Multi-site clustering
    1.
    发明授权
    Multi-site clustering 有权
    多站点集群

    公开(公告)号:US09124612B2

    公开(公告)日:2015-09-01

    申请号:US14266817

    申请日:2014-04-30

    申请人: Splunk Inc.

    IPC分类号: G06F17/30 H04L29/08 G06F11/20

    摘要: According to various embodiments, techniques are described for managing data within a multi-site clustered data intake and query system. A data intake and query system as described herein generally refers to a system for collecting, retrieving, and analyzing data. In this context, a clustered data intake and query system generally refers to a system environment that is configured to provide data redundancy and other features that improve the availability of data stored by the system. For example, a clustered data intake and query system may be configured to store multiple copies of data stored by the system across multiple components such that recovery from a failure of one or more of the components is possible by using copies of the data stored elsewhere in the cluster.

    摘要翻译: 根据各种实施例,描述了用于管理多站点群集数据访问和查询系统内的数据的技术。 本文所述的数据采集和查询系统通常是指用于收集,检索和分析数据的系统。 在这种情况下,集群数据采集和查询系统通常是指被配置为提供数据冗余和提高系统存储的数据的可用性的其他特征的系统环境。 例如,集群数据采集和查询系统可以被配置为存储由多个组件存储的系统的多个副本,以便可以通过使用其他地方存储的数据的副本来从一个或多个组件的故障中恢复 集群。

    Replication of summary data in a clustered computing environment

    公开(公告)号:US10387448B2

    公开(公告)日:2019-08-20

    申请号:US14929089

    申请日:2015-10-30

    申请人: Splunk Inc.

    摘要: Techniques and mechanisms are disclosed to increase the availability of summary data within a clustered data intake and query system by replicating the summary data within the cluster. In general, summary data may store “pre-computed” results for one or more search queries and can be used by indexers of a cluster to process subsequent instances of the same search queries. At a high level, replication of summary data within a cluster may include ensuring that each instance of summary data created by an indexer of a cluster is replicated to other indexers within the cluster that store copies of the same grouped subset(s) of data to which the summary data relates. In this manner, if one or more indexers of an indexer cluster fail, other indexers of the cluster can make immediate use of replicated copies of the summary data without re-creating it.

    DISASTER RECOVERY IN A CLUSTERED ENVIRONMENT USING GENERATION IDENTIFIERS

    公开(公告)号:US20210279251A1

    公开(公告)日:2021-09-09

    申请号:US17228429

    申请日:2021-04-12

    申请人: SPLUNK, INC.

    摘要: A method for performing disaster recovery in a clustered environment comprises identifying, at a master device, a first indexer from a set of indexers to serve as a primary indexer for responding to queries pertaining to a subset of data. The method also comprises assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the subset of data. Responsive to an event prompting a change in a primary indexer designation for the subset of data, the method comprises identifying, at the master device, a second indexer from the set of indexers to serve as the primary indexer for responding to queries pertaining to the subset of data. Further, the method comprises assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the subset of data.

    REPLICATION OF SUMMARY DATA IN A CLUSTERED COMPUTING ENVIRONMENT
    5.
    发明申请
    REPLICATION OF SUMMARY DATA IN A CLUSTERED COMPUTING ENVIRONMENT 审中-公开
    集群计算环境中的摘要数据的复制

    公开(公告)号:US20160055225A1

    公开(公告)日:2016-02-25

    申请号:US14929089

    申请日:2015-10-30

    申请人: Splunk Inc.

    IPC分类号: G06F17/30

    摘要: Techniques and mechanisms are disclosed to increase the availability of summary data within a clustered data intake and query system by replicating the summary data within the cluster. In general, summary data may store “pre-computed” results for one or more search queries and can be used by indexers of a cluster to process subsequent instances of the same search queries. At a high level, replication of summary data within a cluster may include ensuring that each instance of summary data created by an indexer of a cluster is replicated to other indexers within the cluster that store copies of the same grouped subset(s) of data to which the summary data relates. In this manner, if one or more indexers of an indexer cluster fail, other indexers of the cluster can make immediate use of replicated copies of the summary data without re-creating it.

