Granted Patent B2

US 12,393,631 · App. 18/661,319 · Granted Aug 19, 2025

Inventors: Alexandros Batsakis (San Francisco, CA); Ashish Mathew (San Mateo, CA); Christopher Madden Pride (Oakland, CA); Bharath Kishore Reddy Aleti (San Ramon, CA); Sourav Pal (Foster City, CA); Arindam Bhattacharjee (Fremont, CA); James Monschke (San Francisco, CA); Sai Krishna Sajja (Union City, CA); Igor Stojanovski (San Francisco, CA); Tameem Anwar (South San Francisco, CA); Paul J. Lucas (Oakland, CA); Eric Woo (San Francisco, CA); Steve Wong (San Rafael, CA)

G06F16/901G06F3/0604G06F3/0644G06F3/065G06F3/0652G06F3/0653G06F3/0656G06F3/067G06F16/23G06F16/27G06F16/903

Abstract

Claims (54)

1. A method comprising:

receiving a query from a client device; and

in response to receiving the query:

identifying, by one or more computing devices, a first set of operations for performance by a streaming data processing system based at least in part on the query, the streaming data processing system comprising at least one streaming data processor;

identifying, by the one or more computing devices, a second set of operations for performance by a query system based at least in part on the query, the query system comprising at least one search node, wherein the first set of operations is different from the second set of operations;

generating, by the one or more computing devices, a first set of tasks based at least in part on the first set of operations, wherein the first set of tasks comprises a first task to obtain a set of data stored in a data store based at least in part on the query, a second task to process the set of data according to the first set of operations to obtain a first processed set of data, and a third task to communicate the first processed set of data to a buffer associated with at least one computing device;

generating, by the one or more computing devices, a second set of tasks based at least in part on the second set of operations, wherein the second set of tasks comprises a fourth task to obtain at least a portion of the first processed set of data from the buffer and a fifth task to further process the at least a portion of the first processed set of data according to the second set of operations to obtain a second processed set of data, wherein the second set of tasks is different from the first set of tasks;

determining that the at least one search node is available to execute the query based on monitoring a status of the at least one search node;

distributing, based on the status of the at least one search node, the first set of tasks to the streaming data processing system and the second set of tasks to the query system; and

receiving based at least in part on performance of the first set of tasks and the second set of tasks, results to present to the client device, wherein the results comprise data sets retrieved from one or more data stores.

2. The method of claim 1 , wherein the second set of tasks comprises a sixth task to store at least one of the at least a portion of the first processed set of data or the second processed set of data in a plurality of buckets using a plurality of nodes, wherein a particular node of the plurality of nodes is instantiated as one or more containers on a hosted computing device in a containerized environment.

3. The method of claim 1 , wherein the at least a portion of the first processed set of data is stored in a plurality of buckets in a shared storage system, wherein the shared storage system is accessible by a plurality of search nodes, the plurality of search nodes comprising the at least one search node.

4. The method of claim 1 , wherein the at least a portion of the first processed set of data is stored in one or more buckets, wherein the at least one search node includes a copy of the one or more buckets on a local or shared data store of the at least one search node.

5. The method of claim 1 , wherein the query identifies the set of data and a manner of processing the set of data.

6. The method of claim 1 , wherein the query comprises a plurality of query commands, wherein at least one of the first set of operations or the second set of operations correspond to the plurality of query commands.

7. The method of claim 1 , wherein at least one of the streaming data processing system or the query system operates according to a publisher subscriber model.

8. The method of claim 1 , wherein the query is a first query, wherein the at least a portion of the first processed set of data is stored in a shared storage system of the query system, wherein the second processed set of data comprises at least a portion of results of further processing the at least a portion of the first processed set of data and at least a portion of results of execution of a second query.

9. The method of claim 1 , wherein the at least one search node comprises a first search node

instantiated as one or more containers on a hosted computing device in a containerized environment,

wherein a second search node is dynamically identified to execute a second query based on the status of the first search node.

10. The method of claim 1 , further comprising:

in response to receiving the query, dynamically identifying the at least one search node.

