Single point of dispatch for management of search heads in a hybrid cloud deployment of a query system

• US 10,678,803 B2
• Filed: 04/28/2017
• Issued: 06/09/2020
• Est. Priority Date: 04/28/2017
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Mathew, Ashish
• Primary Examiner(s): Hasan, Syed H
• Application Number:
  US15/582,372
• Publication Number:
  US 20180314744A1
• Time in Patent Office: 1,138 Days
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 9/50 Allocation of resources, e.g. of the central processing unit [CPU]
• CPC Class Codes: G06F 9/505 considering the load

Abstract

Embodiments of the present disclosure provide a method for performing search queries in a manner that avoids overloading an indexer cluster or indexers with an unwanted or unauthorized high levels of concurrent searches. The method comprises transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers. The method further comprises receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master. Responsive to a grant of a slot by the cluster master, the method comprises using the addresses to transmit the query to the active indexers and receiving results of the query from the active indexers. Subsequently, the method comprises releasing the slot to the cluster master.

Claims

1. A method for performing a query, the method comprising:

transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers;

receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master at the search head;

responsive to a grant of a slot by the cluster master, using the addresses to transmit the query to the active indexers from the search head;

receiving results of the query from the active indexers at the search head; and

releasing the slot to the cluster master.

2. The method of claim 1, further comprising:

responsive to a denial of the slot request, dispensing with the query in accordance with an enforcement mode.

3. The method of claim 1, further comprising:

responsive to a denial of the slot request, responding to the denial of the slot request in accordance with an enforcement mode, wherein the enforcement mode is published by the cluster master to the search head as part of a heartbeat response message received from the cluster master.

4. The method of claim 1, further comprising:

responsive to a denial of the slot request, dispensing with the query in accordance with an enforcement mode, wherein the enforcement mode comprises taking an action selected from the group consisting of;

canceling the query, transmitting the query to the active indexers despite the denial of the slot request, queuing the query, delaying the query, and canceling the query if a number of entries in a search queue are above a threshold value.

5. The method of claim 1, wherein the cluster master and the indexer cluster are located in a cloud network, and wherein the search head is located at an on-premises location of an organization.

6. The method of claim 1, wherein the cluster master, the search head and the indexer cluster are located in a cloud network.

7. The method of claim 1, wherein the cluster master, the search head and the indexer cluster are located at an on-premises location of an organization.

8. The method of claim 1, wherein the cluster master and the indexer cluster are located at an on-premises location of an organization, and wherein the search head is located in a cloud network.

9. The method of claim 1, wherein an evaluation of the slot request by the cluster master comprises consulting a plurality of static policies selected from the group consisting of:

maximum number of concurrent searches, frequency of searches, source of searches, and type of search.

10. The method of claim 1, wherein an evaluation of the slot request by the cluster master comprises consulting a plurality of dynamic policies selected from the group consisting of:

I/O level usage of the search head, CPU usage by the search head, memory usage by the search head, types of indexes accessed by the query, and number of archived indexes accessed by the query.

11. A non-transitory computer-readable medium having computer-readable program code embodied therein for causing a computer system to perform a method for performing a query, the method comprising:

transmitting a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers;

receiving addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master at the search head;

responsive to a grant of a slot by the cluster master, using the addresses to transmit the query to the active indexers from the search head;

receiving results of the query from the active indexers at the search head; and

releasing the slot to the cluster master.

12. The computer-readable medium of claim 11, wherein the method further comprises:

responsive to a denial of the slot request, dispensing with the query in accordance with an enforcement mode.

13. The computer-readable medium of claim 11, wherein the method further comprises:

responsive to a denial of the slot request, responding to the denial of the slot request in accordance with an enforcement mode, wherein the enforcement mode is published by the cluster master at the search head as part of a heartbeat response message received from the cluster master.

14. The computer-readable medium of claim 11, wherein the method further comprises:

responsive to a denial of the slot request, dispensing with the query in accordance with an enforcement mode, wherein the enforcement mode comprises taking an action selected from the group consisting of;

canceling the query, transmitting the query to the active indexers despite the denial of the slot request, queuing the query, delaying the query, and canceling the query if a number of entries in a search queue are above a threshold value.

15. The computer-readable medium of claim 11, wherein the cluster master and the indexer cluster are located in a cloud network, and wherein the search head is located at an on-premises location of an organization.

16. The computer-readable medium of claim 11, wherein the cluster master, the search head and the indexer cluster are located in a cloud network.

17. The computer-readable medium of claim 11, wherein the cluster master, the search head and the indexer cluster are located at an on-premises location of an organization.

18. The computer-readable medium of claim 11, wherein the cluster master and the indexer cluster are located at an on-premises location of an organization, and wherein the search head is located in a cloud network.

19. The computer-readable medium of claim 11, wherein an evaluation of the slot request by the cluster master comprises consulting a plurality of static policies selected from the group consisting of:

maximum number of concurrent searches, frequency of searches, source of searches, and type of search.

20. The computer-readable medium of claim 11, wherein an evaluation of the slot request by the cluster master comprises consulting a plurality of dynamic policies selected from the group consisting of:

I/O level usage of the search head, CPU usage by the search head, memory usage by the search head, types of indexes accessed by the query, and number of archived indexes accessed by the query.

21. A system comprising:

a processing device communicatively coupled with a memory and configured to;

transmit a slot request from a search head to a cluster master in response to a query, wherein the cluster master is communicatively coupled with an indexer cluster comprising a plurality of indexers;

receive addresses of active indexers in the indexer cluster and a response to the slot request from the cluster master at the search head;

responsive to a grant of a slot by the cluster master, use the addresses to transmit the query to the active indexers from the search head;

receive results of the query from the active indexers at the search head; and

release the slot to the cluster master.

22. The system of claim 21, wherein the processor is further configured to:

responsive to a denial of the slot request, dispense with the query in accordance with an enforcement mode.

23. The system of claim 21, wherein the processor is further configured to:

responsive to a denial of the slot request, respond to the denial of the slot request in accordance with an enforcement mode, wherein the enforcement mode is published by the cluster master at the search head as part of a heartbeat response message received from the cluster master.

24. The system of claim 21, wherein the processor is further configured to:

responsive to a denial of the slot request, dispense with the query in accordance with an enforcement mode, wherein the enforcement mode comprises taking an action selected from the group consisting of;

canceling the query, transmitting the query to the active indexers despite the denial of the slot request, queuing the query, delaying the query, and canceling the query if a number of entries in a search queue are above a threshold value.

25. The system of claim 21, wherein the cluster master and the indexer cluster are located in a cloud network, and wherein the search head is located at an on-premises location of an organization.

26. The system of claim 21, wherein the cluster master, the search head and the indexer cluster are located in a cloud network.

27. The system of claim 21, wherein the cluster master, the search head and the indexer cluster are located at an on-premises location of an organization.

28. The system of claim 21, wherein the cluster master and the indexer cluster are located at an on-premises location of an organization, and wherein the search head is located in a cloud network.

29. The system of claim 21, wherein an evaluation of the slot request by the cluster master comprises consulting a plurality of static policies selected from the group consisting of:

maximum number of concurrent searches, frequency of searches, source of searches, and type of search.

30. The system of claim 21, wherein an evaluation of the slot request by the cluster master comprises consulting a plurality of dynamic policies selected from the group consisting of:

I/O level usage of the search head, CPU usage by the search head, memory usage by the search head, types of indexes accessed by the query, and number of archived indexes accessed by the query.