Splunk Inc.

Cisco Technology, Inc.

Instabase, Inc.

Karthikeyan Sabhanatarajan

David Marquardt

Steve Yu Zhang

Alexander Douglas James

Nicholas Robert Romito

Sourav Pal

Arindam Bhattacharjee

Christopher Madden Pride

Alexandros Batsakis

Ashish Mathew

Bharath Kishore Reddy Aleti

Pirabhu Raman

James Monschke

Shih Ping Chang

Sophia Rui Zhu

Anant Bhardwaj

Justin Herlick

Mohit Chawla

David Ryan Marquardt

A method includes receiving an initial pipeline including a sequence of commands for execution on a computing system, and obtaining, for each command in the sequence of commands, semantic information. The sequence of commands includes a command with incomplete semantic information. The method further includes generating an abstract semantic tree (AST) with the semantic information and a placeholder for the incomplete semantic information, and manipulating the AST to generate a revised AST. The revised AST corresponds to a revised pipeline that reduces an execution time on the computing system. The method further includes executing the revised pipeline.

Partially typed semantic based query execution optimization

Embodiments of the present disclosure provide techniques for using an inverted index in a pipelined search query. A field searchable data store is provided that comprises a plurality of event records, each event record comprising a time-stamped portion of raw machine data. Responsive to the reciept of an incoming search query, the search engine accesses an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and value pair that identifies a location in the data store where an associated event record is stored. Once the inverted index is accessed, it can be used to identify and search a subset of the plurality of event records, wherein the subset comprises one or more event records with corresponding reference values in the inverted index.

Pipelined search query, leveraging reference values of an inverted index to access a set of event data and performing further queries on associated raw data

Embodiments of the present disclosure provide techniques for performing searches of event records by leveraging reference values in an inverted index. A method of searching comprises accessing a query associated with a first set of event records in a field searchable data store, each event record comprising a time-stamped portion of raw machine data. The method further comprises evaluating the query and generating results for the query by accessing an inverted index, wherein each entry in the inverted index comprises at least one field, a corresponding at least one field value and a reference value that identifies a location in the field searchable data store where an associated event record is stored. The method further comprises performing a search to filter out a second set of event records and retrieving the second set of event records from the field searchable data store using reference values in the inverted index.

Retrieving event records from a field searchable data store using references values in inverted indexes

Systems and methods for distribution of enterprise software and compensation for usage of the enterprise software are disclosed. Exemplary implementations may: store information including executable code of software applications; receive user input from administrative users regarding eligibility of individual software applications for different users; facilitate execution of different eligible software applications as selected by the different users; monitor billable execution of the software applications; determine compensation amounts that correspond to monitored billable execution; and presenting information to a given administrative user regarding the determined compensation amounts.

Systems and methods for user-specific distribution of enterprise software and compensation for user-specific monitored usage of the enterprise software

Query execution optimization for partially typed semantics

Embodiments of the present disclosure provide techniques for using an inverted index in a pipelined search query. A field searchable data store is provided that comprises a plurality of event records, each event record comprising a time-stamped portion of raw machine data. Responsive to the receipt of an incoming search query, the search engine accesses an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and value pair that identifies a location in the data store where an associated event record is stored. Once the inverted index is accessed, it can be used to identify and search a subset of the plurality of event records, wherein the subset comprises one or more event records with corresponding reference values in the inverted index.

Pipelined search query, leveraging reference values of an inverted index to determine a set of event data and performing further queries on the event data

Embodiments of the present disclosure provide techniques for emitting structured and dynamic fields from an accelerated data model. The method comprises evaluating a query to search a data model, wherein the data model is defined by a set of events and at least one structured field from fields associated with the set of events. Each event comprises a time-stamped portion of raw machine data and is stored in a field searchable data store. A summarization table is associated with the data model and comprises a plurality of entries comprising reference values, wherein a respective summarization table entry comprises: the at least one structured field; a respective field value; and a reference value. The method further comprises accessing the set of events from the field searchable data store using the reference values in the summarization table and annotating the set of events with the at least one structured field and with at least one dynamic field from the fields associated with the set of events, wherein the at least one dynamic field is not defined in the data model.

Optimizing search of an accelerated data model by enabling emitting of structured and unstructured fields from the data model

Leveraging references values in inverted indexes to retrieve associated event records comprising raw machine data

Systems and methods are disclosed for processing and executing queries in a data intake and query system. The data intake and query system receives a query identifying a set of data to be processed and a manner of processing the set of data. The data intake and query system uses one or more containerized search nodes to execute the query and stores the results in a data store for combination with additional query results.

Managing, storing, and caching query results and partial query results for combination with additional query results

Partially typed semantics optimization

Embodiments of the present disclosure provide techniques for using an inverted index in a pipelined search query. A field searchable data store is provided that comprises a plurality of event records, each event record comprising a time-stamped portion of raw machine data. Responsive to the reciept of an incoming search query, the search engine accesses an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and value pair that identifies a location in the data store where an associated event record is stored. Once the inverted index is accessed, it can be used to filter out a subset of the plurality of event records, wherein the subset comprises one or more event records with corresponding reference values in the inverted index.

Using an inverted index in a pipelined search query to determine a set of event data that is further limited by filtering and/or processing of subsequent query pipestages

Techniques are provided to prevent switches in a data center fabric path environment with fabric path extension devices from media access control (MAC) address flooding and MAC address table overflow. In such an environment, endpoints associated with virtual port channels are connected to multiple switches which normally would perform MAC address flooding across all switch forwarding engines. The switches in the fabric path exchange MAC synchronization messages based on source/destination specific connectivity such that MAC broadcast messages that advertise source/destination MAC addresses for endpoints do not have to be repeatedly sent and their corresponding MAC lookup tables do not have to be updated or include unnecessary MAC table entries.

Growing community of inventors

San Francisco, CA, United States of America

Karthikeyan Sabhanatarajan