公开(公告)号：US20190317947A1

公开(公告)日：2019-10-17

申请号：US16451582

申请日：2019-06-25

Applicant: SPLUNK, INC.

Inventor： Da Xu ,  Sundar Vasan ,  Dhruva Kumar Bhagi

IPC: G06F16/27 ,  G06F16/22 ,  G06F11/30 ,  G06F11/20 ,  G06F11/34 ,  H04L29/08 ,  G06F11/32

Abstract: Techniques and mechanisms are disclosed to execute data searches using generation identifiers. In general, a method of executing the searches comprises broadcasting, from a search head, a first query to a plurality of indexers in a cluster, wherein a portion of the first query is directed to a set of data, and wherein the set of data comprises time-stamps within a particular time frame. The method further comprises providing, with the first query, a first generation identifier for the set of data, wherein the first generation identifier identifies a first indexer from the plurality of indexers to serve as a primary indexer for responding to queries that comprise the first generation identifier and that pertain to the set of data, wherein one or more indexers in the cluster other than the first indexer are designated as secondary indexers, wherein the secondary indexers are configured to ignore queries that pertain to the set of data and that comprise the first generation identifier. Subsequently, the method comprises receiving a response to the first query from the plurality of indexers.

公开(公告)号：US10133806B2

公开(公告)日：2018-11-20

申请号：US14449069

申请日：2014-07-31

Applicant: Splunk Inc.

Inventor： Anirban Rahut ,  Sundar Vasan

IPC: G06G7/00 ,  G06F17/30

Abstract: Systems and methods for search result replication in a search head cluster of a data aggregation and analysis system. An example method may comprise maintaining a replication count corresponding to how many replicas of a result of a particular map-reduce search exist in a search head cluster comprising a plurality of search heads that are each configured to enable them to manage a reduce phase of a map-reduce search, determining that the replication count is less than a target replication count, selecting, based the determining, a target search head from the search head cluster to receive a replica of the search result, initiating a replication of the search result from a source search head in the search head cluster to the selected target search head, receiving an indication that the replication is complete, and based on receiving the indication, increasing the replication count corresponding to the search result.

公开(公告)号：US20160246495A1

公开(公告)日：2016-08-25

申请号：US15143582

申请日：2016-04-30

Applicant: Splunk Inc.

Inventor： Alice Neels ,  Sundar Vasan ,  Simon Fishel ,  Marc Robichaud ,  Divanny Lamas

IPC: G06F3/0484 ,  G06F3/0482

CPC classification number: G06F16/338 ,  G06F3/0482 ,  G06F3/04842 ,  G06F3/04847 ,  G06F16/24575 ,  G06F16/2477 ,  G06F16/248 ,  G06F16/26 ,  G06F16/334 ,  G06F16/335 ,  G06F16/345 ,  G06F16/9024 ,  G06F16/9535 ,  G06F17/24 ,  G06T11/206 ,  G06T2200/24

Abstract: The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

Abstract translation: 本公开涉及用于从非结构化数据生成报告的某些系统和方法实施例。 在一个实施例中，一种方法可以包括识别匹配初始搜索查询的标准的事件（每个事件包括与时间相关联的原始机器数据的一部分），标识一组字段，每个字段被定义为一个或多个 识别的事件，导致显示包括一个或多个交互元件的交互式图形用户界面（GUI），使得用户能够定义用于提供与匹配事件有关的信息的报告（每个交互元件能够处理或呈现在 通过GUI接收指示如何报告与匹配事件有关的信息的报告定义，以及基于报告定义生成包括与所述事件相关的信息的报告的报告 匹配事件。

公开(公告)号：US20160217599A1

公开(公告)日：2016-07-28

申请号：US15007182

申请日：2016-01-26

Applicant: Splunk Inc.

Inventor： Alice Neels ,  Sundar Vasan ,  Simon Fishel ,  Marc Robichaud ,  Divanny Lamas

IPC: G06T11/20 ,  G06F3/0482 ,  G06F3/0484 ,  G06F17/30

CPC classification number: G06F16/338 ,  G06F3/0482 ,  G06F3/04842 ,  G06F3/04847 ,  G06F16/24575 ,  G06F16/2477 ,  G06F16/248 ,  G06F16/26 ,  G06F16/334 ,  G06F16/335 ,  G06F16/345 ,  G06F16/9024 ,  G06F16/9535 ,  G06F17/24 ,  G06T11/206 ,  G06T2200/24

Abstract: The disclosure relates to certain system and method embodiments for generating reports from unstructured data. In one embodiment, a method can include identifying events matching criteria of an initial search query (each of the events including a portion of raw machine data that is associated with a time), identifying a set of fields, each field defined for one or more of the identified events, causing display of an interactive graphical user interface (GUI) that includes one or more interactive elements enabling a user to define a report for providing information relating to the matching events (each interactive element enabling processing or presentation of information in the matching events using one or more fields in the identified set of fields), receiving, via the GUI, a report definition indicating how to report information relating to the matching events, and generating, based on the report definition, a report including information relating to the matching events.

Abstract translation: 本公开涉及用于从非结构化数据生成报告的某些系统和方法实施例。 在一个实施例中，一种方法可以包括识别匹配初始搜索查询的标准的事件（每个事件包括与时间相关联的原始机器数据的一部分），标识一组字段，每个字段被定义为一个或多个 识别的事件，导致显示包括一个或多个交互元件的交互式图形用户界面（GUI），使得用户能够定义用于提供与匹配事件有关的信息的报告（每个交互元件能够处理或呈现在 通过GUI接收指示如何报告与匹配事件有关的信息的报告定义，以及基于报告定义生成包括与所述事件相关的信息的报告的报告 匹配事件。