Splunk Inc.

Paul J Lucas

Alexandros Batsakis

Ledion Bitincka

Nicholas Robert Romito

Eric Timothy Woo

Igor Stojanovski

Bharath Aleti

Sourav Pal

Tameem Anwar

Steve Wong

Alexandras Batsakis

Sai Krishna

Embodiments are disclosed for performing cache aware searching. In response to a search query, a first bucket and a second bucket in remote storage for processing the search query. A determination is made that a first file in the first bucket is present in a cache when the search query is received. In response to the search query, a search is performed using the first file based on the determination that the first file is present in the cache when the search query is received, and the search is performed using a second file from the second bucket once the second file is stored in the cache.

Cache aware searching based on files of buckets

Systems and methods are disclosed for making space available in a local storage of a data intake and query system. A cache manager of the data intake and query system may determine an amount of storage space of a local data store that is available for use to perform a query. The cache manager may then use one or more eviction policies associated with content stored at the local data store to purge content items to evict from the local storage. The system may then retrieve content for performing the query from a remote storage and store the retrieved content at the local storage.

Evicting data associated with a data intake and query system from a local storage

Techniques for scheduling search queries in a computing environment are disclosed. A search query scheduling system associates a first set of queries with a first skew tolerance, the first set of queries scheduled to be performed during a first period, where the first skew tolerance is based on a duration of the first period. The search query scheduling system reschedules a first subset of search queries included in the first set of queries by skewing the first subset of search queries over a first portion of the first period based on the first skew tolerance.

Skewing of scheduled search queries

Cache aware searching based on one or more files in remote storage

Cache aware searching based on one or more files in one or more buckets in remote storage

Systems and methods are disclosed for processing and executing queries in a data intake and query system. The data intake and query system receives raw machine data at an indexing system, and stores at least a portion of the raw machine data in buckets using containerized indexing nodes instantiated in a containerized environment. The data intake and query system stores the buckets in a shared storage system.

Processing data using containerized state-free indexing nodes in a containerized scalable environment

Embodiments are disclosed for a prefetching method that may include copying, in response to a search query, a first bucket from a remote storage to a cache. The first bucket may include first data associated with the search query. The method may further include identifying a first file type associated with a first file in the first bucket. The first file may be associated with a usage status. The method may further include accessing, based on the search query, a second bucket from the remote storage. The second bucket may include second data associated with the search query. The method may further include identifying a second file in the second bucket having the first file type, and copying, in response to the usage status indicating that the first file was used in processing the search query, the second file from the remote storage to the cache.

Pre-fetching files from buckets in remote storage for a cache based on file usage history

Cache aware searching of buckets in remote storage

Pre-fetching data from buckets in remote storage for a cache

Growing community of inventors

San Francisco, CA, United States of America

Paul J Lucas