Splunk Inc.

Scott Calvert

Christopher Madden Pride

Alexander Douglas James

Alexandros Batsakis

Ashish Mathew

Arun Ramani

Xiaowei Wang

Andrew Peters

James Monschke

Manu Jose

Bei Li

Sogol Moshtaghi

Systems and methods are disclosed for annotating a metadata catalog in a data intake and query system based on a query received by the data intake and query system. The metadata catalog can store information about datasets associated with the data intake and query system, including dataset configuration records of the datasets, which can be used to process queries for execution by the data intake and query system. The data intake and query system can receive a query identifying a set of data to be processed and a manner of processing the set of data. The data intake and query system can parse the query to identify datasets and/or data fields associated with the query. Based on the identified datasets and/or fields, the data intake and query system can generate one or more annotations, and use the annotations to update the metadata catalog.

Revising catalog metadata based on parsing queries

Systems and methods are disclosed for mapping search nodes to a search head in a data intake and query system based on a tenant identifier in order to execute a query received by the data intake and query system. The mapping may allow same or similar search nodes to be used to execute queries that are associated with a particular tenant identifier, in order to take advantage of caching and local data stored with those search nodes. In some cases, search nodes can be mapped based on the tenant identifier using a hashing algorithm, such as a consistent hashing algorithm.

Dynamically assigning a search head to process a query

Systems and methods are disclosed for annotating a metadata catalog in a data intake and query system based on a detected change to the metadata catalog. The metadata catalog can store information about datasets associated with the data intake and query system, including dataset configuration records of the datasets, which can be used to process queries for execution by the data intake and query system. Based on a detected change to the metadata catalog, such as a manual or system annotation, the data intake and query system can generate additional annotations for the metadata catalog and use the annotations to update the metadata catalog.

Automatically generating metadata for a metadata catalog based on detected changes to the metadata catalog

Mapping search nodes to a search head using a tenant identifier

Systems and methods are disclosed for dynamically assigning a search head or search nodes in a data intake and query system for a query received by the data intake and query system. Existing search heads and search nodes can periodically report their status to the data intake and query system, which can use that information to help determine the need to provision additional search heads and search nodes. The data intake and query system can receive a query identifying a set of data to be processed and a manner of processing the set of data. The data intake and query system can use the status information for existing search heads and search nodes to dynamically assign a search head and search nodes for the query. Dynamically assigning the search head and search nodes in this manner may provide many benefits, including improved load balancing and resource utilization.

Dynamically assigning a search head and search nodes for a query

Growing community of inventors

El Cerrito, CA, United States of America

Scott Calvert