Dynamic scheduling of tasks for collecting and processing data using job configuration data

• US 10,089,143 B2
• Filed: 01/30/2015
• Issued: 10/02/2018
• Est. Priority Date: 07/29/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Fletcher, Tristan, Bingham, Brian
• Primary Examiner(s): Lee, James J
• Application Number:
  US14/611,138
• Publication Number:
  US 20150143377A1
• Time in Patent Office: 1,341 Days
• CPC Class Codes: G06F 16/316 Indexing structures
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: G06F 9/5011 the resources being hardware resources other than CPUs, Servers and Terminals
• CPC Class Codes: G06F 9/5033 considering data affinity
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders'"'"' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Claims

1. A computer-implemented method, comprising:

identifying, by a scheduler, a plurality of jobs, wherein each job in the plurality of jobs comprises collecting data from one or more sources;

transmitting, at a direction of the scheduler, credentials to each forwarder in a set of multiple forwarders, wherein each forwarder stores the credentials;

generating, by the scheduler, job configuration data for a job, wherein the job configuration data includes identification of a data collection task to perform, a data filter to apply, a target source from which the data is to be collected, and a particular indexer to receive the data after the data is collected from the target source, the particular indexer being one of a plurality of indexers configured to index data for subsequent searching; and

for each job of the plurality of jobs,

selecting, by the scheduler, a particular forwarder for the job and assigning the job to the particular forwarder selected,

transmitting to the particular forwarder, by the scheduler, the job configuration data that includes the identification of the data collection task to perform, the data filter to apply, the target source from which the data is to be collected, and the particular indexer to receive the data after the data is collected from the target source,

using, by the particular forwarder, the job configuration data and the stored credentials to execute the job, and

transmitting, by the particular forwarder, data collected according to the job to a particular indexer of the plurality of indexers that index data for subsequent searching of the indexed data, the particular indexer being identified by the job configuration data transmitted by the scheduler to the particular forwarder.

2. The method of claim 1, wherein the job configuration data specifies at least one client preference comprising:

format of data output of the job; and

a relative expiration deadline of initiation of execution the job.

3. The method of claim 1, wherein the job configuration data identifies a data-request format required by a particular target source.

4. The method of claim 1, further comprising:

responsive to modifications to the job configuration data, transmitting the modified job configuration data to the each forwarder in the set of multiple forwarders.

5. The method of claim 1, further comprising:

responsive to addition of a new forwarder to the set of multiple forwarders and modifications to the job configuration data, transmitting the modified job configuration data to the new forwarder.

6. The method of claim 1, wherein the plurality of jobs includes a job to collect unstructured data from a first source using a first application programming interface (API) and further includes a job to collect unstructured data from a second source using a second API.

7. The method of claim 1, wherein one of the plurality of jobs includes collecting the data from a host of a web service.

8. The method of claim 1, further comprising:

estimating a load for each forwarder in the set of forwarders based on received communications from the forwarders; and

wherein the assigning of jobs is made based on the estimated load.

9. The method of claim 1, further comprising:

receiving an identification of a new forwarder, wherein the identification of the new forwarder is received after each job in the plurality of jobs is assigned but before the selection of a further forwarder to perform a further job is made; and

adding the new forwarder to the set of forwarders, wherein selecting the further forwarder of the set of forwarders comprises comparing an estimated current workload for the new forwarder to an estimated current workload for another forwarder in the set of forwarders.

10. The method of claim 1, further comprising:

prior to selecting the particular forwarder, determining a number of worker processes present on each forwarder in the set of forwarders, wherein selecting the particular forwarder is based at least in part on the number of worker processes present on each forwarder in the set of forwarders.

11. The method of claim 1, wherein, for a first job in the plurality of jobs, the data to be collected includes unstructured data.

12. The method of claim 1, wherein a second job and one first job in the plurality of jobs pertain to data provided by a same source, and wherein the selection of the forwarder to perform the second job is made based on a bias towards assigning the second job and the one first job to a same forwarder.

13. The method of claim 1, further comprising:

accessing, at the scheduler, workload data that describes at least a collection task and a schedule of times at which the collection task is to be performed; and

dividing, by the scheduler, the workload into at least a first job of the plurality of jobs and a second job.

14. The method of claim 1, further comprising:

assigning, by the scheduler, a first job to the particular forwarder; and

wherein selecting the particular forwarder to perform a second job is based at least in part on the first job and the second job having both originated from a same workload.

15. The method of claim 1, further comprising:

maintaining capability data describing, for each forwarder in the set of forwarders, one or more handlers at the forwarder and one or more data collection tasks that each of the one or more handlers is configured to perform; and

wherein assigning each job in the plurality of jobs is based at least partially on the capability data.

16. The method of claim 1, further comprising:

wherein the scheduler executes at a particular computing device;

wherein the set of forwarders executes at a first set of one or more computing devices that includes at least one computing device other than the particular computing device; and

wherein the plurality of indexers execute at a second set of one or more computing devices that is different than the first set of one or more computing devices.

17. The method of claim 1, wherein assigning the job to the particular forwarder takes into account information received from the particular forwarder on completion of previously assigned jobs.

