-
公开(公告)号:US11914552B1
公开(公告)日:2024-02-27
申请号:US18160123
申请日:2023-01-26
Applicant: Splunk Inc.
IPC: G06F17/30 , G06F16/17 , G06F16/20 , G06F16/174
CPC classification number: G06F16/1734 , G06F16/174 , G06F16/20
Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.
-
公开(公告)号:US11886502B2
公开(公告)日:2024-01-30
申请号:US16870233
申请日:2020-05-08
Applicant: Splunk Inc.
Inventor: Mitchell Neuman Blank, Jr. , Leonid Budchenko , David Carasso , Micah James Delfino , Johnvey Hwang , Stephen Phillip Sorkin , Eric Timothy Woo
IPC: G06F16/901 , G06F16/9535 , G06F16/248 , G06F16/25 , G06F16/31 , G06F16/951 , G06F16/22 , G06F16/2458 , G06F16/2455 , G06F40/205 , G06F3/04842 , G06F3/0482 , G06F3/0485 , G06V10/24 , G06V40/16
CPC classification number: G06F16/901 , G06F3/0482 , G06F3/0485 , G06F3/04842 , G06F16/2228 , G06F16/248 , G06F16/2477 , G06F16/24564 , G06F16/252 , G06F16/316 , G06F16/951 , G06F16/9535 , G06F40/205 , G06V10/245 , G06V40/161
Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.
-
公开(公告)号:US11580071B2
公开(公告)日:2023-02-14
申请号:US17080416
申请日:2020-10-26
Applicant: SPLUNK INC.
IPC: G06F17/30 , G06F16/17 , G06F16/20 , G06F16/174
Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.
-
公开(公告)号:US10997138B2
公开(公告)日:2021-05-04
申请号:US16424307
申请日:2019-05-28
Applicant: Splunk Inc.
IPC: G06F16/00 , G06F16/22 , G06F16/2453 , G06F16/33 , G06F16/242 , G06F16/248 , G06F16/28 , G06F16/31 , G06F16/338 , G06F16/23 , G06F16/2458 , G06F16/2455
Abstract: Embodiments are directed towards a method for searching data. The method comprises providing an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises receiving an incoming search query that references a field name and evaluating the incoming search query. Furthermore, responsive to the evaluating, the method comprises determining results for the incoming search query using both of the field searchable datastore and the inverted index.
-
公开(公告)号:US10650069B2
公开(公告)日:2020-05-12
申请号:US15642062
申请日:2017-07-05
Applicant: Splunk Inc.
Inventor: Mitchell Neuman Blank, Jr. , Leonid Budchenko , David Carasso , Micah James Delfino , Johnvey Hwang , Stephen Phillip Sorkin , Eric Timothy Woo
IPC: G06F16/00 , G06F16/9535 , G06F16/248 , G06F16/25 , G06F16/31 , G06F16/951 , G06F16/22 , G06F16/2458 , G06F16/2455 , G06F40/205 , G06F3/0484 , G06F3/0482 , G06F3/0485
Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.
-
公开(公告)号:US10423595B2
公开(公告)日:2019-09-24
申请号:US15421212
申请日:2017-01-31
Applicant: Splunk Inc.
IPC: G06F16/00 , G06F16/22 , G06F16/2453 , G06F16/33 , G06F16/242 , G06F16/248 , G06F16/28 , G06F16/31 , G06F16/338 , G06F16/23 , G06F16/2458 , G06F16/2455
Abstract: Embodiments are directed towards a method for searching data. The method comprises providing an inverted index that comprises at least one record, wherein the at least one record comprises at least one field name and a corresponding at least one field value. The at least one field name and corresponding value are extracted from time-stamped searchable events that are stored in a field searchable datastore and comprise portions of raw data. The at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored. The method further comprises receiving an incoming search query that references a field name and evaluating the incoming search query. Furthermore, responsive to the evaluating, the method comprises determining results for the incoming search query using both of the field searchable datastore and the inverted index.
-
公开(公告)号:US09984129B2
公开(公告)日:2018-05-29
申请号:US14815974
申请日:2015-08-01
Applicant: Splunk Inc.
