Splunk Inc.

Dinesh Sharma

Zi Liang Chen

Bradford H Lovering

Hong Yuan

Alexander Binkin

Vinu K Alazath

Gang Tao

Alex Cain

Kyung Rock Baek

Li Li

Chaitanya Sunil Phalak

Anuj Gupta

Embodiments described herein are directed to facilitating management of collection agents. In one embodiment, a control request is received at an agent service manager from an agent controller that manages collection agents that collect data. The agent controller and the collection agents operate on a remote computing machine. A desired agent event is identified to be executed in association with a set of collection agent of the collection agents. An indication of the desired agent event is provided to the agent controller for execution of the desired agent event in association with each collection agent of the set of collection agents.

Facilitating management of collection agents

Embodiments of the present invention are directed to facilitating performing data extraction via efficient extraction rule matching. Generally, an extraction rule can be determined to match an event based on a two-step process. In particular, initially, a determination that a set of fixed substrings associated with the extraction rule matches fixed substrings of the event can be made. Based on fixed substring match, a determination can be made that a set of fields associated with the extraction rule matches fields of the event. In such a case, the extraction rule can be deemed to match the event and used to extract values from the event.

Enhanced data extraction via efficient extraction rule matching

Embodiments described herein are directed to facilitating management of collection agents. In one embodiment, a control request is provided to an agent service manager from an agent controller that manages collection agents that collect data. The agent controller and the collection agents operate on a computing machine remote from the agent service manager. In response to the control request, a control directive is received, the control directive including an agent event indicator indicating an agent event to be executed in association with a set of collection agents of the collection agents. Thereafter, execution of the agent event is initiated in association with each collection agent of the set of collection agents.

Managing collection agents via an agent controller

A computerized method is disclosed for storing data using a persistent queue. The computerized method includes operations of obtaining machine data from a remote electronic device, providing the machine data to a persistent queue component, wherein the persistent queue component organizes the machine data for storage on a first data store and storing a copy of the organized machine data in the first data store, and responsive to completion of the storing of the copy of the organized machine data. Further operations include transmitting an acknowledgement communication to the remote electronic device indicating storage of the copy of the machine data in the first data store, processing the machine data for storage, and responsive to completion of the storing of the processed machine data in a second data store, deleting the copy of the machine data from the first data store. The persistent queue component may include a socket server.

System and method for storage of data utilizing a persistent queue

A computerized method is disclosed. Operations of the method include obtaining, by a data retrieval component, the data from a remote electronic device, storing a copy of the data in a first data store, providing an acknowledgement to the remote electronic device based on storage of the copy of the data in the first data store, parsing the data into one or more time-based events, storing the one or more time-based events in a second data store, and deleting the copy of at least the portion of the data from the first data store.

Growing community of inventors

Pleasanton, CA, United States of America

Dinesh Sharma