公开(公告)号：US11449371B1

公开(公告)日：2022-09-20

申请号：US16945645

申请日：2020-07-31

Applicant: Splunk Inc.

Inventor： Shalabh Goyal ,  Anish Shrigondekar ,  Bhavin Thaker ,  Zhenghui Xie ,  Ruochen Zhang

IPC: G06F9/54 ,  G06F11/34 ,  G06F11/30

Abstract: As an indexer indexes and groups events, it can generate data slices that include events. Based on a slice rollover policy, the indexer can add a particular slice to an aggregate slice. Based on an aggregate slice backup policy, the indexer can store a copy of the aggregate slice to a shared storage system. The aggregate slice can be used for restore purposes in the event the indexer fails or becomes unresponsive.

公开(公告)号：US11615082B1

公开(公告)日：2023-03-28

申请号：US16945631

申请日：2020-07-31

Applicant: Splunk Inc.

Inventor： Anish Shrigondekar ,  Ruochen Zhang ,  Zhenghui Xie ,  Shalabh Goyal ,  Bhavin Thaker

IPC: G06F16/24 ,  G06F16/245 ,  G06F13/20 ,  H04L43/16 ,  H04L41/0896

Abstract: A data intake and query system can ingest and index large amounts of data using one or more ingestors and indexers. The ingestors can ingest incoming data and use it to generate events. The ingestor can group the events and prepare them for communication to a message bus. The ingestor can determine a size of the group of events. If the size of the group of events satisfies a message size threshold, the ingestor can store the group of events to a data store, obtain a reference to the group of events, and communicate the reference to the group of events to a message queue. An indexer can obtained the reference from the message queue and use the reference to obtain the group of events from the data store.

公开(公告)号：US11609913B1

公开(公告)日：2023-03-21

申请号：US17162536

申请日：2021-01-29

Applicant: Splunk Inc.

Inventor： Tameem Anwar ,  Alexandros Batsakis ,  Tianyi Gou ,  Mehul Goyal ,  Ashish Mathew ,  Douglas Rapp ,  Sai Krishna Sajja ,  Anish Shrigondekar ,  Igor Stojanovski ,  Eric Woo ,  Zhenghui Xie ,  Ruochen Zhang ,  Sophia Rui Zhu

IPC: G06F16/00 ,  G06F16/2455 ,  G06F16/248 ,  G06F16/2458

Abstract: A data intake and query system can manage the search of large amounts of data using one or more processing nodes. When a new processing node is added or becomes available, the node coordinator can reassign duties from one or more processing nodes to the new processing node. The node coordinator can initially assign the new processing node one or more groups of data for backup purposes. At a later time, the node coordinator can reassign the new processing node to the one or more groups of data for searching purposes.

公开(公告)号：US20230014346A1

公开(公告)日：2023-01-19

申请号：US17933455

申请日：2022-09-19

Applicant: Splunk Inc.

Inventor： Shalabh Goyal ,  Anish Shrigondekar ,  Bhavin Thaker ,  Zhenghui Xie ,  Ruochen Zhang

IPC: G06F9/54 ,  G06F11/34 ,  G06F11/30

Abstract: As an indexer indexes and groups events, it can generate data slices that include events. Based on a slice rollover policy, the indexer can add a particular slice to an aggregate slice. Based on an aggregate slice backup policy, the indexer can store a copy of the aggregate slice to a shared storage system. The aggregate slice can be used for restore purposes in the event the indexer fails or becomes unresponsive.

公开(公告)号：US10985970B1

公开(公告)日：2021-04-20

申请号：US16657684

申请日：2019-10-18

Applicant: Splunk Inc.

Inventor： Shalabh Goyal ,  Anish Shrigondekar ,  Bhavin Thaker ,  Zhenghui Xie ,  Ruochen Zhang

IPC: H04L12/24 ,  G06F16/2458 ,  G06F9/451

Abstract: An operational event processor receives information describing operational events arising in relation to a server cluster of a data intake and query system. Responsive actions are identified for the events that are actionable, and those responsive actions are automatically dispatched. Dispatching may include automatically causing the performance of the actions based on remembered preauthorizations, or automatically causing the performance of the actions based on obtaining real time user authorizations. The operational event processor may employ mechanisms to provide extensibility and a high degree of interoperability with other system components.

公开(公告)号：US20250094253A1

公开(公告)日：2025-03-20

申请号：US18641089

申请日：2024-04-19

Applicant: Splunk Inc.

