Cursored searches in a data fabric service system
AssigneeSplunk Inc.
InventorsArindam Bhattacharjee, Sourav Pal, Christopher Pride
Life of this patent
Estimating the term…
Abstract
The disclosed embodiments include techniques to obtain ordered search results based on partial search results from across multiple diverse internal and/or external data sources. The ordering of the search results may be with respect to a parameter associated with the partial search results. An example of a parameter includes time. As such, the disclosed technique can provide a time-ordered search result based on partial search results obtained from across multiple internal and/or external data sources. Moreover, the disclosed technique can provide time-ordered search results regardless of whether the partial search results obtained from the diverse data sources are timestamped.
Claims31
-30. (canceled)
A computer-implemented method for performing a time-ordered search operation across one or more worker nodes, the method comprising:
- obtaining partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query, and wherein at least one of the partial search results comprises one or more events, each event being associated with a timestamp and including raw machine data reflective of activity within an information technology infrastructure;
- performing one or more transformation operations on at least a portion of the partial search results to produce commonly formatted partial search results;
- determining which of the commonly formatted partial search results are time-stamped and which of the commonly formatted partial search results are not time-stamped;
- and
- processing each commonly formatted partial search result according to whether the commonly formatted partial search result is time-stamped or not time-stamped to generate time-ordered chunks of commonly formatted partial search results.
A non-transitory computer-readable medium including instructions that, when executed by a processor included in a worker node, cause the processor to perform the steps of:
- obtaining partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query, and wherein at least one of the partial search results comprises one or more events, each event being associated with a timestamp and including raw machine data reflective of activity within an information technology infrastructure;
- performing one or more transformation operations on at least a portion of the partial search results to produce commonly formatted partial search results;
- determining which of the commonly formatted partial search results are time-stamped and which of the commonly formatted partial search results are not time-stamped;
- and
- processing each commonly formatted partial search result according to whether the commonly formatted partial search result is time-stamped or not time-stamped to generate time-ordered chunks of commonly formatted partial search results.
A system, comprising:
- one or more worker nodes, wherein each worker node includes a processor and a memory that stores respective instructions, and, when each processor executes the respective instructions, the one or more worker nodes are configured to:
- obtain partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query, and wherein at least one of the partial search results comprises one or more events, each event being associated with a timestamp and including raw machine data reflective of activity within an information technology infrastructure;
- perform one or more transformation operations on at least a portion of the partial search results to produce commonly formatted partial search results;
- determine which of the commonly formatted partial search results are time-stamped and which of the commonly formatted partial search results are not time-stamped;
- and
- process each commonly formatted partial search result according to whether the commonly formatted partial search result is time-stamped or not time-stamped to generate time-ordered chunks of commonly formatted partial search results.
Dependencies are inferred from the claim text.