Management of queries in a hybrid cloud deployment of a query system

    公开(公告)号:US11455314B2

    公开(公告)日:2022-09-27

    申请号:US16853974

    申请日:2020-04-21

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    Abstract: Embodiments of the present disclosure provide a method for performing search queries in a manner that avoids overloading an indexer cluster or indexers with an unwanted or unauthorized high levels of concurrent searches. The method comprises transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers. The method further comprises receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master. Responsive to a grant of a slot by the cluster master, the method comprises using the addresses to transmit the query to the active indexers and receiving results of the query from the active indexers. Subsequently, the method comprises releasing the slot to the cluster master.

    Query management for indexer clusters in hybrid cloud deployments

    公开(公告)号:US11308061B2

    公开(公告)日:2022-04-19

    申请号:US16717956

    申请日:2019-12-17

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    Abstract: Embodiments of the present disclosure provide a method for performing search queries. The method comprises transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers and the first search head. The method further comprises receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request. Further, the method comprises evaluating a plurality of policies to determine if the first slot request can be granted and responsive to a positive determination, transmitting an authorization token for a slot to the first search head.

    Dynamically assigning a search head and search nodes for a query

    公开(公告)号:US11157497B1

    公开(公告)日:2021-10-26

    申请号:US16513555

    申请日:2019-07-16

    Applicant: Splunk Inc.

    Abstract: Systems and methods are disclosed for dynamically assigning a search head or search nodes in a data intake and query system for a query received by the data intake and query system. Existing search heads and search nodes can periodically report their status to the data intake and query system, which can use that information to help determine the need to provision additional search heads and search nodes. The data intake and query system can receive a query identifying a set of data to be processed and a manner of processing the set of data. The data intake and query system can use the status information for existing search heads and search nodes to dynamically assign a search head and search nodes for the query. Dynamically assigning the search head and search nodes in this manner may provide many benefits, including improved load balancing and resource utilization.

    Single point of dispatch for management of search heads in a hybrid cloud deployment of a query system

    公开(公告)号:US10678803B2

    公开(公告)日:2020-06-09

    申请号:US15582372

    申请日:2017-04-28

    Applicant: Splunk Inc.

    Inventor: Ashish Mathew

    Abstract: Embodiments of the present disclosure provide a method for performing search queries in a manner that avoids overloading an indexer cluster or indexers with an unwanted or unauthorized high levels of concurrent searches. The method comprises transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers. The method further comprises receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master. Responsive to a grant of a slot by the cluster master, the method comprises using the addresses to transmit the query to the active indexers and receiving results of the query from the active indexers. Subsequently, the method comprises releasing the slot to the cluster master.

    Multi-phased data execution in a data processing system

    公开(公告)号:US10545964B2

    公开(公告)日:2020-01-28

    申请号:US15419883

    申请日:2017-01-30

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments include a method performed by a data intake and query system. The method includes receiving a search query by a search head, defining a search process for applying the search query to indexers, delegating a first portion of the search process to indexers and a second portion of the search process to intermediary node(s) communicatively coupled to the search head and the indexers. The first portion can define a search scope for obtaining partial search results of the indexers and the second portion can define operations for combining the partial search results by the intermediary node(s) to produce a combination of the partial search results. The search head then receives the combination of the partial search results, and outputs final search results for the search query, where the final search results are based on the combination of the partial search results.

    Optimizing index file sizes based on indexed data storage conditions

    公开(公告)号:US10235431B2

    公开(公告)日:2019-03-19

    申请号:US15011473

    申请日:2016-01-29

    Applicant: Splunk Inc.

    Abstract: Techniques and mechanisms are disclosed to optimize the size of index files to improve use of storage space available to indexers and other components of a data intake and query system. Index files of a data intake and query system may include, among other data, a keyword portion containing mappings between keywords and location references to event data containing the keywords. Optimizing an amount of storage space used by index files may include removing, modifying and/or recreating various components of index files in response to detecting one or more storage conditions related to the event data indexed by the index files. The optimization of index files generally may attempt to manage a tradeoff between an efficiency with which search requests can be processed using the index files and an amount of storage space occupied by the index files.

Patent Agency Ranking