11. The method of claim 1 , further comprising:

receiving, at an indexing system, raw machine data, wherein the raw machine data comprises the set of data;

storing at least a portion of the raw machine data in a plurality of buckets using indexing nodes of the indexing system, wherein the indexing nodes are instantiated on one or more computing devices in a containerized environment; and

storing the plurality of buckets in a shared storage system.

12. The method of claim 1 , wherein the set of data reflects activity in an information processing environment and is produced by a component of the information processing environment.

13. The method of claim 1 , further comprising: storing at least a portion of the results in the data store.

14. The method of claim 1 , wherein the first task comprises a task to receive a stream of data and identify the set of data from the stream of data.

15. Non-transitory computer-readable media comprising computer-executable instructions, wherein execution of the computer-executable instructions by a computing system causes the computing system to:

receive a query from a client device; and

in response to the receiving the query:

identify, by the one or more computing devices, a first set of operations for performance by a streaming data processing system based at least in part on the query, the streaming data processing system comprising at least one streaming data processor;

identify, by the one or more computing devices, a second set of operations for performance by a query system based at least in part on the query, the query system comprising at least one search node, wherein the first set of operations is different from the second set of operations;

generate, by the one or more computing devices, a first set of tasks based at least in part on the first set of operations, wherein the first set of tasks comprises a first task to obtain a set of data stored in a data store based at least in part on the query, a second task to process the set of data according to the first set of operations to obtain a first processed set of data, and a third task to communicate the first processed set of data to a buffer associated with at least one computing device;

generate, by the one or more computing devices, a second set of tasks based at least in part on the second set of operations, wherein the second set of tasks comprises a fourth task to obtain at least a portion of the first processed set of data from the buffer and a fifth task to further process the at least a portion of the first processed set of data according to the second set of operations to obtain a second processed set of data, wherein the second set of tasks is different from the first set of tasks;

determine that the at least one search node is available to execute the query based on monitoring a status of the at least one search node;

distribute, based on the status of the at least one search node, the first set of tasks to the streaming data processing system and the second set of tasks to the query system; and

receive, based at least in part on performance of the first set of tasks and the second set of tasks, results to present to the client device, wherein the results comprise data sets retrieved from one or more data stores.

16. The non-transitory computer-readable media of claim 15 , wherein the second set of tasks comprises a sixth task to store at least one of the at least a portion of the first processed set of data or the second processed set of data in a plurality of buckets using a plurality of nodes, wherein a particular node of the plurality of nodes is instantiated as one or more containers on a hosted computing device in a containerized environment.

17. The non-transitory computer-readable media of claim 15 , wherein the query comprises a plurality of query commands, wherein at least one of the first set of operations or the second set of operations correspond to the plurality of query commands.

18. A computing system, comprising:

memory; and

one or more processing devices coupled to the memory and configured to:

receive a query from a client device; and

in response to receiving the query:

identify, by one or more computing devices, a first set of operations for performance by a streaming data processing system based at least in part on the query, the streaming data processing system comprising at least one streaming data processor;

identify, by the one or more computing devices, a second set of operations for performance by a query system based at least in part on the query, the query system comprising at least one search node, wherein the first set of operations is different from the second set of operations;

generate, by the one or more computing devices, a first set of tasks based at least in part on the first set of operations, wherein the first set of tasks comprises a first task to obtain a set of data stored in a data store based at least in part on the query, a second task to process the set of data according to the first set of operations to obtain a first processed set of data, and a third task to communicate the first processed set of data to a buffer associated with at least one computing device;

generate, by the one or more computing devices, a second set of tasks based at least in part on the second set of operations, wherein the second set of tasks comprises a fourth task to obtain at least a portion of the first processed set of data from the buffer and a fifth task to further process the at least a portion of the first processed set of data according to the second set of operations to obtain a second processed set of data, wherein the second set of tasks is different from the first set of tasks;

determine that the at least one search node is available to execute the query based on monitoring a status of the at least one search node;

distribute, based on the status of the at least one search node, the first set of tasks to the streaming data processing system and the second set of tasks to the query system; and

receive, based at least in part on performance of the first set of tasks and the second set of tasks, results to present to the client device, wherein the results comprise data sets retrieved from one or more data stores.

19. The computing system of claim 18 , wherein at least one of the streaming data processing system or the query system operates according to a publisher subscriber model.

Assignments (7)

Continuity (30)

References Cited (400)