Clustering for high availability and disaster recovery

1. A computer-implemented method comprising:

identifying, at the master device, a first indexer from a set of indexers to serve as a primary indexer for responding to queries pertaining to certain data, and wherein the first indexer is configured to determine whether to search the certain data based on a time range associated with one of the queries pertaining to the certain data;

assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the certain data, the first indexer receiving information that the generation identifier designates the first indexer as the primary indexer for the certain data;

in response to an event prompting a change in a primary indexer designation for the certain data:

identifying, at the master device, a second indexer from the set of indexers to serve as the primary indexer for responding to queries pertaining to the certain data; and

assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the certain data, the second indexer receiving information that the new generation identifier designates the second indexer as the primary indexer for the certain data;

receiving, at the master device, a request for a current generation identifier; and

responding, at the master device, to the request query with the new generation identifier.

2. The method of claim 1 , wherein the event prompting the change includes a determination that the first indexer was non-responsive to a communication.

3. The method of claim 1 , wherein the event prompting the change includes a determination that the first indexer has responsibility for a high processing load relative to other indexers in the set of indexers.

4. The method of claim 1 , further comprising responding, at the master device, to the request with an identification of at least one indexer storing the certain data.

5. The method of claim 1 , wherein the first indexer and the second indexer each concurrently store copies of the certain data.

6. The method of claim 1 , wherein creating the new generation identifier includes incrementing the generation identifier.

7. The method of claim 1 , wherein the certain data includes two or more events, and wherein an indexer in the set of indexers is configured to:

receive raw data;

separate the raw data into the two or more events;

determine, for each of the two or more events, a time stamp; and

store the two or more events in a data store that it can search in response to a query.

8. The method of claim 1 , wherein, while the first indexer is serving as the primary indexer for the certain data, the first indexer concurrently stores other data for which it is not designated as the primary indexer.

9. The method of claim 1 , wherein the certain data is stored in one of several buckets maintained by the first indexer.

10. The method of claim 1 , wherein a particular query pertaining at least to the certain data is associated with a particular generation identifier, and wherein a particular indexer responds to the particular query associated with the particular generation identifier based on the particular indexer having received information that the particular generation identifier designates the particular indexer as the primary indexer for the certain data.

11. A system comprising:

one or more data processors; and

a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:

identifying, at the master device, a first indexer from a set of indexers to serve as a primary indexer for responding to queries pertaining to certain data, and wherein the first indexer is configured to determine whether to search the certain data based on a time range associated with one of the queries pertaining to the certain data;

assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the certain data, the first indexer receiving information that the generation identifier designates the first indexer as the primary indexer for the certain data;

in response to an event prompting a change in a primary indexer designation for the certain data:

identifying, at the master device, a second indexer from the set of indexers to serve as the primary indexer for responding to queries pertaining to the certain data; and

assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the certain data, the second indexer receiving information that the new generation identifier designates the second indexer as the primary indexer for the certain data;

receiving, at the master device, a request for a current generation identifier; and

responding, at the master device, to the request with the new generation identifier.

12. The system of claim 11 , wherein the event prompting the change includes a determination that the first indexer was non-responsive to a communication.

13. The system of claim 11 , wherein the event prompting the change includes a determination that the first indexer has responsibility for a high processing load relative to other indexers in the set of indexers.

14. The system of claim 11 , further comprising responding, at the master device, to the request with an identification of at least one indexer storing the certain data.

15. The system of claim 11 , wherein the first indexer and the second indexer each concurrently store copies of the certain data.

16. The system of claim 11 , wherein creating the new generation identifier includes incrementing the generation identifier.

17. The system of claim 11 , wherein the certain data includes two or more events, and wherein an indexer in the set of indexers is configured to:

receive raw data;

separate the raw data into the two or more events;

determine, for each of the two or more events, a time stamp; and

store the two or more events in a data store that it can search in response to a query.

18. The system of claim 11 , wherein, while the first indexer is serving as the primary indexer for the certain data, the first indexer concurrently stores other data for which it is not designated as the primary indexer.

19. The system of claim 11 , wherein the certain data is stored in one of several buckets maintained by the first indexer.

20. The system of claim 11 , wherein a particular query pertaining at least to the certain data is associated with a particular generation identifier, and wherein a particular indexer responds to the particular query associated with the particular generation identifier based on the particular indexer having received information that the particular generation identifier designates the particular indexer as the primary indexer for the certain data.

21. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions to cause one or more data processors to perform operations comprising:

identifying, at the master device, a first indexer from a set of indexers to serve as a primary indexer for responding to queries pertaining to certain data, and wherein the first indexer is configured to determine whether to search the certain data based on a time range associated with one of the queries pertaining to the certain data;

assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the certain data, the first indexer receiving information that the generation identifier designates the first indexer as the primary indexer for the certain data;

in response to an event prompting a change in a primary indexer designation for the certain data:

identifying, at the master device, a second indexer from the set of indexers to serve as the primary indexer for responding to queries pertaining to the certain data; and

assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the certain data, the second indexer receiving information that the new generation identifier designates the second indexer as the primary indexer for the certain data;

receiving, at the master device, a request for a current generation identifier; and

responding, at the master device, to the request query with the new generation identifier.

22. The product of claim 21 , wherein the event prompting the change includes a determination that the first indexer was non-responsive to a communication.

23. The product of claim 21 , wherein the event prompting the change includes a determination that the first indexer has responsibility for a high processing load relative to other indexers in the set of indexers.

24. The product of claim 21 , further comprising responding, at the master device, to the request with an identification of at least one indexer storing the certain data.

25. The product of claim 21 , wherein the first indexer and the second indexer each concurrently store copies of the certain data.

26. The product of claim 21 , wherein creating the new generation identifier includes incrementing the generation identifier.

27. The product of claim 21 , wherein the certain data includes two or more events, and wherein an indexer in the set of indexers is configured to:

receive raw data;

separate the raw data into the two or more events;

determine, for each of the two or more events, a time stamp; and

store the two or more events in a data store that it can search in response to a query.

28. The product of claim 21 , wherein, while the first indexer is serving as the primary indexer for the certain data, the first indexer concurrently stores other data for which it is not designated as the primary indexer.

29. The product of claim 21 , wherein the certain data is stored in one of several buckets maintained by the first indexer.

30. The product of claim 21 , wherein a particular query pertaining at least to the certain data is associated with a particular generation identifier, and wherein a particular indexer responds to the particular query associated with the particular generation identifier based on the particular indexer having received information that the particular generation identifier designates the particular indexer as the primary indexer for the certain data.