Single point of dispatch for hybrid cloud deployment for indexer clusters

• US 10,579,607 B2
• Filed: 04/28/2017
• Issued: 03/03/2020
• Est. Priority Date: 04/28/2017
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Mathew, Ashish
• Primary Examiner(s): Hasan, Syed H
• Application Number:
  US15/582,424
• Publication Number:
  US 20180314731A1
• Time in Patent Office: 1,040 Days
• Field of Search: None
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/256 in federated or virtual databases

Abstract

Embodiments of the present disclosure provide a method for performing search queries. The method comprises transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers and the first search head. The method further comprises receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request. Further, the method comprises evaluating a plurality of policies to determine if the first slot request can be granted and responsive to a positive determination, transmitting an authorization token for a slot to the first search head.

Claims

1. A method for performing a query, the method comprising:

transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head as part of a heartbeat response message, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers, and wherein the first search head is one of a plurality of search heads operable to be communicatively coupled to the cluster master;

receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request;

evaluating a plurality of policies to determine if the first slot request can be granted; and

responsive to a determination that the first slot request can be granted, transmitting an authorization token for a slot to the first search head.

2. The method of claim 1, further comprising:

responsive to a determination that the first slot request cannot be granted, transmitting a denial of the slot request to the first search head and dispensing with the query in accordance with an enforcement mode, wherein the enforcement mode comprises taking an action selected from the group consisting of;

canceling the query, transmitting the query to the active indexers, queuing the query, delaying the query and canceling the query if a number of entries in a search queue are above a threshold value.

3. The method of claim 1, further comprising:

receiving a release of the slot from the first search head; and

responsive to a determination that a second slot request can be granted to a second search head from the plurality of search heads, transmitting an authorization token for the slot to the second search head.

4. The method of claim 1, further comprising:

while the authorization token is granted for the first search head, maintaining a reservation of the authorization token for the first search head;

receiving a release of the slot from the first search head; and

releasing the reservation of the authorization token.

5. The method of claim 1, wherein the transmitting the list of active indexers is in response to a request for the list of active indexers in a heartbeat message from the first search head to the cluster master.

6. The method of claim 1, wherein the cluster master, the first search head and the indexer cluster are located in a cloud network, wherein the second search head is located at an on-premises location of an organization, and wherein the first search head and the second search head are under the control of the organization.

7. The method of claim 1, wherein the cluster master, the plurality of search heads and the indexer cluster are located in a cloud network.

8. The method of claim 1, wherein the first search head is located at an on-premises location of an organization, wherein the cluster master, the indexer cluster and the remaining search heads in the plurality of search heads are located in a cloud network.

9. The method of claim 1, wherein the evaluating the plurality of policies comprises consulting a plurality of static policies selected from the group consisting of:

maximum number of concurrent searches, frequency of searches, source of searches, and type of search.

10. The method of claim 1, wherein the evaluating the plurality of policies comprises consulting a plurality of dynamic policies selected from the group consisting of:

I/O level usage of the search head, CPU usage by the search head, memory usage by the search head, types of indexes accessed by the query, and number of archived indexes accessed by the query.

11. A non-transitory computer-readable medium having computer-readable program code embodied therein for causing a computer system to perform a method for performing a query, the method comprising:

transmitting a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head as part of a heartbeat response message, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers, and wherein the first search head is one of a plurality of search heads operable to be communicatively coupled to the cluster master;

receiving a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request;

evaluating a plurality of policies to determine if the first slot request can be granted; and

responsive to a determination that the first slot request can be granted, transmitting an authorization token for a slot to the first search head.

12. The computer-readable medium of claim 11, wherein the method further comprises:

responsive to a determination that the first slot request cannot be granted, transmitting a denial of the slot request to the first search head and dispensing with the query in accordance with an enforcement mode, wherein the enforcement mode comprises taking an action selected from the group consisting of;

canceling the query, transmitting the query to the active indexers, queuing the query, delaying the query and canceling the query if a number of entries in a search queue are above a threshold value.

13. The computer-readable medium of claim 11, wherein the method further comprises:

receiving a release of the slot from the first search head; and

responsive to a determination that a second slot request can be granted to a second search head from the plurality of search heads, transmitting an authorization token for the slot to the second search head.

