Actionable event responder architecture

1. A computer-implemented method comprising:

pulling, by a plurality of harvesters and from a plurality of event sources, data for a plurality of actionable event instances for a plurality of actionable event occurrences in a server cluster,

wherein the plurality of harvesters comprises a subset that are each specific to a single event source or single event source type of the plurality of event sources,

wherein at least one of the plurality of harvesters is a universal harvester configured to receive data from a plurality of disparate sources, and

wherein the plurality of harvesters reformats information to obtain representations of the plurality of actionable event instances;

receiving, by an actionable event collector in the server cluster, the information specifying an actionable event instance regarding an actionable event occurrence in the server cluster, wherein the plurality of actionable event instances comprises the actionable event instance;

transmitting, by the actionable event collector, a representation of the actionable event instance to an actionable event queue builder;

inserting, by the actionable event queue builder, the representation as an entry into an actionable event queue; and

processing, by an event action dispatcher, the entry from the actionable event queue,

wherein processing the entry comprises:

determining a responsive action for the entry, and

causing performance of the responsive action.

2. The computer-implemented method of claim 1 ,

wherein the plurality of event sources comprises a log, a monitor output, and a system component.

3. The computer-implemented method of claim 1 , further comprising:

wherein the plurality of event sources comprises operational components of a data intake and query system that manages storage of events, and

wherein the plurality of actionable event instances is excluded from the storage of events in the data intake and query system.

4. The computer-implemented method of claim 1 , further comprising:

receiving the information via a computing interface; and

validating, by an event injector in the actionable event collector, the information for completion and conformity.

5. The computer-implemented method of claim 1 ,

wherein the data comprises both the information specifying the plurality of actionable event instances and information specifying a plurality of non-actionable event instances.

6. The computer-implemented method of claim 1 ,

wherein at least one harvester filters the information specifying the plurality of actionable event instances and reformats the information to obtain representations of the plurality of actionable event instances.

7. The computer-implemented method of claim 1 ,

wherein the universal harvester is configured to use command, configuration, and control data that is specific to a particular event source or event source type.

8. The computer-implemented method of claim 1 , wherein determining the responsive action for the entry comprises:

obtaining an event-type code from the entry, and

obtaining, from an event-type response map, a correlation between the event-type code and a signifier for the responsive action.

9. The computer-implemented method of claim 1 , wherein determining the responsive action for the entry comprises:

obtaining an event-type code from the entry, and

obtaining, from an event-type response map, a correlation between the event-type code and a signifier for the responsive action,

wherein the event-type response map comprises a plurality of entries maintained by a control data manager.

10. The computer-implemented method of claim 1 , wherein causing the performance of the responsive action comprises:

signaling an invocation message to a resolution handler to perform the responsive action.

11. The computer-implemented method of claim 1 , wherein prior to causing the performance of the responsive action, the event action dispatcher obtains authorization for the performance of the responsive action using a user interface.

12. The computer-implemented method of claim 1 , wherein causing the performance of the responsive action comprises:

selecting a resolution handler from a plurality of resolution handlers based on a particular component targeted by the resolution handler, and

signaling an invocation message to the resolution handler to perform the responsive action.

13. The computer-implemented method of claim 1 , wherein causing the performance of the responsive action comprises:

performing a multicast fanout method to perform the responsive action to the server cluster.

14. A computing device, comprising:

a processor; and

a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:

pulling, by a plurality of harvesters and from a plurality of event sources, data for a plurality of actionable event instances for a plurality of actionable event occurrences in a server cluster,

wherein the plurality of harvesters comprises a subset that are each specific to a single event source or single event source type of the plurality of event sources,

wherein at least one of the plurality of harvesters is a universal harvester configured to receive data from a plurality of disparate sources, and

wherein the plurality of harvesters reformats information to obtain representations of the plurality of actionable event instances,

receiving, by an actionable event collector in the server cluster, the information specifying an actionable event instance regarding an actionable event occurrence in the server cluster, wherein the plurality of actionable event instances comprises the actionable event instance,

transmitting, by the actionable event collector, a representation of the actionable event instance to an actionable event queue builder,

inserting, by the actionable event queue builder, the representation as an entry into an actionable event queue, and

processing, by an event action dispatcher, the entry from the actionable event queue, wherein processing the entry comprises:

determining a responsive action for the entry, and

causing performance of the responsive action.

15. The computing device of claim 14 ,

wherein the plurality of event sources comprising a log, a monitor output, and a system component.

16. The computing device of claim 14 ,

wherein the plurality of event sources comprises operational components of a data intake and query system that manages storage of events, and

wherein the plurality of actionable event instances is excluded from the storage of events in the data intake and query system.

17. A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:

pulling, by a plurality of harvesters and from a plurality of event sources, data for a plurality of actionable event instances for a plurality of actionable event occurrences in a server cluster,

wherein the plurality of harvesters comprises a subset that are each specific to a single event source or single event source type of the plurality of event sources,

wherein at least one of the plurality of harvesters is a universal harvester configured to receive data from a plurality of disparate sources, and

wherein the plurality of harvesters reformats information to obtain representations of the plurality of actionable event instances;

receiving, by an actionable event collector in the server cluster, the information specifying an actionable event instance regarding an actionable event occurrence in the server cluster, wherein the plurality of actionable event instances comprises the actionable event instance;

transmitting, by the actionable event collector, a representation of the actionable event instance to an actionable event queue builder;

inserting, by the actionable event queue builder, the representation as an entry into an actionable event queue; and

processing, by an event action dispatcher, the entry from the actionable event queue,

wherein processing the entry comprises:

determining a responsive action for the entry, and

causing performance of the responsive action.

18. The non-transitory computer-readable medium of claim 17 ,

wherein the plurality of event sources comprises a log, a monitor output, and a system component.

19. The non-transitory computer-readable medium of claim 17 ,

wherein the plurality of event sources comprises operational components of a data intake and query system that manages storage of events, and

wherein the plurality of actionable event instances is excluded from the storage of events in the data intake and query system.