Reducing index file size based on event attributes

    公开(公告)号:US11138218B2

    公开(公告)日:2021-10-05

    申请号:US16259975

    申请日:2019-01-28

    Applicant: Splunk Inc.

    Abstract: Techniques and mechanisms are disclosed to optimize the size of index files to improve use of storage space available to indexers and other components of a data intake and query system. Index files of a data intake and query system may include, among other data, a keyword portion containing mappings between keywords and location references to event data containing the keywords. Optimizing an amount of storage space used by index files may include removing, modifying and/or recreating various components of index files in response to detecting one or more storage conditions related to the event data indexed by the index files. The optimization of index files generally may attempt to manage a tradeoff between an efficiency with which search requests can be processed using the index files and an amount of storage space occupied by the index files.

    Single point of dispatch for hybrid cloud deployment for indexer clusters

    公开(公告)号:US10579607B2

    公开(公告)日:2020-03-03

    申请号:US15582424

    申请日:2017-04-28

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    Abstract: Embodiments of the present disclosure provide a method for performing search queries. The method comprises transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers and the first search head. The method further comprises receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request. Further, the method comprises evaluating a plurality of policies to determine if the first slot request can be granted and responsive to a positive determination, transmitting an authorization token for a slot to the first search head.

    Managing slot requests for query execution in hybrid cloud deployments

    公开(公告)号:US11809397B1

    公开(公告)日:2023-11-07

    申请号:US17680900

    申请日:2022-02-25

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    CPC classification number: G06F16/2272 G06F16/256

    Abstract: Embodiments of the present disclosure provide a method for performing search queries. The method comprises transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers and the first search head. The method further comprises receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request. Further, the method comprises evaluating a plurality of policies to determine if the first slot request can be granted and responsive to a positive determination, transmitting an authorization token for a slot to the first search head.

    Multi-phased execution of a search query

    公开(公告)号:US11625404B2

    公开(公告)日:2023-04-11

    申请号:US16687158

    申请日:2019-11-18

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments include a method performed by a data intake and query system. The method includes receiving a search query by a search head, defining a search process for applying the search query to indexers, delegating a first portion of the search process to indexers and a second portion of the search process to intermediary node(s) communicatively coupled to the search head and the indexers. The first portion can define a search scope for obtaining partial search results of the indexers and the second portion can define operations for combining the partial search results by the intermediary node(s) to produce a combination of the partial search results. The search head then receives the combination of the partial search results, and outputs final search results for the search query, where the final search results are based on the combination of the partial search results.

Patent Agency Ranking