# US 11,907,097 B1 · Techniques for processing trace data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,097 B1 - Document ID: US11907097B1 - Status: Granted - Kind: B1 - Application number: 18/104,207 - Filed: 2023-01-31 - Granted: 2024-02-20 - Earliest claimed: 2023-01-31 - Assignees: Splunk Inc. - Applicants: SPLUNK Inc. - Inventors: Bogdan Cristian Drutu; Filip Slunecko; Charles Joseph Smith; Timothy Matthew Robin Williamson - Web page: https://patentgrep.com/patent/US11907097B1 ## CPC - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 11/3075: {the data filtering being achieved in order to maintain consistency among the monitored data, e.g. ensuring that the monitored data belong to the same timeframe, to the same system or component} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/106: using time related information in packets, e.g. by adding timestamps - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques may include receiving a plurality of spans of trace data at a computing system during a first time period. The techniques may include storing the plurality of spans in a span partition of a data store. The data store can contain a plurality of span partitions with spans that are grouped in the partition by trace identifier. The device may include generating a timestamp partition, with an index of timestamps by trace identifiers, for the first time period. The techniques may include storing the timestamp partition in the data store. Also, the techniques may include identifying at least two timestamp partitions that correspond to a second time period that preceded the first time period. The techniques may include generating and storing a primary compacted timestamp partition by combining the at least two timestamp partitions. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving a plurality of spans of trace data at a computing system during a first time period, where each span of the plurality of spans comprises at least one of trace data, a trace identifier, an organization identifier, or a timestamp; storing the plurality of spans in a span partition of a data store, where the data store contains a plurality of span partitions; generating a timestamp partition for the first time period, where the timestamp partition comprises an index of timestamps by trace identifiers; storing the timestamp partition in the data store, where the data store contains a plurality of timestamp partitions; identifying, in the data store, at least two timestamp partitions that correspond to a second time period that preceded the first time period; generating a primary compacted timestamp partition by combining the at least two timestamp partitions; and storing the primary compacted timestamp partition to the plurality of timestamp partitions in the data store. ### Claim 2 (depends on 1) The method of claim 1, further comprising: receiving, from a computing device, a search request comprising a requested trace identifier; performing, by the computing system, a search of the plurality of timestamp partitions to identify one or more time stamps associated with the requested trace identifier, locating one or more span partitions, of the plurality of span partitions, associated with the one or more timestamps; locating one or more spans associated with the requested trace identifier in the located one or more span partitions; and providing the identified spans to the computing device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: identifying, in the data store, at least two primary compacted timestamp partitions corresponding to a third time period that preceded the second time period; generating a secondary compacted timestamp partition by combining the at least two primary compacted timestamp partitions; and storing the secondary compacted timestamp partition to the data store. ### Claim 4 (depends on 3) The method of claim 3, further comprising: Identifying, in the data store, at least two secondary compacted timestamp partitions corresponding to a fourth time period that preceded the third time period; generating a tertiary compacted timestamp partition by combining the at least two secondary compacted timestamp partitions; and storing the tertiary compacted timestamp partition to the data store. ### Claim 5 (depends on 4) The method of claim 4, further comprising: identifying one or more tertiary compacted timestamp partitions with indexes that contain timestamps that were generated before the fourth time period; and deleting the identified one or more tertiary compacted timestamp partitions. ### Claim 6 (depends on 4) The method of claim 4, wherein the first time period is one (1) minute, the second time period is twenty (20) minutes, the third time period is three (3) hours, and the fourth time period is one (1) day. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of spans of trace data are generated by two or more organizations with the same data retention policy. ### Claim 8 A computing device, comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations comprising: receiving a plurality of spans of trace data at a computing system during a first time period, where each span of the plurality of spans comprises at least one of trace data, a trace identifier, an organization identifier, or a timestamp; storing the plurality of spans in a span partition of a data store, where the data store contains a plurality of span partitions; generating a timestamp partition for the first time period, where the timestamp partition comprises an index of timestamps by trace identifiers; storing the timestamp partition in the data store, where the data store contains a plurality of timestamp partitions; identifying, in the data store, at least two timestamp partitions that correspond to a second time period that preceded the first time period; generating