SCALABLE INTERACTIVE DISPLAY OF DISTRIBUTED DATA
First Claim
1. A method comprising:
- receiving a query to search a plurality of event records that are stored across a plurality of computing devices;
submitting a sub-query derived from the received query to each of the plurality of computing devices, wherein each of the plurality of computing devices analyzes event records stored on that computing device, based on the sub-query, to generate one or more event references and to generate an analysis result;
receiving one or more event references from each of the plurality of computing devices, wherein each event reference includes a unique event record identifier and an event order value;
combining the one or more event references from each of the plurality of computing devices into a list of event references ordered by event order value;
providing the ordered list of event references in response to the query;
receiving a request for event records associated with a contiguous subset of the ordered list of event references;
requesting event records from one or more of the plurality of computing devices by sending each unique event record identifier included in the requested contiguous subset of the ordered list of event references to the corresponding computing device; and
providing the requested event records and the analysis result to a display device for display.
1 Assignment
0 Petitions
Accused Products
Abstract
A method, system, and processor-readable storage medium are directed towards generating a report derived from data, such as event data, stored on a plurality of distributed nodes. In one embodiment the analysis is generated using a “divide and conquer” algorithm, such that each distributed node analyzes locally stored event data while an aggregating node combines these analysis results to generate the report. In one embodiment, each distributed node also transmits a list of event data references associated with the analysis result to the aggregating node. The aggregating node may then generate a global ordered list of data references based on the list of event data references received from each distributed node. Subsequently, in response to a user selection of a range of global event data, the report may dynamically retrieve event data from one or more distributed nodes for display according to the global order.
-
Citations
20 Claims
-
1. A method comprising:
-
receiving a query to search a plurality of event records that are stored across a plurality of computing devices; submitting a sub-query derived from the received query to each of the plurality of computing devices, wherein each of the plurality of computing devices analyzes event records stored on that computing device, based on the sub-query, to generate one or more event references and to generate an analysis result; receiving one or more event references from each of the plurality of computing devices, wherein each event reference includes a unique event record identifier and an event order value; combining the one or more event references from each of the plurality of computing devices into a list of event references ordered by event order value; providing the ordered list of event references in response to the query; receiving a request for event records associated with a contiguous subset of the ordered list of event references; requesting event records from one or more of the plurality of computing devices by sending each unique event record identifier included in the requested contiguous subset of the ordered list of event references to the corresponding computing device; and providing the requested event records and the analysis result to a display device for display. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. An apparatus comprising:
-
a processor; and a memory storing instructions that when executed by the processor cause actions to be performed, including; receiving one or more event references from each of a plurality of computing devices, wherein each event reference includes an identifier of a source computing device, an index into an array of event records stored on the source computing device, and an event order value; combining the one or more event references from each of the plurality of computing devices into a list of event references ordered by event order value; receiving a request for event records associated with a contiguous range of the ordered list of event references; retrieving event records from one or more of the plurality of computing devices by sending the index to the corresponding source computing device for each event reference in the requested contiguous range of the ordered list of event references; and providing the requested event records to a display device for display. - View Dependent Claims (9, 10, 11, 12)
-
-
13. A non-transitory processor readable storage device storing instructions that cause a processor to perform actions, comprising:
-
receiving one or more event references from each of a plurality of computing devices, wherein each event reference includes an identifier of a source computing device, an index into an array of event records stored on the source computing device, and an event order value; receiving, in response to a query request, statistical information from each of the plurality of computing devices, where the statistical information is generated by each of the plurality of computing devices performing an analysis of event records stored on that computing device; combining the one or more event references from each of the plurality of computing devices into a list of event references, ordered by event order value; combining the statistical information from each of the computing devices into an aggregated statistical information; receiving a request for event records associated with a portion of the aggregated statistical information; retrieving the requested event records from the plurality of computing devices by sending, for each event reference associated with the portion of the aggregated statistical information, the index into the array of event records stored on the source computing device to the corresponding source computing device; and providing the requested event records to a display device for display. - View Dependent Claims (14, 15)
-
-
16. A system comprising:
-
a plurality of computing devices storing event records; a first computing device configured to perform actions comprising; receiving one or more event references from each of the plurality of computing devices, wherein each event reference includes a unique event record identifier and an event order value; combining the one or more event references from each of the plurality of computing devices into a list of event references ordered by event order value; receiving a request for event records associated with a contiguous range of ordered event references; retrieving event records from one or more of the plurality of computing devices by sending each unique event record identifier included in the requested contiguous range of ordered event references to the corresponding computing device; and providing the requested event records for display. - View Dependent Claims (17, 18, 19, 20)
-
Specification