公开(公告)号：US12038926B1

公开(公告)日：2024-07-16

申请号：US17163220

申请日：2021-01-29

Applicant: SPLUNK INC.

Inventor： Jay A. Pathak ,  Steve Yu Zhang

IPC: G06F16/2455 ,  G06F16/22

CPC classification number: G06F16/2455 ,  G06F16/2228

Abstract: A computer-implemented method of determining indexed fields at query time comprises mapping data from a first source type to indexed fields in batch form using a wildcard specifier. The method also comprises receiving a query to execute on a data set comprising data from the first source type and data from a second source type. Further, the method comprises transforming the query to execute on the data from the first source type separately from the data from the second source type. Additionally, the method comprises executing the query to operate on the data from the first source type using information associated with the indexed fields and to separately operate on the data from the second source type.

公开(公告)号：US11836146B1

公开(公告)日：2023-12-05

申请号：US17163236

申请日：2021-01-29

Applicant: SPLUNK INC.

Inventor： Jay A. Pathak ,  Steve Yu Zhang

IPC: G06F16/20 ,  G06F16/2458 ,  G06F16/22 ,  G06F16/248 ,  G06F16/2457

CPC classification number: G06F16/2477 ,  G06F16/2228 ,  G06F16/248 ,  G06F16/24573

Abstract: A computer-implemented method of determining indexed fields at query time comprises indexing time-stamped events ingested from a plurality of source types. The time-stamped searchable events compare portions of raw data. The method also comprises generating an index containing each keyword in the time-stamped searchable events and an associated location reference of a respective event in which the keyword appears. Further, the method comprises generating a fields metadata file identifying indexed fields in the time-stamped searchable events for each source type. The fields metadata file comprises reference values for accessing indexed fields associated with each source type from the index. The method also comprises accessing the fields metadata file to identify the indexed fields associated with each source type prior to executing a query.