Configuration replication in a search head cluster
AssigneeSplunk Inc.
InventorEric Woo
Life of this patent
Estimating the term…
Abstract
Replication of search-related configuration customizations across multiple individual configuration files of search heads of a cluster for a consistent user experience. The cluster of search heads may be synchronized such that the search heads operate to receive the configuration or knowledge object customizations from one or more clients. Following synchronization, the respective search heads may display the knowledge object customizations to the one or more clients via a user interface.
Claims28
A method comprising:
- receiving, by one or more processing devices of a first search head of a cluster comprising a plurality of search heads, a first customization of a knowledge object from a client computing device of a plurality of client computing devices, wherein each search head is responsible for a reduce phase of a map-reduce search computation, and wherein each search head comprises a local data store;
- storing a first journal entry relating to the first customization of the knowledge object in a first local data store of the first search head;
- receiving a second journal entry relating to a second customization of the knowledge object processed by a second search head of the cluster;
- detecting a conflict by determining the first journal entry and the second journal entry share a same parent commit journal entry;
- and
- resolving the conflict by updating the parent commit journal entry of the first journal entry to a current parent commit, wherein the second customization of the knowledge object is accessible by one or more of the plurality of client computing devices via a user interface associated with the first search head to perform a first map-reduce search computation using the second customization of the knowledge object.
A system comprising:
- a first local data store of a first search head;
- and
- a processing device operatively coupled to the first local data store, the processing device to:
- receive, by the first search head of a cluster comprising a plurality of search heads, a first customization of a knowledge object from a client computing device of a plurality of client computing devices, wherein each search head is responsible for a reduce phase of a map-reduce search computation, and wherein each search head comprises a local data store;
- store a first journal entry relating to the first customization of the knowledge object in a first local data store of the first search head;
- receive a second journal entry relating to a second customization of the knowledge object processed by a second search head of the cluster;
- detect a conflict by determining the first journal entry and the second journal entry share a same parent commit journal entry;
- and
- resolve the conflict by updating the parent commit journal entry of the first journal entry to a current parent commit, wherein the second customization of the knowledge object is accessible by one or more of the plurality of client computing devices via a user interface associated with the first search head to perform a first map-reduce search computation using the second customization of the knowledge object.
A non-transitory computer-readable medium having instructions encoded thereon which, when executed by a processing device, cause the processing device to perform operations comprising:
- receiving, by the processing device of a first search head of a cluster comprising a plurality of search heads, a first customization of a knowledge object from a client computing device of a plurality of client computing devices, wherein each search head is responsible for a reduce phase of a map-reduce search computation, and wherein each search head comprises a local data store;
- storing a first journal entry relating to the first customization of the knowledge object in a first local data store of the first search head;
- receiving a second journal entry relating to a second customization of the knowledge object processed by a second search head of the cluster;
- detecting a conflict by determining the first journal entry and the second journal entry share a same parent commit journal entry;
- and
- resolving the conflict by updating the parent commit journal entry of the first journal entry to a current parent commit, wherein the second customization of the knowledge object is accessible by one or more of the plurality of client computing devices via a user interface associated with the first search head to perform a first map-reduce search computation using the second customization of the knowledge object.
Dependencies are inferred from the claim text.