Splunk Inc.

Splunkinc.

Mitchell Blank, Jr

Stephen Phillip Sorkin

Vishal Patel

David Marquardt

Amritpal Singh Bath

Sundar Vasan

Micah James Delfino

Eric Timothy Woo

Johnvey Hwang

Leonid Budchenko

David Carasso

Denis Gladkikh

Da Xu

Robin Kumar Das

Anish Shrigondekar

Hasan Alayli

Rama Gopalan

Jag Kerai

Jimmy John

Johnathon Lee Cervelli

R David Carasso

Jagannath Kerai

Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on a source type of the plurality of first chunks. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Resegmenting chunks of data based on one or more criteria to facilitate load balancing

A method to assist with processing distributed jobs by retrieving and/or synchronizing supplemental job data. The method includes: transmitting, by a first component of a first execution environment via a first connection to a second component of a second execution environment, a first request associated with a job; receiving, by the first component via a second connection from the second component, a second request associated with the job; transmitting, by the first component via the second connection to the second component, a response to the second request, the response comprising an information associated with the job; and receiving, by the first component via the first connection from the second component, a result of the job.

Processing distributed jobs using multiple connections

Embodiments are directed towards a method for searching data. The method comprises providing an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises evaluating an incoming search query that references a field name. Responsive to the evaluating, the method comprises determining results for the incoming search query by executing the incoming search query across the field searchable datastore or the inverted index.

Query handling using a field searchable datastore or an inverted index

Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.

Facilitating existing item determinations

Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.

Facilitating event creation via previews

A method of data replication in a clustered computing environment comprises receiving, at a selected indexer within a plurality of indexers in a cluster, data from a forwarder indexer, wherein the selected indexer is designated as a primary indexer for the data, wherein the primary indexer has primary responsibility for responding to search queries pertaining to the data, wherein the cluster comprises a plurality of sites. The method further comprises receiving, at the selected indexer, data replication instructions, wherein the data replication instructions comprise a number of other indexers in the cluster for storing a replicated copy of the data and further comprise a number of sites from the plurality of sites across which to store a replicated copy of the data determined in accordance with a site replication factor.

Data replication and site replication in a clustered computing environment

Resegmenting chunks of data based on source type to facilitate load balancing

Monitoring changes to data items using associated metadata

A method to assist with processing distributed jobs by retrieving and/or synchronizing supplemental job data. The method includes receiving a request pertaining to a job from a first virtualized execution environment using a non-persistent connection between the first virtualized execution environment and a second virtualized execution environment, transmitting, by the secondary machine using a persistent connection between the first virtualized execution environment and the second virtualized execution environment, a task request for supplemental information pertaining to the job, generating a job result for the job based on the supplemental information received from the first virtualized execution environment via the persistent connection, and transmitting, to the first virtualized execution environment, the job result for the job using the non-persistent connection.

Utilizing multiple connections for generating a job result

The invention is directed towards enabling data volume and data type based licensing of software in a distributed system of a plurality of remote and/or local nodes. The invention enables measuring and optionally restricting the use of software based on one or more provided licenses that restrict the amount and type of data that may be processed by the software. New and older licenses may be added together for a single, bulk entitlement for a given volume of data processing for one or all types of data. Different users in the same enterprise may combine license entitlements too. Also, a new license can be acquired repeatedly, without requiring the issuance of combined licenses by the issuing authority and/or the revocation of prior licenses.

Distributed license management for a data limited application

Embodiments are directed towards a method for searching data. The method comprises providing an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises receiving an incoming search query that references a field name and evaluating the incoming search query. Furthermore, responsive to the evaluating, the method comprises determining results for the incoming search query using the field searchable datastore or the inverted index.

Query handling for field searchable raw machine data using a field searchable datastore or an inverted index

Detecting and resolving computer system errors using fast file change monitoring

Embodiments are directed towards managing within a cluster environment having a plurality of indexers for data storage using redundancy the data being managed using a generation identifier, such that a primary indexer is designated for a given generation of data. When a master device for the cluster fails, data may continue to be stored using redundancy, and data searches performed may still be performed.

Using an electron process to determine a primary indexer for responding to search queries including generation identifiers

Embodiments are directed towards a method for searching data. The method comprises generating an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises receiving an incoming search query that references a field name. Furthermore, the method comprises generating results to the incoming search query based on the field searchable datastore, wherein the field searchable datastore is directly searchable by the field name.

Directly searchable and indirectly searchable using associated inverted indexes raw machine datastore

Embodiments are directed towards a method for searching data. The method comprises providing an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises receiving an incoming search query that references a field name and evaluating the incoming search query. Furthermore, responsive to the evaluating, the method comprises determining results for the incoming search query using both of the field searchable datastore and the inverted index.

Growing community of inventors

San Francisco, CA, United States of America

Mitchell Blank, Jr