14. The computer-readable medium of claim 11, wherein the method further comprises:

while the authorization token is granted for the first search head, maintaining a reservation of the authorization token for the first search head;

receiving a release of the slot from the first search head; and

releasing the reservation of the authorization token.

15. The computer-readable medium of claim 11, wherein the transmitting the list of active indexers is in response to a request for the list of active indexers in a heartbeat message from the first search head to the cluster master.

16. The computer-readable medium of claim 11, wherein the cluster master, the first search head and the indexer cluster are located in a cloud network, wherein the second search head is located at an on-premises location of an organization, and wherein the first search head and the second search head are under the control of the organization.

17. The computer-readable medium of claim 11, wherein the cluster master, the plurality of search heads and the indexer cluster are located in a cloud network.

18. The computer-readable medium of claim 11, wherein the first search head is located at an on-premises location of an organization, wherein the cluster master, the indexer cluster and the remaining search heads in the plurality of search heads are located in a cloud network.

19. The computer-readable medium of claim 11, wherein the evaluating the plurality of policies comprises consulting a plurality of static policies selected from the group consisting of:

maximum number of concurrent searches, frequency of searches, source of searches, and type of search.

20. The computer-readable medium of claim 11, wherein the evaluating the plurality of policies comprises consulting a plurality of dynamic policies selected from the group consisting of:

I/O level usage of the search head, CPU usage by the search head, memory usage by the search head, types of indexes accessed by the query, and number of archived indexes accessed by the query.

21. A system comprising:

a processing device communicatively coupled with a memory and configured to;

transmit a list of active indexers in an indexer cluster from a cluster master for receipt by a first search head as part of a heartbeat response message, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers, and wherein the first search head is one of a plurality of search heads operable to be communicatively coupled to the cluster master;

receive a first slot request at the cluster master in response to a query from the first search head, wherein the first search head is operable to transmit the query to the active indexers for execution if granted the slot request;

evaluate a plurality of policies to determine if the first slot request can be granted; and

responsive to a determination that the first slot request can be granted, transmit an authorization token for a slot to the first search head.

22. The system of claim 21, wherein the processor is further configured to:

responsive to a determination that the first slot request cannot be granted, transmit a denial of the slot request to the first search head and dispensing with the query in accordance with an enforcement mode, wherein the enforcement mode comprises taking an action selected from the group consisting of;

canceling the query, transmitting the query to the active indexers, queuing the query, delaying the query and canceling the query if a number of entries in a search queue are above a threshold value.

23. The system of claim 21, wherein the processor is further configured to:

receive a release of the slot from the first search head; and

responsive to a determination that a second slot request can be granted to a second search head from the plurality of search heads, transmit an authorization token for the slot to the second search head.

24. The system of claim 21, wherein the processor is further configured to:

while the authorization token is granted for the first search head, maintain a reservation of the authorization token for the first search head;

receiving a release of the slot from the first search head; and

releasing the reservation of the authorization token.

25. The system of claim 21, wherein the list of active indexers is transmitted in response to a request for the list of active indexers in a heartbeat message from the first search head to the cluster master.

26. The system of claim 21, wherein the cluster master, the first search head and the indexer cluster are located in a cloud network, wherein the second search head is located at an on-premises location of an organization, and wherein the first search head and the second search head are under the control of the organization.

27. The system of claim 21, wherein the cluster master, the plurality of search heads and the indexer cluster are located in a cloud network.

28. The system of claim 21, wherein the first search head is located at an on-premises location of an organization, wherein the cluster master, the indexer cluster and the remaining search heads in the plurality of search heads are located in a cloud network.

29. The system of claim 21, wherein to evaluate the plurality of policies the processor is configured to consult a plurality of static policies selected from the group consisting of:

maximum number of concurrent searches, frequency of searches, source of searches, and type of search.

30. The system of claim 21, wherein to evaluate the plurality of policies the processor is configured to consult a plurality of dynamic policies selected from the group consisting of:

I/O level usage of the search head, CPU usage by the search head, memory usage by the search head, types of indexes accessed by the query, and number of archived indexes accessed by the query.