Splunk Inc.

Bei Li

Alexander Douglas James

Christopher Madden Pride

Alexandros Batsakis

Ashish Mathew

Xiaowei Wang

James Monschke

Scott Calvert

Sogol Moshtaghi

Ganesh Jothikumar

Arthur Foelsche

Ricky Gene Burnett

Daniel Ferstay

Vinayak Bhakta

Salih Ammar Wajih Zainulabdeen

Amy Joanna Sutedja

Ankur Dalsukhbhai Bambharoliya

Jengie Shau

Systems and methods are disclosed for receiving, at query coordinator, a search query. The query coordinator parses the search query and generates tasks for different runtime systems. The query coordinator configures an interface enabling inter system communication between the runtime systems. The generated tasks are distributed to the runtime systems and partial results of a runtime system are communicated to the interface. The query coordinator retrieves the partial results from the interface, finalizes the partial results, and sends finalized results them to the requestor of the search query.

Runtime systems query coordinator

Systems and methods are described for providing previews of deployment of data stream processing instructions sets, sometimes called pipelines, to a stream data processing system. Rather than deploying such an instruction set, which may cause detrimental side effects, previews can be facilitated by conversion of a data stream processing instructions set to a batch query that is applied to an existing data set. An output of the batch query can then be provided to an end user as a preview of output of the data stream processing instructions set, when implemented.

Data stream processing instruction set previews using batch conversion

Systems and methods are disclosed for mapping search nodes to a search head in a data intake and query system based on a tenant identifier in order to execute a query received by the data intake and query system. The mapping may allow same or similar search nodes to be used to execute queries that are associated with a particular tenant identifier, in order to take advantage of caching and local data stored with those search nodes. In some cases, search nodes can be mapped based on the tenant identifier using a hashing algorithm, such as a consistent hashing algorithm.

Dynamically assigning a search head to process a query

Mapping search nodes to a search head using a tenant identifier

Systems and methods are disclosed for dynamically assigning a search head or search nodes in a data intake and query system for a query received by the data intake and query system. Existing search heads and search nodes can periodically report their status to the data intake and query system, which can use that information to help determine the need to provision additional search heads and search nodes. The data intake and query system can receive a query identifying a set of data to be processed and a manner of processing the set of data. The data intake and query system can use the status information for existing search heads and search nodes to dynamically assign a search head and search nodes for the query. Dynamically assigning the search head and search nodes in this manner may provide many benefits, including improved load balancing and resource utilization.

Dynamically assigning a search head and search nodes for a query

Growing community of inventors

Redwood City, CA, United States of America

Bei Li