PRIORITY-BASED PROCESSING OF MESSAGES FROM MULTIPLE SERVERS

    公开(公告)号:US20180007180A1

    公开(公告)日:2018-01-04

    申请号:US15703209

    申请日:2017-09-13

    Applicant: Splunk Inc.

    Abstract: Systems and methods for priority-based processing of messages received from multiple servers. An example method comprises: receiving a plurality of network packets from one or more servers; processing the plurality of network packets to produce a first message associated with a first timestamp and a second message associated with a second timestamp; writing the first message to a first message queue of a plurality of message queues; writing the second message to a second message queue of the plurality of message queues; and retrieving, from the plurality of message queues, the first message and the second message in an order of their respective associated timestamps.

    Supporting query languages through distributed execution of query engines

    公开(公告)号:US12118009B2

    公开(公告)日:2024-10-15

    申请号:US16657916

    申请日:2019-10-18

    Applicant: Splunk Inc.

    CPC classification number: G06F16/2471 G06F16/24526

    Abstract: Systems and methods are described for distributed processing a query in a first query language utilizing a query execution engine intended for single-device execution. While distributed processing provides numerous benefits over single-device processing, distributed query execution engines can be significantly more difficult to develop that single-device engines. Embodiments of this disclosure enable the use of a single-device engine to support distributed processing, by dividing a query into multiple stages, each of which can be executed by multiple, concurrent executions of a single-device engine. Between stages, data can be shuffled between executions of the engine, such that individual executions of the engine are provided with a complete set of records needed to implement an individual stage. Because single-device engines can be significantly less difficult to develop, use of the techniques described herein can enable a distributed system to rapidly support multiple query languages.

    Multi-phased execution of a search query

    公开(公告)号:US11625404B2

    公开(公告)日:2023-04-11

    申请号:US16687158

    申请日:2019-11-18

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments include a method performed by a data intake and query system. The method includes receiving a search query by a search head, defining a search process for applying the search query to indexers, delegating a first portion of the search process to indexers and a second portion of the search process to intermediary node(s) communicatively coupled to the search head and the indexers. The first portion can define a search scope for obtaining partial search results of the indexers and the second portion can define operations for combining the partial search results by the intermediary node(s) to produce a combination of the partial search results. The search head then receives the combination of the partial search results, and outputs final search results for the search query, where the final search results are based on the combination of the partial search results.

Patent Agency Ranking