# US 11,310,313 B2 · Multi-threaded processing of search responses returned by search peers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,313 B2 - Document ID: US11310313B2 - Status: Granted - Kind: B2 - Application number: 17/014,244 - Filed: 2020-09-08 - Published: 2021-02-25 - Granted: 2022-04-19 - Earliest claimed: 2014-07-31 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Sourav Pal; Christopher Madden Pride - Web page: https://patentgrep.com/patent/US11310313B2 ## CPC - H04L 67/1087: using cross-functional networking aspects - G06F 15/167: using a common memory, e.g. mailbox - G06F 16/951: Indexing; Web crawling techniques - G06F 16/953: Querying, e.g. by the use of web search engines - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 43/16: Threshold monitoring - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/1004: Server selection for load balancing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Multi-threaded processing of search responses returned by search peers is disclosed. An example method may include transmitting, by a computer system, a search request to a plurality of search peers of a data aggregation and analysis system; receiving, by a first processing thread, a plurality of data packets from the plurality of search peers; parsing, by a second processing thread operating asynchronously with respect to the first processing thread, one or more data packets of the plurality of data packets, to produce a partial response to the search request; splitting the partial response into two or more fields; and generating, based on the two or more fields of the partial response, an aggregated response to the search request. ## Claims ### Claim 1 A method, comprising: transmitting, by a computer system, a search request to a plurality of search peers of a data aggregation and analysis system; receiving, by a first processing thread, a plurality of data packets from the plurality of search peers; parsing, by a second processing thread operating asynchronously with respect to the first processing thread, one or more data packets of the plurality of data packets, to produce a partial response to the search request; splitting the partial response into two or more fields; and generating, based on the two or more fields of the partial response, an aggregated response to the search request. ### Claim 2 (depends on 1) The method of claim 1, wherein the aggregated response comprises one or more events derived from time-series source data. ### Claim 3 (depends on 1) The method of claim 1, further comprising: encoding the aggregated response according to a defined encoding rule. ### Claim 4 (depends on 1) The method of claim 1, further comprising: writing the partial response to a message queue; and responsive to determining that a total size of messages in the message queue exceeds a certain threshold, suspending the first processing thread. ### Claim 5 (depends on 4) The method of claim 4, further comprising: responsive to determining that a total size of messages in the message queue falls below a certain threshold, notifying the first processing thread to resume receiving data packets. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the aggregated response further comprises: assigning the two or more fields of the partial response to respective fields of a memory data structure representing the aggregated response to the search request. ### Claim 7 (depends on 1) The method of claim 1, further comprising: pre-processing the search request by replacing an identifier of a first function returning a first aggregated parameter with an identifier of a second function returning a second aggregated parameter. ### Claim 8 (depends on 1) The method of claim 1, wherein receiving the plurality of data packets further comprises: reading, in a non-blocking mode, data from one or more communication endpoints having at least one data packet available. ### Claim 9 (depends on 1) The method of claim 1, wherein parsing the one or more data packets is performed by two or more processing threads operating in parallel, wherein each processing thread of the two or more processing threads produces a respective partial response to the search request. ### Claim 10 (depends on 1) The method of claim 1, wherein receiving the plurality of data packets is performed over a plurality of transport layer connections. ### Claim 11 (depends on 1) The method of claim 1, wherein parsing the one or more data packets is performed in an order of receiving the data packets over a plurality of transport layer connections. ### Claim 12 (depends on 1) The method of claim 1, wherein each search peer of the plurality of search peers performs map operations of a map-reduce search, to return partial results based on a subset of source data. ### Claim 13 (depends on 1) The method of claim 1, wherein the method is performed by a search head that performs map operations of a map-reduce search. ### Claim 14 A computer system, comprising: a memory; and one or more processing devices, coupled to the memory, to: transmit a search request to a plurality of search peers of a data aggregation and analysis system; receive, by a first processing thread, a plurality of data packets from the plurality of search peers; parse, by a second processing thread operating asynchronously with respect to the first processing thread, one or more data packets of the plurality of data packets, to produce a partial response to the search request; split the partial response into two or more fields; and generate, based on the two or more fields of the partial response, an aggregated response to the search request. ### Claim 15 (depends on 14) The computer system of claim 14, wherein the aggregated response comprises one or more events derived from time-series source data. ### Claim 16 (depends on 14) The computer system of claim 14, wherein the one or more processing devices are further to: write the partial response to a message queue; and responsive to determining that a total size of messages in the message queue exceeds a certain threshold, suspend the first processing thread that is receiving the data packets. ### Claim 17 (depends on 16) The computer system of claim 16, wherein the one or more processing devices are further to: responsive to determining that a total size of messages in the message queue falls below a certain threshold, notifying the first processing thread to resume receiving data packets. ### Claim 18 (depends on 14) The computer system of claim 14, wherein generating the aggregated response further comprises: assigning the two or more fields of the partial response to respective fields of a memory data structure representing the aggregated response to the search request. ### Claim 19 (depends on 14) The computer system of claim 14, wherein each search peer of the plurality of search peers performs map operations of a map-reduce search, to return partial results based on a subset of source data. ### Claim 20 A computer-readable non-transitory storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to: transmit a search request to a plurality of search peers of a data aggregation and analysis system; receive, by a first processing thread, a plurality of data packets from the plurality of search peers; parse, by a second processing thread operating asynchronously with respect to the first processing thread, one or more data packets of the plurality of data packets, to produce a partial response to the search request; split the partial response into two or more fields; and generate, based on the two or more fields of the partial response, an aggregated response to the search request.