# US 8,788,459 B2 · Clustering for high availability and disaster recovery > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,459 B2 - Document ID: US8788459B2 - Status: Granted - Kind: B2 - Application number: 13/648,116 - Filed: 2012-10-09 - Published: 2013-11-21 - Granted: 2014-07-22 - Earliest claimed: 2012-05-15 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Vishal Patel; Mitchell Neuman Blank, Jr.; Sundar Rengarajan Vasan; Stephen Phillip Sorkin - Web page: https://patentgrep.com/patent/US8788459B2 ## CPC - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 11/2097: {maintaining the standby controller/processing unit updated (initialisation or re-synchronisation thereof G06F11/1658 and subgroups)} - G06F 16/22: Indexing; Data structures therefor; Storage structures - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments are directed towards managing within a cluster environment having a plurality of indexers for data storage using redundancy the data being managed using a generation identifier, such that a primary indexer is designated for a given generation of data. When a master device for the cluster fails, data may continue to be stored using redundancy, and data searches performed may still be performed. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving, at an indexer, (i) a first query to search a subset of data accessible to the indexer, and (ii) a first identifier indicating that the indexer has primary responsibility for responding to the first query with a result from a search of the subset of data that is based on the first query; receiving, at the indexer, (i) a second query to search the subset of data and (ii) a second identifier different from the first identifier and indicating that the indexer does not have primary responsibility for responding to the second query with a result from a search of the subset of data that is based on the second query; determining, at the indexer, based on the first identifier, and independent from having access to the subset of data, that the indexer should respond to the first query with the result from the search of the subset of data that is based on the first query; and determining, at the indexer, based on the second identifier, and independent from having access to the subset of data, that the indexer should not respond to the second query with the result from the search of the subset of data that is based on the second query. ### Claim 2 (depends on 1) The method of claim 1, wherein the first query and the second query are identical. ### Claim 3 (depends on 1) The method of claim 1, wherein the first query and the second query differ. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, at the indexer, raw data; separating the raw data into a plurality of events included in the subset of data; determining, for each event in the plurality of events, a time stamp; and storing each event in the plurality of events in a manner making it searchable by the indexer. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; and based on storing the subset of data, sending an acknowledgement message. ### Claim 6 (depends on 1) The method of claim 1, further comprising, prior to receiving the first query: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; identifying a replication factor that indicates a number of times that the subset of data is to be replicated; and forwarding the subset of data to a number of other indexers, wherein the number corresponds to the replication factor. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; identifying, at the indexer, a replication factor that indicates a number of times that the subset of data is to be replicated; forwarding, by the indexer, the subset of data to a number of other indexers, wherein the number corresponds to the replication factor; determining that an acknowledgement receipt, responsive to the forwarding the subset of data, has not been received from at least one of the other indexers; and upon determining that the acknowledgement receipt has not been received, forwarding the subset of data to another indexer not in the other indexers. ### Claim 8 (depends on 1) The method of claim 1, wherein a copy of the subset of data is accessible by at least one other indexer, and wherein the first identifier indicates that the at least one other indexer does not have primary responsibility for responding to the first query with the result from the search of the subset of data that is based on the first query. ### Claim 9 (depends on 1) The method of claim 1, wherein the indexer determines that the indexer should respond to the first query with the result from the search of the subset of data that is based on the first query by comparing the first identifier with a notification from a master about when the indexer should respond to a query associated with a given identifier. ### Claim 10 A system comprising: one or more data processors; and a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including: receiving, at an indexer, (i) a first query to search a subset of data accessible to the indexer, and (ii) a first identifier indicating that the indexer has primary responsibility for responding to the first query with a result from a search of the subset of data that is based on the first query; receiving, at the indexer, (i) a second query to search the subset of data and (ii) a second identifier different from the first identifier and indicating that the indexer does not have primary responsibility for responding to the second query with a result from a search of the subset of data that is based on the second query; determining, at the indexer, based on the first identifier, and independent from having access to the subset of data, that the indexer should respond to the first query with the result from the search of the subset of data that is based on the first query; and determining, at the indexer, based on the second identifier, and independent from having access to the subset of data, that the indexer should not respond to the second query with the result from the search of the subset of data that is based on the second query. ### Claim 11 (depends on 10) The system of claim 10, wherein the first query and the second query are identical. ### Claim 12 (depends on 10) The system of claim 10, wherein the first query and the second query differ. ### Claim 13 (depends on 10) The system of claim 10, the operations further comprising: receiving, at the indexer, raw data; separating the raw data into a plurality of events included in the subset of data; determining, for each event in the plurality of events, a time stamp; and storing each event in the plurality of events in a manner making it searchable by the indexer. ### Claim 14 (depends on 10) The system of claim 10, the operations further comprising: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; and