Disaster recovery in a clustered environment using generation identifiers

1. A method, comprising:

identifying, at a master device from a set of indexers, a first indexer to serve as a primary indexer for responding to queries pertaining to a subset of data, wherein the primary indexer is operable to return results responsive to searching the subset of data based on the queries pertaining thereto;

assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the subset of data;

in response to an event prompting a change in a designation of the primary indexer for the subset of data:

identifying, at the master device from the set of indexers, a second indexer to serve as the primary indexer for responding to queries pertaining to the subset of data; and

assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the subset of data.

2. The method of claim 1 , wherein the event prompting the change comprises an indication that the first indexer was determined to be non-responsive to a communication.

3. The method of claim 1 , wherein the event prompting the change comprises an indication that the first indexer has responsibility for a higher processing load relative to other indexers in the set of indexers.

4. The method of claim 1 , further comprising:

receiving, at the master device, a request for a current generation identifier; and

responding, at the master device, to the request with the new generation identifier.

5. The method of claim 1 , wherein the first indexer and the second indexer each concurrently store instances of the subset of data.

6. The method of claim 1 , wherein the assigning the new generation identifier comprises increasing a count associated with the generation identifier.

7. The method of claim 1 , wherein the subset of data comprises two or more events, and wherein an indexer in the set of indexers is configured to:

receive raw data;

segment the raw data into the two or more events;

determine, for each of the two or more events, a timestamp; and

store the two or more events in a data store that is searchable in response to a query.

8. The method of claim 1 , wherein the subset of data is stored in one of several buckets maintained by the first indexer.

9. The method of claim 1 , further comprising, responsive to the assigning the generation identifier indicating that the first indexer is the primary indexer for the subset of data, the first indexer receiving the generation identifier designating the first indexer as the primary indexer for the subset of data.

10. The method of claim 1 , further comprising, responsive to the assigning the new generation identifier indicating that the second indexer is the primary indexer for the subset of data, the second indexer receiving the new generation identifier designating the second indexer as the primary indexer for the subset of data.

11. The method of claim 1 , further comprising, while the first indexer is serving as the primary indexer for the subset of data, the first indexer concurrently storing other data for which it is not designated as the primary indexer.

12. The method of claim 1 , wherein the event prompting the change comprises a notification that a new indexer has been added to the set of indexers.

13. The method of claim 1 , wherein the event prompting the change comprises the master device initializing.

14. The non-transitory computer-readable medium of claim 13 , wherein the event prompting the change comprises an indication that the first indexer was determined to be non-responsive to a communication.

15. The non-transitory computer-readable medium of claim 13 , wherein the event prompting the change comprises an indication that the first indexer has responsibility for a higher processing load relative to other indexers in the set of indexers.

16. The method of claim 1 , wherein the event prompting the change comprises an indication that an indexer from the set of indexers has failed.

17. The method of claim 1 , further comprising:

responsive to receiving a request from a search head at the master device, transmitting a current generation identifier to the search head, wherein the search head is configured to distribute the queries pertaining to the subset of data to the set of indexers.

18. The method of claim 1 , wherein the generation identifier comprises a generation mapping, and wherein, for the subset of data, the generation mapping indicates which of the set of indexers is a primary indexer and which indexers of the set of indexers are secondary indexers.

19. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by a processor, cause the processor to perform operations comprising:

identifying, at a master device from a set of indexers, a first indexer to serve as a primary indexer for responding to queries pertaining to a subset of data, wherein the primary indexer is operable to return results responsive to searching the subset of data based on the queries pertaining thereto;

assigning, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the subset of data;

in response to an event prompting a change in a designation of the primary indexer for the subset of data:

identifying, at the master device from the set of indexers, a second indexer to serve as the primary indexer for responding to queries pertaining to the subset of data; and

assigning, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the subset of data.

20. A system comprising:

at least one memory storing computer-executable instructions; and

at least one processor, wherein the at least one processor is configured to access the at least one memory and to execute the computer-executable instructions to:

identify, at a master device from a set of indexers, a first indexer to serve as a primary indexer for responding to queries pertaining to a subset of data, wherein the primary indexer is operable to return results responsive to searching the subset of data based on the queries pertaining thereto;

assign, at the master device, a generation identifier indicating that the first indexer is the primary indexer for the subset of data;

in response to an event prompting a change in a designation of the primary indexer for the subset of data:

identify, at the master device from the set of indexers, a second indexer to serve as the primary indexer for responding to queries pertaining to the subset of data; and

assign, at the master device, a new generation identifier indicating that the second indexer is the primary indexer for the subset of data.