Co-located deployment of a data fabric service system

A method, comprising:

• launching, by a data intake and query system comprising a cluster of search heads, a master control to coordinate control of a search service;
• launching, by the data intake and query system, a plurality of worker nodes, each worker node of the plurality of worker nodes communicatively coupled to the master control;
• receiving, by the data intake and query system, a search query;
• initiating, by a search head of the cluster of search heads, a local search session of the search service;
• triggering, by the search head, a distributed search of internal data stores and external data stores using one or more indexers communicatively coupled to the search head, wherein the internal data stores store data as a plurality of time-indexed events including portions of raw machine data;
• retrieving, using the one or more indexers, first partial search results from the internal data stores;
• sending, using the one or more indexers, the first partial search results to the plurality of worker nodes, wherein the plurality of worker nodes obtain second partial search results from the external data stores, aggregate the first partial search results and the second partial search results into aggregated partial search results and send the aggregated partial search results to the master control;
• receiving, by the search head, the aggregated partial search results from the master control;
• and
• rendering an output of the aggregated partial search results or data indicative of the aggregated partial search results for display on a user interface of a display device associated with a user.

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• launch a master control to coordinate control of a search service;
• launch a plurality of worker nodes, each worker node of the plurality of worker nodes communicatively coupled to the master control;
• receive a search query;
• initiate a local search session of the search service;
• trigger a distributed search of internal data stores and external data stores wherein the internal data stores store data as a plurality of time-indexed events including portions of raw machine data;
• retrieve first partial search results from the internal data stores;
• send the first partial search results to the plurality of worker nodes, wherein the plurality of worker nodes obtain second partial search results from the external data stores, aggregate the first partial search results and the second partial search results into aggregated partial search results and send the aggregated partial search results to the master control;
• receive the aggregated partial search results from the master control;
• and
• render an output of the aggregated partial search results or data indicative of the aggregated partial search results for display on a user interface of a display device associated with a user.

A non-transitory computer-readable medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• launching a master control to coordinate control of a search service;
• launching a plurality of worker nodes, each worker node of the plurality of worker nodes communicatively coupled to the master control;
• receiving a search query;
• initiating a local search session of the search service;
• triggering a distributed search of internal data stores and external data stores wherein the internal data stores store data as a plurality of time-indexed events including portions of raw machine data;
• retrieving first partial search results from the internal data stores;
• sending the first partial search results to the plurality of worker nodes, wherein the plurality of worker nodes obtain second partial search results from the external data stores, aggregate the first partial search results and the second partial search results into aggregated partial search results and send the aggregated partial search results to the master control;
• receiving the aggregated partial search results from the master control;
• and
• rendering an output of the aggregated partial search results or data indicative of the aggregated partial search results for display on a user interface of a display device associated with a user.