based on storing the subset of data, sending an acknowledgement message. ### Claim 15 (depends on 10) The system of claim 10, the operations further comprising, prior to receiving the first query: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; identifying a replication factor that indicates a number of times that the subset of data is to be replicated; and forwarding the subset of data to a number of other indexers, wherein the number corresponds to the replication factor. ### Claim 16 (depends on 10) The system of claim 10, the operations further comprising: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; identifying, at the indexer, a replication factor that indicates a number of times that the subset of data is to be replicated; forwarding, by the indexer, the subset of data to a number of other indexers, wherein the number corresponds to the replication factor; determining that an acknowledgement receipt, responsive to the forwarding the subset of data, has not been received from at least one of the other indexers; and upon determining that the acknowledgement receipt has not been received, forwarding the subset of data to another indexer not in the other indexers. ### Claim 17 (depends on 10) The system of claim 10, wherein a copy of the subset of data is accessible by at least one other indexer, and wherein the first identifier indicates that the at least one other indexer does not have primary responsibility for responding to the first query with the result from the search of the subset of data that is based on the first query. ### Claim 18 (depends on 10) The system of claim 10, wherein the indexer determines that the indexer should respond to the first query with the result from the search of the subset of data that is based on the first query by comparing the first identifier with a notification from a master about when the indexer should respond to a query associated with a given identifier. ### Claim 19 A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions to cause one or more data processors perform operations including: receiving, at an indexer, (i) a first query to search a subset of data accessible to the indexer, and (ii) a first identifier indicating that the indexer has primary responsibility for responding to the first query with a result from a search of the subset of data that is based on the first query; receiving, at the indexer, (i) a second query to search the subset of data and (ii) a second identifier different from the first identifier and indicating that the indexer does not have primary responsibility for responding to the second query with a result from a search of the subset of data that is based on the second query; determining, at the indexer, based on the first identifier, and independent from having access to the subset of data, that the indexer should respond to the first query with the result from the search of the subset of data that is based on the first query; and determining, at the indexer, based on the second identifier, and independent from having access to the subset of data, that the indexer should not respond to the second query with the result from the search of the subset of data that is based on the second query. ### Claim 20 (depends on 19) The computer-program product of claim 19, wherein the first query and the second query are identical. ### Claim 21 (depends on 19) The computer-program product of claim 19, wherein the first query and the second query differ. ### Claim 22 (depends on 19) The computer-program product of claim 19, the operations further comprising: receiving, at the indexer, raw data; separating the raw data into a plurality of events included in the subset of data; determining, for each event in the plurality of events, a time stamp; and storing each event in the plurality of events in a manner making it searchable by the indexer. ### Claim 23 (depends on 19) The computer-program product of claim 19, the operations further comprising: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; and based on storing the subset of data, sending an acknowledgement message. ### Claim 24 (depends on 19) The computer-program product of claim 19, the operations further comprising, prior to receiving the first query: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; identifying a replication factor that indicates a number of times that the subset of data is to be replicated; and forwarding the subset of data to a number of other indexers, wherein the number corresponds to the replication factor. ### Claim 25 (depends on 19) The computer-program product of claim 19, the operations further comprising: receiving, at the indexer, the subset of data; storing, by the indexer, the subset of data; identifying, at the indexer, a replication factor that indicates a number of times that the subset of data is to be replicated; forwarding, by the indexer, the subset of data to a number of other indexers, wherein the number corresponds to the replication factor; determining that an acknowledgement receipt, responsive to the forwarding the subset of data, has not been received from at least one of the other indexers; and upon determining that the acknowledgement receipt has not been received, forwarding the subset of data to another indexer not in the other indexers. ### Claim 26 (depends on 19) The computer-program product of claim 19, wherein a copy of the subset of data is accessible by at least one other indexer, and wherein the first identifier indicates that the at least one other indexer does not have primary responsibility for responding to the first query with the result from the search of the subset of data that is based on the first query. ### Claim 27 (depends on 19) The computer-program product of claim 19, wherein the indexer determines that the indexer should respond to the first query with the result from the search of the subset of data that is based on the first query by comparing the first identifier with a notification from a master about when the indexer should respond to a query associated with a given identifier. ### Claim 28 (depends on 1) The method of claim 1, wherein the search of the subset of data that is based on the first query is identical to the search of the subset of data that is based on the second query. ### Claim 29 (depends on 1) The method of claim 1, wherein the search of the subset of data that is based on the first query differs from the search of the subset of data that is based on the second query. ### Claim 30 (depends on 1) The method of claim 1, wherein the first query also requires a search of a second subset of data accessible to the indexer, and wherein the first identifier also indicates that the indexer does not have primary responsibility for responding to the first query with a result from a search of the second subset of data that is based on the first query.