SINGLE POINT OF DISPATCH FOR HYBRID CLOUD DEPLOYMENT FOR INDEXER CLUSTERS

    公开(公告)号:US20180314731A1

    公开(公告)日:2018-11-01

    申请号:US15582424

    申请日:2017-04-28

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    CPC classification number: G06F16/2272 G06F16/256

    Abstract: Embodiments of the present disclosure provide a method for performing search queries. The method comprises transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers and the first search head. The method further comprises receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request. Further, the method comprises evaluating a plurality of policies to determine if the first slot request can be granted and responsive to a positive determination, transmitting an authorization token for a slot to the first search head.

    MULTI-PHASED DATA EXECUTION IN A DATA PROCESSING SYSTEM

    公开(公告)号:US20180218045A1

    公开(公告)日:2018-08-02

    申请号:US15419883

    申请日:2017-01-30

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments include a method performed by a data intake and query system. The method includes receiving a search query by a search head, defining a search process for applying the search query to indexers, delegating a first portion of the search process to indexers and a second portion of the search process to intermediary node(s) communicatively coupled to the search head and the indexers. The first portion can define a search scope for obtaining partial search results of the indexers and the second portion can define operations for combining the partial search results by the intermediary node(s) to produce a combination of the partial search results. The search head then receives the combination of the partial search results, and outputs final search results for the search query, where the final search results are based on the combination of the partial search results.

    Multi-phased execution of a search query

    公开(公告)号:US12072891B1

    公开(公告)日:2024-08-27

    申请号:US18180728

    申请日:2023-03-08

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments include a method performed by a data intake and query system. The method includes receiving a search query by a search head, defining a search process for applying the search query to indexers, delegating a first portion of the search process to indexers and a second portion of the search process to intermediary node(s) communicatively coupled to the search head and the indexers. The first portion can define a search scope for obtaining partial search results of the indexers and the second portion can define operations for combining the partial search results by the intermediary node(s) to produce a combination of the partial search results. The search head then receives the combination of the partial search results, and outputs final search results for the search query, where the final search results are based on the combination of the partial search results.

    MANAGEMENT OF QUERIES IN A HYBRID CLOUD DEPLOYMENT OF A QUERY SYSTEM

    公开(公告)号:US20200250180A1

    公开(公告)日:2020-08-06

    申请号:US16853974

    申请日:2020-04-21

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    Abstract: Embodiments of the present disclosure provide a method for performing search queries in a manner that avoids overloading an indexer cluster or indexers with an unwanted or unauthorized high levels of concurrent searches. The method comprises transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers. The method further comprises receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master. Responsive to a grant of a slot by the cluster master, the method comprises using the addresses to transmit the query to the active indexers and receiving results of the query from the active indexers. Subsequently, the method comprises releasing the slot to the cluster master.

    SINGLE POINT OF DISPATCH FOR MANAGEMENT OF SEARCH HEADS IN A HYBRID CLOUD DEPLOYMENT OF A QUERY SYSTEM

    公开(公告)号:US20180314744A1

    公开(公告)日:2018-11-01

    申请号:US15582372

    申请日:2017-04-28

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    Abstract: Embodiments of the present disclosure provide a method for performing search queries in a manner that avoids overloading an indexer cluster or indexers with an unwanted or unauthorized high levels of concurrent searches. The method comprises transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers. The method further comprises receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master. Responsive to a grant of a slot by the cluster master, the method comprises using the addresses to transmit the query to the active indexers and receiving results of the query from the active indexers. Subsequently, the method comprises releasing the slot to the cluster master.

    Reducing index file size based on event attributes

    公开(公告)号:US11934418B2

    公开(公告)日:2024-03-19

    申请号:US17447620

    申请日:2021-09-14

    Applicant: Splunk Inc.

    CPC classification number: G06F16/248 G06F16/2228 G06F16/285 G06F16/21

    Abstract: Techniques and mechanisms are disclosed to optimize the size of index files to improve use of storage space available to indexers and other components of a data intake and query system. Index files of a data intake and query system may include, among other data, a keyword portion containing mappings between keywords and location references to event data containing the keywords. Optimizing an amount of storage space used by index files may include removing, modifying and/or recreating various components of index files in response to detecting one or more storage conditions related to the event data indexed by the index files. The optimization of index files generally may attempt to manage a tradeoff between an efficiency with which search requests can be processed using the index files and an amount of storage space occupied by the index files.

Patent Agency Ranking