a primary compacted timestamp partition by combining the at least two timestamp partitions; and storing the primary compacted timestamp partition to the plurality of timestamp partitions in the data store. ### Claim 9 (depends on 8) The computing device of claim 8, wherein the operations further comprise: receiving, from a computing device, a search request comprising a requested trace identifier; performing, by the computing system, a search of the plurality of timestamp partitions to identify one or more time stamps associated with the requested trace identifier, locating one or more span partitions, of the plurality of span partitions, associated with the one or more timestamps; locating one or more spans associated with the requested trace identifier in the located one or more span partitions; and providing the identified spans to the computing device. ### Claim 10 (depends on 8) The computing device of claim 8, wherein the operations further comprise: identifying, in the data store, at least two primary compacted timestamp partitions corresponding to a third time period that preceded the second time period; generating a secondary compacted timestamp partition by combining the at least two primary compacted timestamp partitions; and storing the secondary compacted timestamp partition to the data store. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the operations further comprise: Identifying, in the data store, at least two secondary compacted timestamp partitions corresponding to a fourth time period that preceded the third time period; generating a tertiary compacted timestamp partition by combining the at least two secondary compacted timestamp partitions; and storing the tertiary compacted timestamp partition to the data store. ### Claim 12 (depends on 11) The computing device of claim 11, wherein the operations further comprise: identifying one or more tertiary compacted timestamp partitions with indexes that contain timestamps that were generated before the fourth time period; and deleting the identified one or more tertiary compacted timestamp partitions. ### Claim 13 (depends on 11) The computing device of claim 11, wherein the first time period is one (1) minute, the second time period is twenty (20) minutes, the third time period is three (3) hours, and the fourth time period is one (1) day. ### Claim 14 (depends on 8) The computing device of claim 8, wherein the plurality of spans of trace data are generated by two or more organizations with the same data retention policy. ### Claim 15 A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: receiving a plurality of spans of trace data at a computing system during a first time period, where each span of the plurality of spans comprises at least one of trace data, a trace identifier, an organization identifier, or a timestamp; storing the plurality of spans in a span partition of a data store, where the data store contains a plurality of span partitions; generating a timestamp partition for the first time period, where the timestamp partition comprises an index of timestamps by trace identifiers; storing the timestamp partition in the data store, where the data store contains a plurality of timestamp partitions; identifying, in the data store, at least two timestamp partitions that correspond to a second time period that preceded the first time period; generating a primary compacted timestamp partition by combining the at least two timestamp partitions; and storing the primary compacted timestamp partition to the plurality of timestamp partitions in the data store. ### Claim 16 (depends on 15) The non-transitory computer readable of claim 15, wherein the operations further comprise: receiving, from a computing device, a search request comprising a requested trace identifier; performing, by the computing system, a search of the plurality of timestamp partitions to identify one or more time stamps associated with the requested trace identifier, locating one or more span partitions, of the plurality of span partitions, associated with the one or more timestamps; locating one or more spans associated with the requested trace identifier in the located one or more span partitions; and providing the identified spans to the computing device. ### Claim 17 (depends on 15) The non-transitory computer readable of claim 15, wherein the operations further comprise: Identifying, in the data store, at least two primary compacted timestamp partitions corresponding to a third time period that preceded the second time period; generating a secondary compacted timestamp partition by combining the at least two primary compacted timestamp partitions; and storing the secondary compacted timestamp partition to the data store. ### Claim 18 (depends on 17) The non-transitory computer readable of claim 17, wherein the operations further comprise: identifying, in the data store, at least two secondary compacted timestamp partitions corresponding to a fourth time period that preceded the third time period; generating a tertiary compacted timestamp partition by combining the at least two secondary compacted timestamp partitions; and storing the tertiary compacted timestamp partition to the data store. ### Claim 19 (depends on 18) The non-transitory computer readable of claim 18, wherein the operations further comprise: Identifying one or more tertiary compacted timestamp partitions with indexes that contain timestamps that were generated before the fourth time period; and deleting the identified one or more tertiary compacted timestamp partitions. ### Claim 20 (depends on 18) The non-transitory computer readable medium of claim 18, wherein the first time period is one (1) minute, the second time period is twenty (20) minutes, the third time period is three (3) hours, and the fourth time period is one (1) day.