IP Library Granted Patent US 10,509,784
Granted Patent B2
US 10,509,784 · App. 15/582,519 · Granted Dec 17, 2019

Partially typed semantics optimization

Inventors: Alexander Douglas James (Sammamish, WA); David Ryan Marquardt (San Francisco, CA); Karthikeyan Sabhanatarajan (San Francisco, CA)
Assignee: Splunk Inc.
G06F16/24542
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,509,784
App. No.
15/582,519
Granted
Dec 17, 2019
Kind
B2
Abstract

A method includes receiving an initial pipeline including a sequence of commands for execution on a computing system, and obtaining, for each command in the sequence of commands, semantic information. The sequence of commands includes a command with incomplete semantic information. The method further includes generating an abstract semantic tree (AST) with the semantic information and a placeholder for the incomplete semantic information, and manipulating the AST to generate a revised AST. The revised AST corresponds to a revised pipeline that reduces an execution time on the computing system. The method further includes executing the revised pipeline.

Claims (91)

1. A method implemented by a computing device, the method comprising:

receiving, at the computing device, input corresponding to a sequence of commands for execution on a computing system, each command in the sequence of commands including an identifier corresponding to an operation to be executed by the computing system and one or more parameters;

obtaining, for each command in the sequence of commands, semantic information, wherein the semantic information describes behavior of each command in view of respective parameters associated with the command;

determining, for a particular command in the sequence of commands, that respective semantic information for the particular command is incomplete, wherein, based on the respective semantic information being incomplete, behavior of the particular command is unknown;

generating an abstract semantic tree (AST) including a node for each command in the sequence of commands, wherein the AST includes the semantic information and a placeholder for the respective semantic information for the particular command;

determining a first execution time of the sequence of instructions based on a first possible modification of the AST;

determining a second execution time of the sequence of instructions using a second possible modification of the AST;

modifying, in response to determining that the first execution time is less than the second execution time, the AST using the first possible modification, wherein modifying results in a revised AST;

generating, using the revised AST, a revised sequence of commands; and

executing the revised sequence of commands.

2. The method of claim 1 , further comprising:

parsing the input into the sequence of commands.

3. The method of claim 1 , further comprising:

invoking, for each command in the sequence of commands, a corresponding command processor with a request for the semantic information; and

receiving, for each command in the sequence of commands, semantic information comprising known semantics of the command from the corresponding command processor.

4. The method of claim 1 , wherein executing the revised pipeline comprises:

invoking, in order specified by the revised sequence of commands, a command processor for each corresponding command in the revised sequence of commands with a request execute the corresponding command.

5. The method of claim 1 , further comprising:

receiving, by a pipeline interface, the input;

determining, by the pipeline interface, whether an optimizer is enabled or disabled; and

passing, by the pipeline interface and in response to the determining the optimizer is enabled, the input to the optimizer to create the revised sequence of commands.

6. The method of claim 1 , wherein manipulating the AST comprises:

performing predicate pushdown on the AST to generate the revised AST.

7. The method of claim 1 , wherein manipulating the AST comprises:

performing projection elimination on the AST to generate the revised AST.

8. The method of claim 1 , wherein generating the revised AST is performed before any command of the input is executed.

9. The method of claim 1 , wherein the input is a query evaluation pipeline.

10. The method of claim 1 , wherein the input comprises a search command, an evaluation command, and a statistics command.

11. The method of claim 1 , further comprising:

distributing a revised query in the revised sequence of commands to a plurality of indexers to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the sequence of commands;

executing an evaluation command in the revised pipeline on the plurality of events to obtain at least one result; and

executing a statistics command in the revised sequence of commands to obtain a statistic from the at least one result.

12. The method of claim 1 , further comprising:

distributing a revised query in the revised sequence of commands to a plurality of indexers to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the sequence of commands, wherein each event in the plurality of events correspond to a portion of raw machine data associated with a timestamp;

executing an evaluation command in the revised sequence of commands on the plurality of events to obtain at least one result; and

executing a statistics command in the revised sequence of commands to obtain a statistic from the at least one result.

13. The method of claim 1 , wherein execution of the revised sequence of commands is based on a late-binding schema.

14. The method of claim 1 , further comprising:

searching raw machine data using a revised query in the revised sequence of commands to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the sequence of commands.

15. A system comprising:

a computing system for executing a revised pipeline;

a computer processor for executing instructions that cause the computer processor to perform operations comprising:

receiving input corresponding to a sequence of commands for execution on the computing system, each command in the sequence of commands including an identifier corresponding to an operation to be executed by the computing system and one or more parameters;

obtaining, for each command in the sequence of commands, semantic information, wherein the semantic information describes behavior of each command in view of respective parameters associated with the command;

determining, for a particular command in the sequence of commands, that respective semantic information for the particular command is incomplete, wherein, based on the respective semantic information being incomplete, behavior of the particular command is unknown;

generating an abstract semantic tree (AST) including a node for each command in the sequence of commands, wherein the AST includes the semantic information and a placeholder for the respective semantic information for the particular command;

determining a first execution time of the sequence of instructions based on a first possible modification of the AST;

determining a second execution time of the sequence of instructions using a second possible modification of the AST;

modifying, in response to determining that the first execution time is less than the second execution time, the AST using the first possible modification, wherein modifying results in a revised AST;

generating, using the revised AST, a revised sequence of commands; and

executing the revised sequence of commands.

