Splunk Inc.

Splunkinc.

Zi Liang Chen

Dinesh Sharma

Hong Yuan

Bradford H Lovering

Alexander Binkin

Ting Wang

Ran Xie

Li Li

Gang Tao

Donald Tregonning

Alex Cain

Embodiments of the present invention are directed to facilitating performing data extraction via efficient extraction rule matching. Generally, an extraction rule can be determined to match an event based on a two-step process. In particular, initially, a determination that a set of fixed substrings associated with the extraction rule matches fixed substrings of the event can be made. Based on fixed substring match, a determination can be made that a set of fields associated with the extraction rule matches fields of the event. In such a case, the extraction rule can be deemed to match the event and used to extract values from the event.

Enhanced data extraction via efficient extraction rule matching

A computerized method is disclosed for storing data using a persistent queue. The computerized method includes operations of obtaining machine data from a remote electronic device, providing the machine data to a persistent queue component, wherein the persistent queue component organizes the machine data for storage on a first data store and storing a copy of the organized machine data in the first data store, and responsive to completion of the storing of the copy of the organized machine data. Further operations include transmitting an acknowledgement communication to the remote electronic device indicating storage of the copy of the machine data in the first data store, processing the machine data for storage, and responsive to completion of the storing of the processed machine data in a second data store, deleting the copy of the machine data from the first data store. The persistent queue component may include a socket server.

System and method for storage of data utilizing a persistent queue

A computerized method is disclosed. Operations of the method include obtaining, by a data retrieval component, the data from a remote electronic device, storing a copy of the data in a first data store, providing an acknowledgement to the remote electronic device based on storage of the copy of the data in the first data store, parsing the data into one or more time-based events, storing the one or more time-based events in a second data store, and deleting the copy of at least the portion of the data from the first data store.

Event collector with stateless data ingestion

Systems and methods are disclosed for enabling stateless status checks using collector redirection. A pool of collector devices can enable asynchronous submission to a data collection system, whereby on receipt of data to a collector device, the collector device generates and acknowledgement value for the data. A submitting device can later use the acknowledgement value to obtain the status of processing the data on the collection system. If collector devices are load balanced, operation of a load balancer can cause a request for status to be routed to a different collector device than the device to which data was initially submitted. To address this, collector devices can be configured to use the acknowledgement value to identify another collector device to which data was originally submitted, and to forward status requests to that other device. Status requests can thus be correctly routed without modification to load balancer operation.

Enabling stateless status checks using collector redirection

Growing community of inventors

San Ramon, CA, United States of America

Zi Liang Chen