Disaster recovery in a clustered environment using generation identifiers
A method for performing disaster recovery in a clustered environment comprises identifying, at a master device, a first indexer from a set of indexers to serve as a primary indexer for responding to queries pertaining to a subset of data. The method also comprises assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the subset of data. Responsive to an event prompting a change in a primary indexer designation for the subset of data, the method comprises identifying, at the master device, a second indexer from the set of indexers to serve as the primary indexer for responding to queries pertaining to the subset of data. Further, the method comprises assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the subset of data.
1. A method comprising:
receiving, at an indexer, a search affinity identifier, wherein the search affinity identifier indicates that the indexer has primary responsibility for responding to search queries originating from a particular site of a plurality of sites from which a search query may originate, wherein a site represents a group of one or more computing devices corresponding to a particular geographic location, wherein the indexer is one of a plurality of indexers included in a cluster, wherein the cluster is distributed over the plurality of sites, and wherein a master node coordinates searches against data indexed by the plurality of indexers in the cluster;
receiving, at the indexer, a search query and a site identifier identifying a site at which the search query originated;
determining, based on the search affinity identifier and the site identifier, that the indexer has primary responsibility to respond to the search query; and
transmitting results of the search query to the site at which the search query originated.
2. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates for a respective site of the plurality of sites from which a search query may originate whether the indexer has primary responsibility for responding to search queries from the respective site.
3. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates, for a particular subset of data accessible to the indexer and for a respective site of the plurality of sites from which a search query may originate, whether the indexer has primary responsibility for responding to search queries originating from the respective site based on data from the particular subset of data.
4. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates for a respective site of the plurality of sites from which a search query may originate, whether the indexer as primary responsibility for responding to search queries from the respective site, and wherein the search query originates from a first site, and wherein the method further comprises:
receiving, at the indexer, an additional search query including a second site identifier identifying a second site;
determining, based on both the second site identifier and a respective search affinity identifier of the set of search affinity identifiers, that the indexer is not to respond to the additional search query.
5. The method of claim 1 , wherein the search affinity identifier is a bitmask, and wherein each digit of the bitmask represents a respective site of the plurality of sites from which a search query may originate.
6. The method of claim 1 , wherein the group of one or more computing devices corresponding to the particular geographic location is user-specified.
7. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates for a respective site of the plurality of sites from which a search query may originate, whether the indexer as primary responsibility for responding to search queries from the respective site, wherein the set of search affinity identifiers comprises a collection of bitmasks, and wherein the search query originates at a first site, and wherein the method further comprises:
receiving, at the indexer, an additional search query including a second site identifier identifying a second site;
determining, based on both the second site identifier and a respective search affinity identifier of the set of search affinity identifiers, that the indexer is not to respond to the additional search query.
8. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates for a respective site of the plurality of sites from which a search query may originate, whether the indexer as primary responsibility for responding to search queries from the respective site, and wherein the search query originates at a first site, and wherein the method further comprises:
receiving, at the indexer, an additional search query including a second site identifier identifying a second site;
determining, based on both the second site identifier and a respective search affinity identifier of the set of search affinity identifiers, that the indexer is not to respond to the additional search query, wherein the search query and the additional search query are different.
9. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates, for a particular subset of data accessible to the indexer and for a respective site of the plurality of sites from which a search query may originate, whether the indexer has primary responsibility for responding to search queries originating from the respective site based on data from the particular subset of data, and wherein the method further comprises:
receiving, at the indexer, raw data;
separating the raw data into a plurality of events included in the particular subset of data; determining, for each event in the plurality of events, a time stamp; and
storing the particular subset of data in a data store.
10. The method of claim 1 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates, for a particular subset of data accessible to the indexer and for a respective site of the plurality of sites from which a search query may originate, whether the indexer has primary responsibility for responding to search queries originating from the respective site based on data from the particular subset of data, and wherein the method further comprises:
receiving, at the indexer, raw data;
separating the raw data into a plurality of events included in the particular subset of data;
storing the particular subset of data in a data store;
identifying a replication factor that indicates a number of times that the particular subset of data is to be replicated; and
transmitting the particular subset of data to a number of other indexers, wherein the number corresponds to the replication factor.
11. The method of claim 1 , wherein the search affinity identifier is generated by the master node of the cluster.
12. The method of claim 1 , wherein the search affinity identifier is a bitmask, and wherein each digit of the bitmask represents a respective site of the plurality of sites from which a search query may originate, and wherein a value of each digit indicates to the indexer whether the indexer has primary responsibility for searches originating from a respective site.
13. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by a processor, cause the processor to perform operations comprising:
receiving, at an indexer, a search affinity identifier, wherein the search affinity identifier indicates that the indexer has primary responsibility for responding to search queries originating from a particular site of a plurality of sites from which a search query may originate, wherein a site represents a group of one or more computing devices corresponding to a particular geographic location, wherein the indexer is one of a plurality of indexers included in a cluster, wherein the cluster is distributed over the plurality of sites, and wherein a master node coordinates searches against data indexed by the plurality of indexers in the cluster;
receiving, at the indexer, a search query and a site identifier identifying a site at which the search query originated;
determining, based on the search affinity identifier and the site identifier, that the indexer has primary responsibility to respond to the search query; and
transmitting results of the search query to the site at which the search query originated.
14. The non-transitory computer-readable medium of claim 13 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates for a respective site of the plurality of sites from which a search query may originate whether the indexer has primary responsibility for responding to search queries from the respective site.
15. The non-transitory computer-readable medium of claim 13 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates, for a particular subset of data accessible to the indexer and for a respective site of the plurality of sites from which a search query may originate, whether the indexer has primary responsibility for responding to search queries originating from the respective site based on data from the particular subset of data.
16. The non-transitory computer-readable medium of claim 13 , wherein the search affinity identifier is a bitmask, and wherein each digit of the bitmask represents a respective site of the plurality of sites from which a search query may originate, and wherein a value of each digit indicates to the indexer whether the indexer has primary responsibility for searches originating from a respective site.
17. A system comprising:
at least one memory storing computer-executable instructions; and
at least one processor, wherein the at least one processor is configured to access the at least one memory and to execute the computer-executable instructions to:
receive, at an indexer, a search affinity identifier, wherein the search affinity identifier indicates that the indexer has primary responsibility for responding to search queries originating from a particular site of a plurality of sites from which a search query may originate, wherein a site represents a group of one or more computing devices corresponding to a particular geographic location, wherein the indexer is one of a plurality of indexers included in a cluster, wherein the cluster is distributed over the plurality of sites, and wherein a master node coordinates searches against data indexed by the plurality of indexers in the cluster;
receive, at the indexer, a search query and a site identifier identifying a site at which the search query originated;
determine, based on the search affinity identifier and the site identifier, that the indexer has primary responsibility to respond to the search query; and
transmit results of the search query to the site at which the search query originated.
18. The system of claim 17 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates for a respective site of the plurality of sites from which a search query may originate whether the indexer has primary responsibility for responding to search queries from the respective site.
19. The system of claim 17 , wherein the search affinity identifier received at the indexer is one of a set of search affinity identifiers received at the indexer, wherein each search affinity identifier indicates, for a particular subset of data accessible to the indexer and for a respective site of the plurality of sites from which a search query may originate, whether the indexer has primary responsibility for responding to search queries originating from the respective site based on data from the particular subset of data.
20. The system of claim 17 , wherein the search affinity identifier is generated by a master node of a cluster, wherein the cluster comprises a plurality of indexers including the indexer, and wherein the cluster is distributed over the plurality of sites.