Configuration file management in a search head cluster

1. A method comprising:

receiving, by one or more processing devices of a search head leader of a cluster comprising a plurality of search heads, a first journal entry relating to a first customization of a knowledge object from a first search head of the cluster, wherein the first search head performs a first reduce phase of a first map-reduce search computation of source data in accordance with the first customization, and wherein each search head of the cluster is configured to perform a reduce phase of a map-reduce search computation;

determining, by the one or more processing devices, the first journal entry references a parent commit journal entry matching a latest commit journal entry in a journal stored in a local data store of the search head leader;

storing the first journal entry relating to the first customization of the knowledge object in the journal;

updating a configuration file stored in the local data store of the search head leader to include the first journal entry; and

sending, to the first search head, a communication indicating the updating of the configuration file.

2. The method of claim 1 , further comprising sending the first journal entry stored in the local data store associated with the search head leader to one or more search heads of the cluster.

3. The method of claim 1 , wherein the first customization comprises a customization of at least one of a late-binding schema, a saved search, an event type, a transaction, a tag, a field extraction, a field transform, a lookup, a workflow action, a search command, or a view.

4. The method of claim 1 , wherein the first customization comprises at least one of a change, update, creation, modification, sharing, permissioning, or deletion relating to the knowledge object.

5. The method of claim 1 , wherein the plurality of search heads each comprise a client interface configured to receive one or more customizations from one or more client computing devices.

6. The method of claim 1 , wherein the plurality of search heads each comprise a client interface configured to present one or more customizations shared by the plurality of search heads of the cluster.

7. The method of claim 1 , further comprising:

resolving, by the first search head of the cluster, a conflict between the first customization of the knowledge object and a second customization of the knowledge object processed by a second search head of the cluster.

8. The method of claim 1 , further comprising:

replicating the first customization across the plurality of search heads of the cluster via the search head leader of the cluster, wherein the first customization is communicated via a client interface associated with a second search head of the plurality of search heads of the cluster.

9. The method of claim 1 , further comprising writing, by the search head leader, a configuration setting corresponding to the first customization to the configuration file.

10. The method of claim 1 , further comprising performing a map-reduce search of source data in accordance with the first customization.

11. The method of claim 10 , wherein performing the map-reduce search comprises applying a late binding schema to the source data, the late binding schema associated with one or more extraction rules defining one or more fields in the source data.

12. The method of claim 10 , wherein the source data comprises at least one of aggregated heterogeneous data generated by at least one of a server, a database, an application, or a network, raw machine data, or a plurality of timestamped events, each timestamped event including a portion of raw machine data.

13. The method of claim 1 , wherein the search head leader is configured to synchronize one or more customizations across the plurality of search heads in the cluster.

14. The method of claim 1 , wherein the search head leader is selected from among the plurality of search heads in the cluster using a Raft consensus algorithm.

15. A system comprising:

a local data store; and

a processing device coupled to the local data store, the processing device to execute instructions to:

receive, by a search head leader of a cluster comprising a plurality of search heads, a first journal entry relating to a first customization of a knowledge object from a first search head of the cluster, wherein the first search head performs a first reduce phase of a first map-reduce search computation of source data in accordance with the first customization, and wherein each search head of the cluster is configured to perform a reduce phase of a map-reduce search computation;

determine the first journal entry references a parent commit journal entry matching a latest commit journal entry in a journal stored in a local data store of the search head leader;

store the first journal entry relating to the first customization of the knowledge object in the journal;

update a configuration file stored in the local data store of the search head leader to include the first journal entry; and

send, to the first search head, a communication indicating the update of the configuration file.

16. The system of claim 15 , the processing device to send the first journal entry stored in the local data store associated with the search head leader to one or more search heads of the cluster.

17. The system of claim 15 , the processing device to execute the instructions to write a configuration setting corresponding to the first customization to the configuration file.

18. The system of claim 15 , wherein the search head leader is configured to synchronize one or more customizations across the plurality of search heads in the cluster.

19. A non-transitory computer-readable medium encoding instructions thereon that, in response to execution by one or more processing devices cause the one or more processing devices to perform operations comprising:

receiving, by one or more processing devices of a search head leader of a cluster comprising a plurality of search heads, a first journal entry relating to a first customization of a knowledge object from a first search head of the cluster, wherein the first search head performs a first reduce phase of a first map-reduce search computation of source data in accordance with the first customization, and wherein each search head of the cluster is configured to perform a reduce phase of a map-reduce search computation;

determining, by the one or more processing devices, the first journal entry references a parent commit journal entry matching a latest commit journal entry in a journal stored in a local data store of the search head leader;

storing the first journal entry relating to the first customization of the knowledge object in the journal;

updating a configuration file stored in the local data store of the search head leader to include the first journal entry; and

sending, to the first search head, a communication indicating the updating of the configuration file.

20. The non-transitory computer-readable medium of claim 19 , the operations further comprising sending the first journal entry stored in the local data store associated with the search head leader to one or more search heads of the cluster.