G06F16/14 ,  G06F16/16 ,  G06F16/172 ,  H04L29/08 ,  G06F16/174 ,  H04L67/02

Abstract: A computerized method is disclosed. Operations of the method include obtaining, by a data retrieval component, the data from a remote electronic device, storing a copy of the data in a first data store, providing an acknowledgement to the remote electronic device based on storage of the copy of the data in the first data store, parsing the data into one or more time-based events, storing the one or more time-based events in a second data store, and deleting the copy of at least the portion of the data from the first data store.

公开(公告)号：US11977523B1

公开(公告)日：2024-05-07

申请号：US16859203

申请日：2020-04-27

Applicant: SPLUNK INC.

Inventor： Li Li ,  Zi Liang Chen ,  Gang Tao ,  Dinesh Sharma ,  Alex Cain

IPC: G06F16/21

CPC classification number: G06F16/211

Abstract: Embodiments of the present invention are directed to facilitating performing data extraction via efficient extraction rule matching. Generally, an extraction rule can be determined to match an event based on a two-step process. In particular, initially, a determination that a set of fixed substrings associated with the extraction rule matches fixed substrings of the event can be made. Based on fixed substring match, a determination can be made that a set of fields associated with the extraction rule matches fields of the event. In such a case, the extraction rule can be deemed to match the event and used to extract values from the event.

公开(公告)号：US11755531B1

公开(公告)日：2023-09-12

申请号：US17584114

申请日：2022-01-25

Applicant: Splunk Inc.

Inventor： Hong Yuan ,  Alexander Binkin ,  Zi Liang Chen ,  Bradford Lovering ,  Dinesh Sharma

IPC: G06F16/14 ,  G06F16/174 ,  H04L67/02 ,  G06F16/172 ,  G06F16/16

CPC classification number: G06F16/148 ,  G06F16/164 ,  G06F16/172 ,  G06F16/174 ,  H04L67/02

Abstract: A computerized method is disclosed for storing data using a persistent queue. The computerized method includes operations of obtaining machine data from a remote electronic device, providing the machine data to a persistent queue component, wherein the persistent queue component organizes the machine data for storage on a first data store and storing a copy of the organized machine data in the first data store, and responsive to completion of the storing of the copy of the organized machine data. Further operations include transmitting an acknowledgement communication to the remote electronic device indicating storage of the copy of the machine data in the first data store, processing the machine data for storage, and responsive to completion of the storing of the processed machine data in a second data store, deleting the copy of the machine data from the first data store. The persistent queue component may include a socket server.