Batch searches in data fabric service system

A non-transitory computer-readable medium including instructions that, when executed by a processor included in a first computing device, cause the processor to perform the steps of:

• receiving partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query received by a data intake and query system,
• wherein at least one first partial search result of the partial search results is received from a subset of internal data sources of the data intake and query system, wherein the at least one first partial search result comprises one or more first events in a first format, each first event corresponding to at least one second event stored in the subset of internal data sources, wherein each second event includes raw machine data associated with a timestamp and reflects activity within an information technology infrastructure, and
• wherein at least one second partial search result of the partial search results is received from one or more external data sources apart from the data intake and query system, wherein the at least one second partial search result includes data in a second format that is different from the first format;
• transforming the data of the at least one second partial search result into the first format to produce a commonly formatted partial search result;
• processing the commonly formatted partial search result and the at least one first partial search result to generate finalized partial search results,
• wherein the commonly formatted partial search result is processed based on a determination that the commonly formatted partial search result was received from the one or more external data sources, and
• wherein the at least one first partial search result is processed based on a determination that the at least one first partial search result was received from the one or more internal data stores;
• and
• communicating the finalized partial search results to a second computing device, wherein the second computing device processes the finalized partial search results with other finalized partial search results to generate finalized search results.

A system, comprising:

• one or more worker nodes, wherein each worker node includes a processor and a memory that stores respective instructions, and, when each processor executes the respective instructions, wherein at least one worker node is configured to:
• receive partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query received by a data intake and query system,
• wherein at least one first partial search result of the partial search results is received from a subset of internal data sources of the data intake and query system, wherein the at least one first partial search result comprises one or more first events in a first format, each first event corresponding to at least one second event stored in the subset of internal data sources, wherein each second event includes raw machine data associated with a timestamp and reflects activity within an information technology infrastructure, and
• wherein at least one second partial search result of the partial search results is received from one or more external data sources apart from the data intake and query system, wherein the at least one second partial search result includes data in a second format that is different from the first format;
• transform the data of the at least one second partial search result into the first format, to produce commonly formatted partial search results;
• processing the commonly formatted partial search result and the at least one first partial search result to generate finalized partial search results,
• wherein the commonly formatted partial search result is processed based on a determination that the commonly formatted partial search result was received from the one or more external data sources, and
• wherein the at least one first partial search result is processed based on a determination that the at least one first partial search result was received from the one or more internal data stores;
• and
• communicating the finalized partial search results to a second computing device, wherein the second computing device processes the finalized partial search results with other finalized partial search results to generate finalized search results.