公开(公告)号：US20200167349A1

公开(公告)日：2020-05-28

申请号：US16777592

申请日：2020-01-30

Applicant: Splunk Inc.

Inventor： David Ryan Marquardt ,  Hailun Yan ,  Christopher Pride ,  Vishal Patel

IPC: G06F16/248 ,  H04L29/08 ,  G06T11/20 ,  G06F3/0481 ,  G06F16/903 ,  G06F16/2455 ,  G06F16/9535 ,  G06F16/9038 ,  G06F16/835 ,  G06F16/2458 ,  G06F16/242 ,  G06F16/22 ,  G06F16/951 ,  G06F16/901 ,  G06F16/28 ,  G06F16/25

Abstract: The disclosed embodiments include a method performed by a data intake and query system to store and query metrics data. The method includes ingesting metrics, where each metric includes key values and numerical value indicative of a measured characteristic of a computing resource. The method further includes populating a first portion of a metric-series index (msidx) file with the key values and a second portion of the msidx file with numerical values indicative of a measured characteristic, where the first portion is distinct from the second portion. The method further includes receiving a query including criteria, evaluating the query by applying the criteria to the first portion of the msidx file to obtain query results indicative of metrics that satisfy the criteria, and displaying, on a display device, the query results or data indicative of the query results.

公开(公告)号：US20190303373A1

公开(公告)日：2019-10-03

申请号：US16444593

申请日：2019-06-18

Applicant: SPLUNK, INC.

Inventor： Vishal Patel ,  Mitchell Neuman Blank, JR. ,  Sundar Renegarajan Vasan ,  Stephen Phillip Sorkin

IPC: G06F16/2457 ,  G06F16/9537 ,  G06F16/9535 ,  G06F16/22 ,  G06F16/27 ,  G06F16/29 ,  G06F11/20 ,  H04L29/08

Abstract: Embodiments are directed towards managing within a cluster environment having a plurality of indexers for data storage using redundancy the data being managed using a generation identifier, such that a primary indexer is designated for a given generation of data. When a master device for the cluster fails, data may continue to be stored using redundancy, and data searches performed may still be performed.

公开(公告)号：US20190213206A1

公开(公告)日：2019-07-11

申请号：US16353886

申请日：2019-03-14

Applicant: Splunk Inc

Inventor： Vishal Patel ,  Jagannath Kerai ,  Hasan Alayli

IPC: G06F16/31 ,  G06F16/17

CPC classification number: G06F16/328 ,  G06F16/1734

Abstract: The present invention is related to a method for providing dynamic indexer discovery. The method comprises receiving, from an index manager, a status indication associated with a plurality of indexers, wherein each of the plurality of indexers indexes events of raw machine-generated data received from a plurality of data collectors. The method further comprises determining a weight associated with each of the plurality of indexers and selecting an indexer from the plurality of indexers. Subsequently, the method comprises allocating data to the indexer in accordance with a respective weight assigned to the indexer and transmitting the allocated data to the indexer.

公开(公告)号：US20180089286A1

公开(公告)日：2018-03-29

申请号：US15339863

申请日：2016-10-31

Applicant: Splunk Inc.

Inventor： David Ryan Marquardt ,  Hailun Yan ,  Christopher Pride ,  Vishal Patel

IPC: G06F17/30

CPC classification number: G06F16/248 ,  G06F3/0481 ,  G06F16/22 ,  G06F16/2228 ,  G06F16/2255 ,  G06F16/2425 ,  G06F16/2455 ,  G06F16/24568 ,  G06F16/2462 ,  G06F16/2477 ,  G06F16/25 ,  G06F16/285 ,  G06F16/8373 ,  G06F16/901 ,  G06F16/90335 ,  G06F16/9038 ,  G06F16/951 ,  G06F16/9535 ,  G06T11/206 ,  G06T2200/24 ,  H04L43/08 ,  H04L67/02 ,  H04L67/025

Abstract: The disclosed embodiments include a method performed by a data intake and query system to store and query metrics data. The method includes ingesting metrics, where each metric includes key values and numerical value indicative of a measured characteristic of a computing resource. The method further includes populating a first portion of a metric-series index (msidx) file with the key values and a second portion of the msidx file with numerical values indicative of a measured characteristic, where the first portion is distinct from the second portion. The method further includes receiving a query including criteria, evaluating the query by applying the criteria to the first portion of the msidx file to obtain query results indicative of metrics that satisfy the criteria, and displaying, on a display device, the query results or data indicative of the query results.

公开(公告)号：US20180089272A1

公开(公告)日：2018-03-29

申请号：US15339889

申请日：2016-10-31

Applicant: Splunk Inc.

Inventor： Amrittpal Singh Bath ,  Pratiksha Shah ,  Murugan Kandaswamy ,  Vishal Patel

IPC: G06F17/30

CPC classification number: G06F16/248 ,  G06F3/0481 ,  G06F16/22 ,  G06F16/2228 ,  G06F16/2255 ,  G06F16/2425 ,  G06F16/2455 ,  G06F16/24568 ,  G06F16/2462 ,  G06F16/2477 ,  G06F16/25 ,  G06F16/285 ,  G06F16/8373 ,  G06F16/901 ,  G06F16/90335 ,  G06F16/9038 ,  G06F16/951 ,  G06F16/9535 ,  G06T11/206 ,  G06T2200/24 ,  H04L43/08 ,  H04L67/02 ,  H04L67/025

Abstract: The disclosed embodiments include a method performed by a data intake and query system. The method includes ingesting data including raw data obtained over a computer network from a plurality of remote computer systems, and generating events, where each event includes a segment of the raw data and a respective timestamp. The method further includes extracting field values from at least a portion of the raw data of the events, where the field values each include a numerical value, and each numerical value is indicative of a measured characteristic of a computing device. The method further includes generating structured metrics, where each structured metric has a respective numerical value, and indexing the plurality of structured metrics.