16. The system of claim 15 , wherein the operations further comprise:

invoking, for each command in the sequence of commands, a corresponding command processor with a request for the semantic information; and

receiving, for each command in the sequence of commands, semantic information comprising known semantics of the command from the corresponding command processor.

17. The system of claim 15 , wherein manipulating the AST comprises:

performing predicate pushdown on the AST to generate the revised AST.

18. The system of claim 15 , wherein manipulating the AST comprises:

performing projection elimination on the AST to generate the revised AST.

19. The system of claim 15 , wherein generating the revised AST is performed before any command of the sequence of commands is executed.

20. The system of claim 15 , wherein the sequence of commands is a query evaluation pipeline.

21. The system of claim 15 , wherein operations further comprise:

distributing a revised query in the revised sequence of commands to a plurality of indexers to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the sequence of commands, wherein each event in the plurality of events correspond to a portion of raw machine data associated with a timestamp;

executing an evaluation command in the revised sequence of commands on the plurality of events to obtain at least one result; and

executing a statistics command in the revised sequence of commands to obtain a statistic from the at least one result.

22. The system of claim 15 , wherein the operations further comprise:

searching raw machine data using a revised query in the revised sequence of commands to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the sequence of commands.

23. A non-transitory computer-readable storage medium storing computer-readable program code which, when executed by one or more processors, cause the one or more processors to perform operations, comprising:

receiving input corresponding to a sequence of commands for execution on a computing system, each command in the sequence of commands including an identifier corresponding to an operation to be executed by the computing system and one or more parameters;

obtaining, for each command in the sequence of commands, semantic information, wherein the semantic information describes behavior of each command in view of respective parameters associated with the command;

determining, for a particular command in the sequence of commands, that respective semantic information for the particular command is incomplete, wherein, based on the respective semantic information being incomplete, behavior of the particular command is unknown;

generating an abstract semantic tree (AST) including a node for each command in the sequence of commands, wherein the AST includes the semantic information and a placeholder for the respective semantic information for the particular command;

determining a first execution time of the sequence of instructions based on a first possible modification of the AST;

determining a second execution time of the sequence of instructions using a second possible modification of the AST;

modifying, in response to determining that the first execution time is less than the second execution time, the AST using the first possible modification, wherein modifying results in a revised AST;

generating, using the revised AST, a revised sequence of commands; and

executing the revised sequence of commands.

24. The non-transitory computer readable medium of claim 23 , wherein the operations further comprise:

invoking, for each command in the sequence of commands, a corresponding command processor with a request for the semantic information; and

receiving, for each command in the sequence of commands, semantic information comprising known semantics of the command from the corresponding command processor.

25. The non-transitory computer readable medium of claim 23 , wherein manipulating the AST comprises:

performing predicate pushdown on the AST to generate the revised AST.

26. The non-transitory computer readable medium of claim 23 , wherein manipulating the AST comprises:

performing projection elimination on the AST to generate the revised AST.

27. The non-transitory computer readable medium of claim 23 , wherein generating the revised AST is performed before any command of the sequence of commands is executed.

28. The non-transitory computer readable medium of claim 23 , wherein the sequence of commands is a query evaluation pipeline.

29. The non-transitory computer readable medium of claim 23 , wherein the operations further comprise:

distributing a revised query in the revised sequence of commands to a plurality of indexers to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the sequence of commands, wherein each event in the plurality of events correspond to a portion of raw machine data associated with a timestamp;

executing an evaluation command in the revised sequence of commands on the plurality of events to obtain at least one result; and

executing a statistics command in the revised sequence of commands to obtain a statistic from the at least one result.

30. The non-transitory computer readable medium of claim 23 , wherein the operations further comprise:

searching raw machine data using a revised query in the revised sequence of commands to obtain a plurality of events, the revised query further limiting a number of events returned from an original query in the sequence of commands based on an evaluation command in the initial pipeline.

Assignments (5)
CHANGE OF NAME Recorded Jul 22, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 072170/0599 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 22, 2025
From: SPLUNK LLC
To: CISCO TECHNOLOGY, INC.
Reel/Frame 072173/0058 →
CHANGE OF NAME Recorded Jan 6, 2025
From: SPLUNK INC.
To: SPLUNK LLC
Reel/Frame 069825/0558 →
CORRECTIVE ASSIGNMENT TO CORRECT THE NAME OF THE ASSIGNEE FROM "SPLUNK, INC." TO --SPLUNK INC.-- PREVIOUSLY RECORDED AT REEL: 045618 FRAME: 0582. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Recorded Oct 2, 2020
From: JAMES, ALEXANDER DOUGLAS; MARQUARDT, DAVID RYAN; SABHANATARAJAN, KARTHIKEYAN
To: SPLUNK INC.
Reel/Frame 053969/0493 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 24, 2018
From: JAMES, ALEXANDER DOUGLAS; MARQUARDT, DAVID RYAN; SABHANATARAJAN, KARTHIKEYAN
To: SPLUNK INC.
Reel/Frame 045618/0582 →
Continuity (1)
Related Publication 20180314734A1 · Nov 1, 2018