Granted Patent B2

US 12,613,864 · App. 18/609,798 · Granted Apr 28, 2026

Inventors: Sourav Pal (Foster City, CA); Arindam Bhattacharjee (Fremont, CA)

Assignee: Cisco Technology, Inc.

G06F16/24535G06F16/219G06F16/24554G06F16/24568G06F16/2471G06F16/25G06F16/288G06F40/205

Abstract

Claims (89)

1 . A computer-implemented method, comprising:

receiving, at a data intake and query system including a search head, a query identifying a set of data to be processed and a manner of processing the set of data, wherein the data intake and query system comprises at least one computing device;

determining that the set of data includes at least a first subset of data associated with an external data system;

obtaining search configuration data from the external data system;

determining a subquery for the external data system based on the search configuration data obtained from the external data system, the subquery identifying the first subset of data and a manner of processing the first subset of data;

generating instructions for one or more worker nodes to receive and process results of the subquery to form first processed results and to provide the first processed results to the data intake and query system;

communicating the subquery to the external data system using the one or more worker nodes,

wherein at least one worker node communicates the subquery to the external data system,

wherein the external data system processes the first subset of data based on the subquery and distributes the results of the subquery to the one or more worker nodes over a network, and

wherein the one or more worker nodes process the results of the subquery based on the instructions; and

receiving the first processed results from the external data system via the one or more worker nodes.

2 . The method of claim 1 , wherein obtaining the search configuration data comprises:

assigning at least one of the one or more worker nodes to request a version identifier from the external data system;

receiving, at the at least one of the one or more worker nodes, the version identifier; and

based on the version identifier, requesting the search configuration data from the external data system.

3 . The method of claim 1 , further comprising:

determining that the set of data includes a second subset of data associated with the data intake and query system;

generating a second subquery for the data intake and query system, the second subquery for the data intake and query system identifying the second subset of data and a manner of processing the second subset of data, and

generating instructions for the one or more worker nodes to receive and process results of the second subquery for the data intake and query system to form second processed results and to provide the second processed results to the data intake and query system.

4 . The method of claim 1 , further comprising:

determining that the set of data includes a second subset of data associated with the data intake and query system;

generating a second subquery for the data intake and query system, the second subquery for the data intake and query system identifying the second subset of data and a manner of processing the second subset of data; and

generating instructions for the one or more worker nodes to:

receive and process results of the second subquery for the data intake and query system to generate second processed results,

combine and process the first processed results and second processed results to form combined processed results, and

provide the combined processed results to the data intake and query system.

5 . The method of claim 1 , wherein the data intake and query system and the external data system each independently execute queries other than the query.

6 . The method of claim 1 , wherein the data intake and query system and the external data system each independently receive queries other than the query, generate subqueries based on the queries, and execute the subqueries.

7 . The method of claim 1 , wherein the external data system includes one or more search heads and one or more indexers.

8 . The method of claim 1 , wherein determining that the set of data includes at least the first subset of data comprises:

parsing the query;

based on identifying a search parameter in the query associated with a search of an external data source, identifying the external data system; and

determining access information to access the external data system.

9 . The method of claim 1 , wherein determining that the set of data includes at least the first subset of data comprises:

parsing the query; and

based on identifying a search parameter in the query that includes an identification of the external data system, determining access information to access the external data system.

10 . The method of claim 1 , wherein determining that the set of data includes at least the first subset of data comprises:

parsing the query;

based on identifying a search parameter in the query associated with a search of an external data source, parsing a configuration file;

based on parsing the configuration file, identifying the external data system; and

based on identifying the external data system, determining access information to access the external data system.

11 . The method of claim 1 , further comprising associating a search identifier with the external data system, wherein the one or more worker nodes process results of the subquery based on the search identifier.

12 . The method of claim 1 ,

wherein determining the subquery further comprises associating, by the data intake and query system, a first search identifier with the external data system,

wherein the results of the subquery include a second search identifier assigned to the results of the subquery by the external data system, and

wherein the one or more worker nodes map the first search identifier to the second search identifier and process the results of the subquery based on the map.

13 . The method of claim 1 , wherein generating the instructions for the one or more worker nodes comprises:

obtaining a data ingest estimate for the subquery; and

generating the instructions for the one or more worker nodes based on the data ingest estimate.

14 . The method of claim 1 , wherein generating the instructions for the one or more worker nodes comprises:

determining a processing capability of the external data system;

determining a data ingest estimate for the subquery based on the processing capability; and

generating the instructions for the one or more worker nodes based on the data ingest estimate.

15 . The method of claim 1 , wherein generating the instructions for the one or more worker nodes comprises:

assigning at least one of the one or more worker nodes to request a version identifier from the external data system;

receiving, at the at least one of the one or more worker nodes, the version identifier;

determining a data ingest estimate for the subquery based on the version identifier; and

generating the instructions for the one or more worker nodes based on the data ingest estimate.

16 . The method of claim 1 , wherein generating the instructions for the one or more worker nodes comprises:

determining a quantity of partitions to ingest the results of the subquery; and

generating the instructions for the one or more worker nodes based on the quantity of partitions.

17 . The method of claim 1 , further comprising:

obtaining network access information from at least one of the one or more worker nodes, wherein executing the subquery comprises communicating the network access information to the external data system.

18 . The method of claim 1 , wherein the subquery includes instructions for the external data system to communicate the results of the subquery to only one worker node of the one or more worker nodes, and wherein the method further comprises:

generating instructions for the one worker node to distribute the results of the subquery to a plurality of worker nodes of the one or more worker nodes.

19 . A computing system of a data intake and query system, the computing system comprising:

memory; and

one or more processing devices coupled to the memory and configured to:

receive, at a data intake and query system including a search head, a query identifying a set of data to be processed and a manner of processing the set of data, wherein the data intake and query system comprises at least one computing device;

determine that the set of data includes at least a first subset of data associated with an external data system;

obtain search configuration data from the external data system;

determine a subquery for the external data system based on the search configuration data obtained from the external data system, the subquery identifying the first subset of data and a manner of processing the first subset of data;

generate instructions for one or more worker nodes to receive and process results of the subquery to form first processed results and to provide the first processed results to the data intake and query system;

communicate the subquery to the external data system using the one or more worker nodes,

wherein at least one worker node communicates the subquery to the external data system,

wherein the external data system processes the first subset of data based on the subquery and distributes the results of the subquery to the one or more worker nodes over a network, and

wherein the one or more worker nodes process the results of the subquery based on the instructions; and

receive the first processed results from the external data system via the one or more worker nodes.

20 . Non-transitory computer readable media comprising computer-executable instructions that, when executed by a computing system of a first data intake and query system, cause the computing system to:

receive, at a data intake and query system including a search head, a query identifying a set of data to be processed and a manner of processing the set of data, wherein the data intake and query system comprises at least one computing device;

determine that the set of data includes at least a first subset of data associated with an external data system;

obtain search configuration data from the external data system;

determine a subquery for the external data system based on the search configuration data obtained from the external data system, the subquery identifying the first subset of data and a manner of processing the first subset of data;

generate instructions for one or more worker nodes to receive and process results of the subquery to form first processed results and to provide the first processed results to the data intake and query system;

communicate the subquery to the external data system using the one or more worker nodes,

wherein at least one worker node communicates the subquery to the external data system,

wherein the external data system processes the first subset of data based on the subquery and distributes the results of the subquery to the one or more worker nodes over a network, and

wherein the one or more worker nodes process the results of the subquery based on the instructions; and

receive the first processed results from the external data system via the one or more worker nodes.

Assignments (5)

Continuity (19)

References Cited (400)