18. The method of claim 17, further comprising assigning a second job to the particular forwarder based at least in part on not receiving an indication that a first forwarder has completed a first job to which the first forwarder was assigned.

19. A system, comprising:

a plurality of data processors associated with a scheduler and a set of forwarders; and

a non-transitory computer-readable storage medium containing instructions which when executed on the plurality of data processors, cause the processors to perform operations including;

identifying, by a scheduler, a plurality of jobs, wherein each job in the plurality of jobs comprises collecting data from one or more sources;

transmitting, at a direction of the scheduler, credentials to each forwarder in a set of multiple forwarders, wherein each forwarder stores the credentials;

generating, by the scheduler, job configuration data for a job, wherein the job configuration data includes identification of a data collection task to perform, a data filter to apply, a target source from which the data is to be collected, and a particular indexer in a plurality of indexers to receive the data after the data is collected from the target source;

for each job of the plurality of jobs,

selecting, by the scheduler, a particular forwarder for the job and assigning the job to the particular forwarder selected,

transmitting to the particular forwarder, by the scheduler, the job configuration data that includes the identification of the data collection task to perform, the data filter to apply, the target source from which the data is to be collected, and the particular indexer to receive the data after the data is collected from the target source,

using, by the particular forwarder, the job configuration data and the stored credentials to execute the job, and

transmitting, by the particular forwarder, data collected according to the job to a particular indexer of the plurality of indexers that index data, according to the job configuration data transmitted to the particular forwarder by the scheduler, for subsequent searching of the indexed data.

20. The method of claim 19, wherein the job configuration data specifies at least one client preference comprising:

format of data output of the job; and

a relative expiration deadline of initiation of execution the job.

21. The system of claim 19, wherein the job configuration data identifies a data-request format required by a particular target source.

22. The system of claim 19, further comprising:

responsive to modifications to the job configuration data, transmitting the modified job

configuration data to the each forwarder in the set of multiple forwarders.

23. The system of claim 19, further comprising:

responsive to addition of a new forwarder to the set of multiple forwarders and modifications to the job configuration data, transmitting the modified job configuration data to the new forwarder.

24. The system of claim 19, wherein the plurality of jobs includes a job to collect unstructured data from a first source using a first application programming interface (API) and further includes a job to collect unstructured data from a second source using a second API.

25. The system of claim 19, wherein one of the plurality of jobs includes collecting the data from a host of a web service.

26. The system of claim 19, wherein the operations further comprise:

estimating a load for each forwarder in the set of forwarders based on the received communication; and

wherein the selection is made based on the estimated loads.

27. The system of claim 19, wherein the operations further comprise:

receiving an identification of a new forwarder, wherein the identification of the new forwarder is received after each job in the plurality of jobs is assigned but before the selection of a further forwarder to perform a further job is made; and

adding the new forwarder to the set of forwarders, wherein selecting the further forwarder of the set of forwarders comprises comparing an estimated current workload for the new forwarder to an estimated current workload for another forwarder in the set of forwarders.

28. The system of claim 19, wherein the operations further comprise:

prior to selecting the particular forwarder, determining a number of worker processes present on each forwarder in the set of forwarders, wherein selecting the particular forwarder is based at least in part on the number of worker processes present on each forwarder in the set of forwarders.

29. The system of claim 19, wherein, for a first job in the plurality of jobs, the data to be collected includes unstructured data.

30. The system of claim 19, wherein a second job and one first job in the plurality of jobs pertain to data provided by a same source, and wherein the selection of the forwarder to perform the second job is made based on a bias towards assigning the second job and the one first job to a same forwarder.

31. The system of claim 19, wherein assigning the job to the particular forwarder takes into account information received from the particular forwarder on completion of previously assigned jobs.

32. A computer-program product tangibly embodied in a non- transitory machine-readable storage medium including instructions, an execution of which by one or more processors causes a plurality of data processors associated with a scheduler and a set of forwarders to:

identify, by a scheduler, a plurality of jobs, wherein each job in the plurality of jobs comprises collecting data from one or more sources;

transmit, at a direction of the scheduler, credentials to each forwarder in a set of multiple forwarders, wherein each forwarder stores the credentials;

generate, by the scheduler, job configuration data for a job, wherein the job configuration data includes identification of a data collection task to perform, a data filter to apply, a target source from which the data is to be collected, and a particular indexer in a plurality of indexers to receive the data after the data is collected from the target source; and

for each job of the plurality of jobs,

select, by the scheduler, a particular forwarder for the job and assign the job to the particular forwarder selected,

transmit to the particular forwarder, by the scheduler, the job configuration data that includes the identification of the data collection task to perform, the data filter to apply, the target source from which the data is to be collected, and the particular indexer to receive the data after the data is collected from the target source,

use, by the particular forwarder, the job configuration data and the stored credentials to execute the job, and

transmit, by the particular forwarder, data collected according to the job to a particular indexer of the plurality of indexers that index data, according to the job configuration data transmitted to the particular forwarder by the scheduler, for subsequent searching of the indexed data.

33. The computer-program product of claim 32, wherein assigning the job to the particular forwarder takes into account information received from the particular forwarder on completion of previously assigned jobs.