# US 10,503,698 B2 · Configuration replication in a search head cluster > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,698 B2 - Document ID: US10503698B2 - Status: Granted - Kind: B2 - Application number: 14/448,919 - Filed: 2014-07-31 - Published: 2016-02-04 - Granted: 2019-12-10 - Earliest claimed: 2014-07-31 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Eric Woo - Web page: https://patentgrep.com/patent/US10503698B2 ## CPC - G06F 16/178: Techniques for file synchronisation in file systems - G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor - G06F 16/285: {Clustering or classification} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Replication of search-related configuration customizations across multiple individual configuration files of search heads of a cluster for a consistent user experience. The cluster of search heads may be synchronized such that the search heads operate to receive the configuration or knowledge object customizations from one or more clients. Following synchronization, the respective search heads may display the knowledge object customizations to the one or more clients via a user interface. ## Claims ### Claim 1 A method comprising: receiving, by one or more processing devices of a first search head of a cluster comprising a plurality of search heads, a first customization of a knowledge object from a client computing device of a plurality of client computing devices, wherein each search head is responsible for a reduce phase of a map-reduce search computation, and wherein each search head comprises a local data store; storing a first journal entry relating to the first customization of the knowledge object in a first local data store of the first search head; receiving a second journal entry relating to a second customization of the knowledge object processed by a second search head of the cluster; detecting a conflict by determining the first journal entry and the second journal entry share a same parent commit journal entry; and resolving the conflict by updating the parent commit journal entry of the first journal entry to a current parent commit, wherein the second customization of the knowledge object is accessible by one or more of the plurality of client computing devices via a user interface associated with the first search head to perform a first map-reduce search computation using the second customization of the knowledge object. ### Claim 2 (depends on 1) The method of claim 1, wherein the second customization of the knowledge object is accessed based on the updated first journal entry stored in the first local data store of the first search head. ### Claim 3 (depends on 1) The method of claim 1, further comprising: sending, from the first local data store of the first search head, the journal entry relating to the first customization of the knowledge object to a search head leader selected from the plurality of search heads of the cluster. ### Claim 4 (depends on 1) The method of claim 1, wherein the knowledge object comprising at least one of a late-binding schema, a saved search, an event type, a transaction, a tag, a field extraction, a field transform, a lookup, a workflow action, a search command, or a view. ### Claim 5 (depends on 1) The method of claim 1, wherein the first customization of the knowledge object comprises at least one of a change, update, creation, modification, sharing, permissioning, or deletion relating to the knowledge object. ### Claim 6 (depends on 1) The method of claim 1, wherein each of the plurality of search heads comprises a client interface configured to receive one or more customizations from the plurality of client computing devices. ### Claim 7 (depends on 1) The method of claim 1, wherein each of the plurality of search heads comprises a client interface configured to receive one or more customizations from the plurality of client computing devices and present the one or more customizations shared by the plurality of search heads of the cluster. ### Claim 8 (depends on 1) The method of claim 1, further comprising: replicating the first customization of the knowledge object across the plurality of search heads of the cluster via a search head leader of the cluster, wherein the first customization of the knowledge object is communicated via a client interface associated with the second search head of the plurality of search heads of the cluster. ### Claim 9 (depends on 1) The method of claim 1, further comprising: updating, by the first search head, a local configuration file of the first local data store by applying the first customization of the knowledge object. ### Claim 10 (depends on 1) The method of claim 1, further comprising performing the map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein performing the map-reduce search computation comprises applying a late binding schema to the source data, the late binding schema associated with one or more extraction rules defining one or more fields in the source data. ### Claim 11 (depends on 1) The method of claim 1, further comprising performing the first map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein the source data comprises aggregated heterogeneous data generated by at least one of: a server, a database, an application, or a network. ### Claim 12 (depends on 1) The method of claim 1, further comprising performing the first map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein the source data includes raw machine data. ### Claim 13 (depends on 1) The method of claim 1, further comprising performing the map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein the source data comprises a plurality of timestamped events, each timestamped event including a portion of raw machine data. ### Claim 14 (depends on 1) The method of claim 1, wherein sharing the first customization of the knowledge object comprises transmitting the first customization of the knowledge object to a search head leader responsible for synchronization of changes across the plurality of search heads in the cluster, the search head leader having been selected from among the plurality of search heads in the cluster using a Raft consensus algorithm. ### Claim 15 A system comprising: a first local data store of a first