    摘要翻译: 公开了技术和机制,以通过复制集群内的摘要数据来增加集群数据采集和查询系统内的摘要数据的可用性。 通常,摘要数据可以存储一个或多个搜索查询的“预先计算的”结果,并且可以由群集的索引器使用来处理相同搜索查询的后续实例。 在高级别中,集群内的摘要数据的复制可以包括确保由集群的索引器创建的每个概要数据实例被复制到集群内的其他索引器,其将相同的分组数据子集的副本存储到 摘要数据与之相关。 以这种方式,如果索引器集群的一个或多个索引器失败,集群的其他索引器可以立即使用摘要数据的复制副本,而无需重新创建。

    MANAGING SITE-BASED SEARCH CONFIGURATION DATA
    6.
    发明申请
    MANAGING SITE-BASED SEARCH CONFIGURATION DATA 有权
    管理基于站点的搜索配置数据

    公开(公告)号:US20150339308A1

    公开(公告)日:2015-11-26

    申请号:US14815880

    申请日:2015-07-31

    申请人: Splunk Inc.

    IPC分类号: G06F17/30

    摘要: Techniques are described for managing data within a multi-site clustered data intake and query system. A data intake and query system as described herein generally refers to a system for collecting, retrieving, and analyzing data. In this context, a clustered data intake and query system generally refers to a system environment that is configured to provide data redundancy and other features that improve the availability of data stored by the system. For example, a clustered data intake and query system may be configured to store multiple copies of data stored by the system across multiple components such that recovery from a failure of one or more of the components is possible by using copies of the data stored elsewhere in the cluster.

    摘要翻译: 描述了用于管理多站点群集数据采集和查询系统中的数据的技术。 本文所述的数据采集和查询系统通常是指用于收集,检索和分析数据的系统。 在这种情况下,集群数据采集和查询系统通常是指被配置为提供数据冗余和提高系统存储的数据的可用性的其他特征的系统环境。 例如,集群数据采集和查询系统可以被配置为存储由多个组件存储的系统的多个副本,以便可以通过使用其他地方存储的数据的副本来从一个或多个组件的故障中恢复 集群。

    Executing data searches using generation identifiers

    公开(公告)号:US11003687B2

    公开(公告)日:2021-05-11

    申请号:US16451582

    申请日:2019-06-25

    申请人: SPLUNK, INC.

    摘要: Techniques and mechanisms are disclosed to execute data searches using generation identifiers. In general, a method of executing the searches comprises broadcasting, from a search head, a first query to a plurality of indexers in a cluster, wherein a portion of the first query is directed to a set of data, and wherein the set of data comprises time-stamps within a particular time frame. The method further comprises providing, with the first query, a first generation identifier for the set of data, wherein the first generation identifier identifies a first indexer from the plurality of indexers to serve as a primary indexer for responding to queries that comprise the first generation identifier and that pertain to the set of data, wherein one or more indexers in the cluster other than the first indexer are designated as secondary indexers, wherein the secondary indexers are configured to ignore queries that pertain to the set of data and that comprise the first generation identifier. Subsequently, the method comprises receiving a response to the first query from the plurality of indexers.

    EXECUTING DATA SEARCHES USING GENERATION IDENTIFIERS

    公开(公告)号:US20190317947A1

    公开(公告)日:2019-10-17

    申请号:US16451582

    申请日:2019-06-25

    申请人: SPLUNK, INC.

    摘要: Techniques and mechanisms are disclosed to execute data searches using generation identifiers. In general, a method of executing the searches comprises broadcasting, from a search head, a first query to a plurality of indexers in a cluster, wherein a portion of the first query is directed to a set of data, and wherein the set of data comprises time-stamps within a particular time frame. The method further comprises providing, with the first query, a first generation identifier for the set of data, wherein the first generation identifier identifies a first indexer from the plurality of indexers to serve as a primary indexer for responding to queries that comprise the first generation identifier and that pertain to the set of data, wherein one or more indexers in the cluster other than the first indexer are designated as secondary indexers, wherein the secondary indexers are configured to ignore queries that pertain to the set of data and that comprise the first generation identifier. Subsequently, the method comprises receiving a response to the first query from the plurality of indexers.