公开(公告)号：US20170344576A1

公开(公告)日：2017-11-30

申请号：US15663652

申请日：2017-07-28

Applicant: Splunk Inc.

Inventor： Amritpal Singh Bath ,  Mitchell Neuman Blank, JR. ,  Vishal Patel ,  Stephen Phillip Sorkin

IPC: G06F17/30

CPC classification number: G06F16/1734 ,  G06F16/174 ,  G06F16/20

Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.

公开(公告)号：US20160335284A1

公开(公告)日：2016-11-17

申请号：US15224649

申请日：2016-07-31

Applicant: Splunk Inc.

Inventor： Amritpal Singh Bath ,  Mitchell Neuman Blank ,  Vishal Patel ,  Stephen Phillip Sorkin

IPC: G06F17/30

CPC classification number: G06F17/30144 ,  G06F17/3015 ,  G06F17/30286

Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.

Abstract translation: 实施例涉及管理和跟踪多个项目的项目识别以确定项目是否是新的或现有的项目，其中已经预先处理了现有项目。 在一些实施例中，可以生成两个或多个项目标识符。 在一个实施例中，生成两个或多个项目标识符可以包括使用小项目尺寸特征，压缩项目或标识符冲突来分析项目。 可以使用两个或更多个项目标识符来确定该项目是新的还是现有的项目。 在一个实施例中，两个或多个项目标识符可以与关于现有项目的记录进行比较，以确定该项目是新项目还是现有项目。 如果项目是现有项目，则可以进一步处理该项目以确定现有项目是否已经实际改变。

公开(公告)号：US09430488B2

公开(公告)日：2016-08-30

申请号：US14611156

申请日：2015-01-30

Applicant: Splunk Inc.

Inventor： Amritpal Singh Bath ,  Mitchell Neuman Blank ,  Vishal Patel ,  Stephen Phillip Sorkin

IPC: G06F17/30

CPC classification number: G06F17/30144 ,  G06F17/3015 ,  G06F17/30286

Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.

Abstract translation: 实施例涉及管理和跟踪多个项目的项目识别以确定项目是否是新的或现有的项目，其中已经预先处理了现有项目。 在一些实施例中，可以生成两个或多个项目标识符。 在一个实施例中，生成两个或多个项目标识符可以包括使用小项目尺寸特征，压缩项目或标识符冲突来分析项目。 可以使用两个或更多个项目标识符来确定该项目是新的还是现有的项目。 在一个实施例中，两个或多个项目标识符可以与关于现有项目的记录进行比较，以确定该项目是新项目还是现有项目。 如果项目是现有项目，则可以进一步处理该项目以确定现有项目是否已经实际改变。

公开(公告)号：US20140136488A1

公开(公告)日：2014-05-15

申请号：US14014059

申请日：2013-08-29

Applicant: Splunk Inc.

Inventor： Amritpal Singh Bath ,  Mitchell Neuman Blank ,  Vishal Patel ,  Stephen Phillip Sorkin

IPC: G06F17/30

CPC classification number: G06F17/30289 ,  G06F17/30144

Abstract: Embodiments are directed towards a dynamic change evaluation mechanism, whereby items having a detected possible change are scheduled for re-evaluation for possible changes at a higher frequency than items detected to not have previously changed, while those items detected as not to have changed are dynamically scheduled for re-evaluation based on an evaluation backlog that may be in turn based, in part, on a time from when an item is assigned an expiration time to when the item is evaluated. In one embodiment, a possibly changed item may be assigned a new expiration time independent of the evaluation backlog. In another embodiment, if no change is detected, then the item may be assigned a new expiration time as a function of a previous expiration time and on the evaluation backlog.

Abstract translation: 实施例针对动态变化评估机制，由此调度具有检测到的可能变化的项目，以便以比检测到的未被改变的项目更高的频率重新评估可能的改变，而被检测为未改变的那些项目是动态的 计划根据评估积压进行重新评估，该评估积压部分可以部分地基于从物品被分配到期时间到评估物品的时间。 在一个实施例中，可以为可能改变的项目分配与评估积压无关的新的期满时间。 在另一个实施例中，如果没有检测到改变，则可以将该项目分配为作为先前的到期时间的函数的新的期满时间，以及评估积压。

公开(公告)号：US20140025655A1

公开(公告)日：2014-01-23

申请号：US14034220

申请日：2013-09-23

Applicant: Splunk Inc.

Inventor： Amritpal Singh Bath ,  Mitchell Neuman Blank, Jr. ,  Vishal Patel ,  Stephen Phillip Sorkin

IPC: G06F17/30

CPC classification number: G06F17/30144 ,  G06F17/3015 ,  G06F17/30286

Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.

Abstract translation: 实施例涉及管理和跟踪多个项目的项目识别以确定项目是否是新的或现有的项目，其中已经预先处理了现有项目。 在一些实施例中，可以生成两个或多个项目标识符。 在一个实施例中，生成两个或多个项目标识符可以包括使用小项目尺寸特征，压缩项目或标识符冲突来分析项目。 可以使用两个或更多个项目标识符来确定该项目是新的还是现有的项目。 在一个实施例中，两个或多个项目标识符可以与关于现有项目的记录进行比较，以确定该项目是新项目还是现有项目。 如果项目是现有项目，则可以进一步处理该项目以确定现有项目是否已经实际改变。