# US 2018/0322202 A1 · Generating search queries based on query formats for disparate data collections systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0322202 A1 - Document ID: US20180322202A1 - Status: Published application - Kind: A1 - Application number: 16/032,890 - Filed: 2018-07-11 - Published: 2018-11-08 - Earliest claimed: 2013-05-03 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Ledion Bitincka; Steve Zhang; Igor Stojanovski; Stephen Sorkin - Web page: https://patentgrep.com/patent/US20180322202A1 ## CPC - G06F 16/951: Indexing; Web crawling techniques - G06F 16/2455: Query execution - G06F 16/24568: {Data stream processing; Continuous queries} - G06F 16/2471: {Distributed queries} - G06F 16/90335: {Query processing} - G06F 16/953: Querying, e.g. by the use of web search engines - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A search request received at a computer of a search support system is processed by analyzing the received search request to identify request parameters and connecting to a system index of the search support system that is referenced in the request parameters. An external result provider (ERP) process is initiated that establishes communication between the search support system and a data source external to the search support system, for a virtual index referenced in the request parameters. Thus, the ERP process provides an interface between the search support system and external data sources, such as by third parties. The ERP process can operate in a streaming mode (providing realtime search results with minimal processing) and/or a reporting mode (providing results with a greater delay and processing extent) and can switch between modes. The search request results are received from the connected system indexes and the referenced virtual indexes. ## Claims ### Claim 1 A computer-implemented method, comprising: identifying, based on a first query, a second data collection system, wherein at least a first portion of the first query is formatted in a first format, a first set of indices of a first data collection system is searchable via the first format; determining, based on the identified second data collection system, a second format that is associated with the second data collection system, wherein the second data collection system is inaccessible by a first indexer of the first data collection system; generating, based on at least first portion of the first search query and the second format, a second query that is formatted in the second format; providing the second query to the second data collection system; and receiving search results that are based on employing the second query to search the second data collection system. ### Claim 2 (depends on 1) The method as recited in claim 1, further comprising: receiving, at the first data collection system, the first query; and identifying, at the first data collection system, the second data collection system. ### Claim 3 (depends on 1) The method as recited in claim 1, further comprising: causing display of information that is based at least on a portion of the received search results. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein a second set of indices of the second data collection system is searchable via the second format and the second format and the search results are generated in response to a search of the second set of indices based on the second query. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the first query is a search query and generating the second query includes converting the first portion of the first query from the first format to the second format. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the second format is different than the first format, the second format is incompatible with the first data collection system, and the first format is incompatible with the second data collection. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the first data collection system is a local data collection system and the second data collection system is a remote data collection system. ### Claim 8 (depends on 1) The method as recited in claim 1, wherein at least a portion of the search results are generated in response to a search of the first set of indices based on a second portion of the first query. ### Claim 9 (depends on 1) The method as recited in claim 1 wherein a second portion of the first query is fulfilled by a search head. ### Claim 10 (depends on 1) The method as recited in claim 1 wherein the search results are received at the first data collection system from the second data collection system. ### Claim 11 (depends on 1) The method as recited in claim 1, further comprising: identifying at least a second portion of the first query that is associated with the first data collection system; providing the second portion of the first query to the first data collection system; and receiving a second portion of the search results from the first data collection system. ### Claim 12 (depends on 1) The method as recited in claim 1, further comprising: identifying at least a second portion of the first query that is associated with the first data collection system; and providing the second portion of the search query to the first data collection system; receiving a second portion of the search results from the first data collection system; and integrating the search results received from the external data collection system with the search results received from the local data collection system. ### Claim 13 (depends on 1) The method as recited in claim 1, further comprising: caching the search results; and in response to receiving a third query that includes parameters satisfied by a particular set of cached search results, returning the particular set of cached search results. ### Claim 14 (depends on 1) The method as recited in claim 1, further comprising: spawning a process to handle search query communications with the second data collection system. ### Claim 15 (depends on 1) The method as recited in claim 1 wherein the second data collection system comprises a Hadoop system. ### Claim 16 (depends on 1) The method as recited in claim 1 wherein the second data collection system comprises a Cassandra system. ### Claim 17 (depends on 1) The method as recited in claim 1 wherein the second data collection system comprises a MongoDB system. ### Claim 18 (depends on 1) The method as recited in claim 1 wherein the second data collection system comprises any of: a relational database management system or a structured query language system. ### Claim 19 (depends on 1) The method as recited in claim 1, further comprising: analyze the first query; and in response to analyzing the first query, connecting to a second set of indices of the second data collection system. ### Claim 20 (depends on 1) The method as recited in claim 1, further comprising: in response to identifying the second data collection system, initiating an external results provider (ERP) process; employing the ERP process to provide the second query to the second data collection system; and employing the ERP process to revive at least the portion of the search results from the second data collection system. ### Claim 21 A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform actions comprising: identifying, based on a first query, a second data collection system, wherein at least a first portion of the first query is formatted in a first format, a first set of indices of a first data collection system is searchable via the first format; determining, based on the identified second data collection system, a second format that is associated with the second data collection system, wherein the second data collection system is inaccessible by a first indexer of the first data collection system; generating, based on at least first portion of the first search query and the second format, a second query that is formatted in the second format; providing the second query to the second data collection system; and receiving search results that are based on employing the second query to search the second data collection system. ### Claim 22 (depends on 21) The computer-readable medium as recited in claim 21, wherein the action further comprise: receiving, at the first data collection system, the first query; and identifying, at the first data collection system, the second data collection system. ### Claim 23 (depends on 21) The computer-readable medium as recited in claim 21, further comprising: causing display of information that is based at least on a portion of the received search results. ### Claim 24 (depends on 21) The computer-readable medium as recited in claim 21, wherein a second set of indices of the second data collection system is searchable via the second format and the second format and the search results are generated in response to a search of the second set of indices based on the second query. ### Claim 25 (depends on 21) The computer-readable medium as recited in claim 21, wherein the first query is a search query and generating the second query includes converting the first portion of the first query from the first format to the second format. ### Claim 26 (depends on 21) The computer-readable medium as recited in claim 21, wherein the second format is different than the first format, the second format is incompatible with the first data collection system, and the first format is incompatible with the second data collection. ### Claim 27 A computing system, comprising: a processor device; and a computer-readable storage medium, coupled with the processor device, having instructions stored thereon, which, when executed by the processor device, train a machine vision model (MVM) by performing actions comprising: identifying, based on a first query, a second data collection system, wherein at least a first portion of the first query is formatted in a first format, a first set of indices of a first data collection system is searchable via the first format; determining, based on the identified second data collection system, a second format that is associated with the second data collection system, wherein the second data collection system is inaccessible by a first indexer of the first data collection system; generating, based on at least first portion of the first search query and the second format, a second query that is formatted in the second format; providing the second query to the second data collection system; and receiving search results that are based on employing the second query to search the second data collection system. ### Claim 28 (depends on 27) The computing system of claim 27, the actions further comprising: receiving, at the first data collection system, the first query; and identifying, at the first data collection system, the second data collection system. ### Claim 29 (depends on 27) The computing system of claim 27, wherein the second data collection system is inaccessible by a first indexer of the first data collection system and the first data collection system is inaccessible by a second indexer of the second data collection system. ### Claim 30 (depends on 27) The computing system of claim 27, wherein a second set of indices of the second data collection system is searchable via the second format and the second format and the search results are generated in response to a search of the second set of indices based on the second query.