search head; and a processing device operatively coupled to the first local data store, the processing device to: receive, by the first search head of a cluster comprising a plurality of search heads, a first customization of a knowledge object from a client computing device of a plurality of client computing devices, wherein each search head is responsible for a reduce phase of a map-reduce search computation, and wherein each search head comprises a local data store; store a first journal entry relating to the first customization of the knowledge object in a first local data store of the first search head; receive a second journal entry relating to a second customization of the knowledge object processed by a second search head of the cluster; detect a conflict by determining the first journal entry and the second journal entry share a same parent commit journal entry; and resolve the conflict by updating the parent commit journal entry of the first journal entry to a current parent commit, wherein the second customization of the knowledge object is accessible by one or more of the plurality of client computing devices via a user interface associated with the first search head to perform a first map-reduce search computation using the second customization of the knowledge object. ### Claim 16 (depends on 15) The system of claim 15, wherein the second customization of the knowledge object is accessed based on the first journal entry stored in the first local data store of the first search head. ### Claim 17 (depends on 15) The system of claim 15, the processing device to: send, from the first local data store of the first search head, a journal entry relating to the first customization of the knowledge object to a search head leader selected from the plurality of search heads of the cluster. ### Claim 18 (depends on 15) The system of claim 15, wherein the knowledge object comprising at least one of a late-binding schema, a saved search, an event type, a transaction, a tag, a field extraction, a field transform, a lookup, a workflow action, a search command, or a view. ### Claim 19 (depends on 18) The system of claim 18, the processing device further configured to perform the first map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein the source data comprises a plurality of timestamped events, each timestamped event comprising a portion of raw machine data. ### Claim 20 (depends on 15) The system of claim 15, wherein the first customization of the knowledge object comprises at least one of a change, update, creation, modification, sharing, permissioning, or deletion relating to the knowledge object. ### Claim 21 (depends on 15) The system of claim 15, wherein each of the plurality of search heads comprises a client interface configured to receive one or more customizations from one or more of the plurality of client computing devices. ### Claim 22 (depends on 15) The system of claim 15, wherein each of the plurality of search heads comprises a client interface configured to receive one or more customizations from the plurality of client computing devices and present the one or more customizations shared by the plurality of search heads of the cluster. ### Claim 23 (depends on 15) The system of claim 15, the processing device further configured to replicate the first customization of the knowledge object across the plurality of search heads of the cluster via a search head leader of the cluster, wherein the first customization of the knowledge object is communicated via a client interface associated with the second search head of the plurality of search heads of the cluster. ### Claim 24 (depends on 15) The system of claim 15, the processing device further configured to update a local configuration file of the first local data store by applying the first customization of the knowledge object. ### Claim 25 (depends on 15) The system of claim 15, the processing device further configured to perform the first map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein performing the first map-reduce search computation comprises applying a late binding schema to the source data, the late binding schema associated with one or more extraction rules defining one or more fields in the source data. ### Claim 26 (depends on 15) The system of claim 15, the processing device further configured to perform the first map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein the source data comprises aggregated heterogeneous data generated by at least one of: a server, a database, an application, or a network. ### Claim 27 (depends on 15) The system of claim 15, the processing device further configured to perform the first map-reduce search computation of source data in accordance with the second customization of the knowledge object, wherein the source data includes raw machine data. ### Claim 28 A non-transitory computer-readable medium having instructions encoded thereon which, when executed by a processing device, cause the processing device to perform operations comprising: receiving, by the processing device of a first search head of a cluster comprising a plurality of search heads, a first customization of a knowledge object from a client computing device of a plurality of client computing devices, wherein each search head is responsible for a reduce phase of a map-reduce search computation, and wherein each search head comprises a local data store; storing a first journal entry relating to the first customization of the knowledge object in a first local data store of the first search head; receiving a second journal entry relating to a second customization of the knowledge object processed by a second search head of the cluster; detecting a conflict by determining the first journal entry and the second journal entry share a same parent commit journal entry; and resolving the conflict by updating the parent commit journal entry of the first journal entry to a current parent commit, wherein the second customization of the knowledge object is accessible by one or more of the plurality of client computing devices via a user interface associated with the first search head to perform a first map-reduce search computation using the second customization of the knowledge object.