Splunk Inc.

Cisco Technology, Inc.

Mehul Goyal

Alexandros Batsakis

Igor Stojanovski

Ashish Mathew

Douglas Rapp

Eric Timothy Woo

Vladimir A Shcherbakov

Anish Shrigondekar

Sai Krishna Sajja

Ruochen Zhang

Zhenghui Xie

Sonal Maheshwari

Tianyi Gou

Sophia Rui Zhu

David Gustav Ashpole

Gaurav Chawla

Tameem Anwar

Sumeet Rohatgi

Sanjeev Raghavendra Kulkarni

Karthikeyan Ramasamy

Boyang Peng

Matteo Merli

Ivan Kelly

Hao Zhan

Sanish N Mahadik

Aditya Kamble

Tyler Bakke

Rahul Merulinath

Ryan Flynn

A data intake and query system can manage the search of large amounts of data using one or more processing nodes. When a new processing node is added or becomes available, the node coordinator can reassign duties from one or more processing nodes to the new processing node. The node coordinator can initially assign the new processing node one or more groups of data for backup purposes. At a later time, the node coordinator can reassign the new processing node to the one or more groups of data for searching purposes.

Reassignment of processing nodes

A process for facilitating autoscaling in a stateful system is described herein. In embodiments, a set of metrics associated with a set of components of a stateful service is obtained. The set of metrics may generally indicate a utilization or a load of each of the components of the set of components (e.g., message managers and/or data stores). Thereafter, it is determined to initiate a scaling event at the stateful service in association with the set of components of the stateful service based on at least a portion of the set of metrics attaining a metric threshold indicating a threshold value for determining whether to scale stateful service components. A scaling request can then be provided to the stateful service to initiate the scaling event at the stateful service in association with the set of components of the stateful service.

Autoscaling in a stateful system

Reassigning a processing node from downloading to searching a data group

A control plane system can be used to manage or generated components in a shared computing resource environment. To generate a modified components, the control plane system can receive receiving configurations of a component. The configurations can include software versions and/or parameters for the component. Using the configurations, the control plane system can generate an image of a modified component, and communicate the image to a master node in the shared computing resource environment. The master node can provides one or more instances of the modified component for use based on the received image.

Generating a modified component for a data intake and query system using an isolated execution environment image

Systems and methods are described for improving data availability and/or resiliency of indexers of a data intake and query system. Due to a lag between the time at which data is received and the time at which the data is available for searching, the data intake and query system may receive a query indicating that received (but unavailable for search) data is to be included as part of the query. A cluster master can dynamically track what data is available for searching by different indexers and map the data to filter criteria using a bucket map identifier. When a search head receives a query, it can request a bucket map identifier from the cluster master and send the bucket map identifier to the indexers that will be executing the query. The indexers can use the bucket map identifier to request the individual buckets that they are assigned to search.

Mapping buckets and search peers to a bucket map identifier for searching

Reassigning data groups from backup to searching for a processing node

Systems and methods are described for improving data availability and/or resiliency of indexers of a data intake and query system. A data intake and query system can index large amounts of data using one or more indexers. An indexer can store a copy of the data that the indexer is assigned to process in the shared storage system, and a cluster master can track the storage of the data and the indexer assigned to process the data. In the event an indexer fails or is otherwise unable to index data that it has been assigned to index, the cluster master can assign one or more second indexers to process the data. The second indexer can download the data from the shared storage system.

Recovering pre-indexed data from a shared storage system following a failed indexer

An automatic service monitor in an information technology environment may be equipped to automatically process machine data originating from a running IT environment to identify the entities that perform services in the environment, and to reflect the discovered entities and service associations in the control and configuration data that directs the monitoring operations performed by the system.

Automated service discovery in I.T. environments with entity associations

An automatic service monitor in an information technology environment may be equipped to automatically process machine data originating from a running IT environment to identify the entities that perform services in the environment, and to reflect the discovered entities and service associations in the control and configuration data that directs the monitoring operations performed by the system. A related user interface is taught.

Interface for automated service discovery in I.T. environments

Automated service discovery in I.T. environments

Growing community of inventors

Pleasanton, CA, United States of America

Mehul Goyal