Inventor： Shalabh Goyal ,  Anish Shrigondekar ,  Bhavin Thaker ,  Zhenghui Xie ,  Ruochen Zhang

IPC: G06F9/54 ,  G06F11/30 ,  G06F11/34

Abstract: As an indexer indexes and groups events, it can generate data slices that include events. Based on a slice rollover policy, the indexer can add a particular slice to an aggregate slice. Based on an aggregate slice backup policy, the indexer can store a copy of the aggregate slice to a shared storage system. The aggregate slice can be used for restore purposes in the event the indexer fails or becomes unresponsive.

公开(公告)号：US12164402B1

公开(公告)日：2024-12-10

申请号：US18162273

申请日：2023-01-31

Applicant: Splunk Inc.

Inventor： Zhenghui Xie ,  Igor Stojanovski ,  Kartheek Babu Kolla ,  Sai Krishna Sajja ,  Srinivas Chowdhary Bobba ,  Tianyi Gou ,  Kai-Sern Lim ,  Tameem Anwar

IPC: G06F11/30

Abstract: A data intake and query system can manage the search of large amounts of data using one or more processing nodes. The data intake and query system can identify a group of processing nodes and assign a first processing node of the group to download and search a particular data group based on a first node map. The data intake and query system may identify an action associated with the first processing node. The data intake and query system can cause a particular processing node of the group to download the particular data group based on a second node map and transmit an authorization to perform the action to the first processing node.

公开(公告)号：US11966797B2

公开(公告)日：2024-04-23

申请号：US17933455

申请日：2022-09-19

Applicant: Splunk Inc.

Inventor： Shalabh Goyal ,  Anish Shrigondekar ,  Bhavin Thaker ,  Zhenghui Xie ,  Ruochen Zhang

IPC: G06F9/54 ,  G06F11/30 ,  G06F11/34

CPC classification number: G06F9/546 ,  G06F11/3006 ,  G06F11/3409 ,  G06F2201/81

Abstract: As an indexer indexes and groups events, it can generate data slices that include events. Based on a slice rollover policy, the indexer can add a particular slice to an aggregate slice. Based on an aggregate slice backup policy, the indexer can store a copy of the aggregate slice to a shared storage system. The aggregate slice can be used for restore purposes in the event the indexer fails or becomes unresponsive.

公开(公告)号：US12019634B1

公开(公告)日：2024-06-25

申请号：US18123758

申请日：2023-03-20

Applicant: Splunk Inc.

Inventor： Tameem Anwar ,  Alexandros Batsakis ,  Tianyi Gou ,  Mehul Goyal ,  Ashish Mathew ,  Douglas Rapp ,  Sai Krishna Sajja ,  Anish Shrigondekar ,  Igor Stojanovski ,  Eric Woo ,  Zhenghui Xie ,  Ruochen Zhang ,  Sophia Rui Zhu

IPC: G06F16/00 ,  G06F16/2455 ,  G06F16/2458 ,  G06F16/248

CPC classification number: G06F16/24554 ,  G06F16/24552 ,  G06F16/2477 ,  G06F16/248

Abstract: A data intake and query system can manage the search of large amounts of data using one or more processing nodes. When a new processing node is added or becomes available, the node coordinator can reassign duties from one or more processing nodes to the new processing node. The node coordinator can initially assign the new processing node one or more groups of data for backup purposes. At a later time, the node coordinator can reassign the new processing node to the one or more groups of data for searching purposes.

公开(公告)号：US11924021B1

公开(公告)日：2024-03-05

申请号：US17846983

申请日：2022-06-22

Applicant: Splunk Inc.

Inventor： Shalabh Goyal ,  Anish Shrigondekar ,  Bhavin Thaker ,  Zhenghui Xie ,  Ruochen Zhang

IPC: H04L41/0631 ,  G06F16/2458 ,  G06F9/451

CPC classification number: H04L41/0631 ,  G06F16/2465 ,  G06F9/451

Abstract: An actionable event collector in a server cluster receives information specifying an actionable event instance regarding an actionable event occurrence in the server cluster. The actionable event collector transmits a representation of the actionable event instance to an actionable event queue builder. The actionable event queue builder inserts the representation as an entry into an actionable event queue. The event action dispatcher processes the entry from the actionable event queue, wherein processing the entry comprises determining a responsive action for the entry and causing performance of the responsive action.