Inventor: Vishal Patel , Mitchell Neuman Blank, Jr. , Sundar Renegarajan Vasan , Stephen Phillip Sorkin
CPC classification number: G06F17/30528 , G06F3/0617 , G06F3/065 , G06F3/067 , G06F11/20 , G06F11/2094 , G06F17/30241 , G06F17/30336 , G06F17/30575 , G06F17/30581 , G06F17/30867 , G06F17/3087 , H04L67/1097
Abstract: Embodiments are directed towards managing within a cluster environment having a plurality of indexers for data storage using redundancy the data being managed using a generation identifier, such that a primary indexer is designated for a given generation of data. When a master device for the cluster fails, data may continue to be stored using redundancy, and data searches performed may still be performed.
-
公开(公告)号:US09767112B2
公开(公告)日:2017-09-19
申请号:US15224649
申请日:2016-07-31
Applicant: Splunk Inc.
IPC: G06F17/30
CPC classification number: G06F17/30144 , G06F17/3015 , G06F17/30286
Abstract: Embodiments are directed towards managing and tracking item identification of a plurality of items to determine if an item is a new or existing item, where an existing item has been previously processed. In some embodiments, two or more item identifiers may be generated. In one embodiment, generating the two or more item identifiers may include analyzing the item using a small item size characteristic, a compressed item, or for an identifier collision. The two or more item identifiers may be employed to determine if the item is a new or existing item. In one embodiment, the two or more item identifiers may be compared to a record about an existing item to determine if the item is a new or existing item. If the item is an existing item, then the item may be further processed to determine if the existing item has actually changed.
-
公开(公告)号:US09740788B2
公开(公告)日:2017-08-22
申请号:US15224655
申请日:2016-07-31
Applicant: Splunk Inc.
Inventor: Mitchell Neuman Blank, Jr. , Leonid Budchenko , David Carasso , Micah James Delfino , Johnvey Hwang , Stephen Phillip Sorkin , Eric Timothy Woo
IPC: G06F17/30 , G06F3/0484 , G06F3/0482 , G06F17/27 , G06F3/0485
CPC classification number: G06F17/30867 , G06F3/0482 , G06F3/04842 , G06F3/0485 , G06F17/2705 , G06F17/30321 , G06F17/30507 , G06F17/30551 , G06F17/30554 , G06F17/3056 , G06F17/30619 , G06F17/30864
Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.
-
公开(公告)号:US09208206B2
公开(公告)日:2015-12-08
申请号:US14445001
申请日:2014-07-28
Applicant: Splunk Inc.
Inventor: Mitchell Neuman Blank, Jr. , Leonid Budchenko , David Carasso , Micah James Delfino , Johnvey Hwang , Stephen Phillip Sorkin , Eric Timothy Woo
IPC: G06F17/30 , G06F3/0484
CPC classification number: G06F17/30867 , G06F3/0482 , G06F3/04842 , G06F3/0485 , G06F17/2705 , G06F17/30321 , G06F17/30507 , G06F17/30551 , G06F17/30554 , G06F17/3056 , G06F17/30619 , G06F17/30864
Abstract: Embodiments are directed towards previewing results generated from indexing data raw data before the corresponding index data is added to an index store. Raw data may be received from a preview data source. After an initial set of configuration information may be established, the preview data may be submitted to an index processing pipeline. A previewing application may generate preview results based on the preview index data and the configuration information. The preview results may enable previewing how the data is being processed by the indexing application. If the preview results are not acceptable, the configuration information may be modified. The preview application enables modification of the configuration information until the generated preview results may be acceptable. If the configuration information is acceptable, the preview data may be processed and indexed in one or more index stores.
Abstract translation: 实施例针对在将对应的索引数据添加到索引存储之前预览从索引数据原始数据生成的结果。 可以从预览数据源接收原始数据。 在可以建立一组初始配置信息之后,可以将预览数据提交给索引处理流水线。 预览应用可以基于预览索引数据和配置信息生成预览结果。 预览结果可能可以预览索引应用程序如何处理数据。 如果预览结果不可接受,则可以修改配置信息。 预览应用程序可以修改配置信息,直到生成的预览结果可以接受。 如果配置信息是可接受的,则预览数据可以在一个或多个索引存储中被处理和索引。
-
-
-
-
-
-
-
-
-