REPLICATION OF SUMMARY DATA IN A CLUSTERED COMPUTING ENVIRONMENT

• US 20160055225A1
• Filed: 10/30/2015
• Published: 02/25/2016
• Est. Priority Date: 05/15/2012
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Xu, Da, Vasan, Sundar, Bhagi, Dhruva Kumar
• Granted Patent: US 10,387,448 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/32 with visual or acoustical indication of the functioning of the machine
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: G06F 3/0617 in relation to availability
• CPC Class Codes: G06F 3/065 Replication mechanisms
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Techniques and mechanisms are disclosed to increase the availability of summary data within a clustered data intake and query system by replicating the summary data within the cluster. In general, summary data may store “pre-computed” results for one or more search queries and can be used by indexers of a cluster to process subsequent instances of the same search queries. At a high level, replication of summary data within a cluster may include ensuring that each instance of summary data created by an indexer of a cluster is replicated to other indexers within the cluster that store copies of the same grouped subset(s) of data to which the summary data relates. In this manner, if one or more indexers of an indexer cluster fail, other indexers of the cluster can make immediate use of replicated copies of the summary data without re-creating it.

Claims

1. A method comprising:

determining that an indexer of a group of indexers has summary data for a grouped subset of data stored by the indexer, the grouped subset of data including raw data received by the indexer and representative of the performance or operation of one or more components of an information technology (IT) environment, the summary data storing one or more results based on at least one search query for data from the grouped subset of data;

identifying one or more other indexers of the group of indexers that store a copy of the grouped subset of data and do not have a copy of the summary data;

causing the summary data to be sent to the identified one or more other indexers of the group of indexers.

2. The method of claim 1, wherein the summary data is associated with a report, and wherein the at least one search query is a recurring search used to generate the report.

3. The method of claim 1, wherein the summary data is associated with a data model for data stored by the group of indexers, and wherein the one or more results correspond to fields of the data model.

4. The method of claim 1, wherein subsequent instances of the at least one search query retrieve the one or more results from the summary data.

5. The method of claim 1, wherein the summary data is searchable by queries other than the at least one search query.

6. The method of claim 1, wherein the one or more results are based on a transformation of data returned from the grouped subset of data based on the least one search query, the transformation including one or more of:

an aggregation, a filtering, and a data conversion.

7. The method of claim 1, wherein determining that an indexer of a group of indexers has summary data for a grouped subset of data stored by the indexer includes receiving, by a master node of the group of indexers, a message from the indexer indicating that the indexer has the summary data.

8. The method of claim 1, further comprising sending, by a master node of the group of indexers, summary data replication instructions to the indexer, the summary data replication instructions causing the indexer to send the summary data to the identified one or more other indexers of the group of indexers.

9. The method of claim 1, wherein the group of indexers is configured as an indexer cluster, and wherein the indexer cluster is configured to replicate grouped subsets of data within the indexer cluster based on a data replication policy.

10. The method of claim 1, wherein determining that an indexer of a group of indexers has summary data for a grouped subset of data stored by the indexer is based on performing, by a master node of the group of indexers, a scheduled search for new summary data stored by the indexer.

11. The method of claim 1, further comprising:

receiving, from each indexer of the group of indexers, summary metadata indicating a set of summary data instances stored by the indexer, each summary data instance associated with a particular grouped subset of data stored by the indexer;

generating, based on the summary metadata, a summary data manifest indicating, for each indexer of the group of indexers, summary data instances stored by the indexer;

wherein identifying the one or more other indexers of the group of indexers includes determining that the summary data manifest does not include the summary data.

12. The method of claim 1, further comprising:

receiving, from each indexer of the group of indexers, summary metadata indicating a set of summary data instances stored by the indexer, each summary data instance associated with a particular grouped subsets of data stored by the indexer;

generating, based on the summary metadata, a summary data manifest indicating, for each indexer of the group of indexers, summary data instances stored by the indexer;

in response to determining that the indexer has the summary data for the grouped subset of data stored by the indexer, updating the summary data manifest to include the summary data.

13. The method of claim 1, wherein the indexer stores the summary data separate from the grouped subset of data.

14. The method of claim 1, wherein the grouped subset of data includes the summary data.

15. The method of claim 1, further comprising:

receiving, by a master node of the group of indexers, a copy of the summary data from the indexer;

wherein causing the summary data to be sent to the identified one or more other indexers of the group of indexers includes sending, by the master node, the copy of the summary data to the one or more other indexers.

16. The method of claim 1, wherein causing the summary data to be sent to the identified one or more other indexers of the group of indexers includes sending, by a master node of the group of indexers, summary data replication instructions to the indexer, the summary data replication instructions causing the indexer to send the summary data to the identified one or more other indexers of the group of indexers.

17. The method of claim 1, wherein causing the summary data to be sent to the identified one or more other indexers of the group of indexers includes sending, by a master node of the group of indexers, summary data replication instructions to the indexer, the summary data replication instructions causing the indexer to send the summary data to the identified one or more other indexers of the group of indexers;

and

wherein the summary data replication instructions include separate commands to send the summary data to each indexer of the identified one or more other indexers.

18. The method of claim 1, wherein determining that the indexer has summary data includes determining that the indexer has new summary data for the grouped subset of data.

19. The method of claim 1, wherein determining that the indexer has summary data includes determining that the indexer has updated summary data for the grouped subset of data.

20. The method of claim 1, wherein the summary data is associated with an identifier of a search head that sent the specified search query.

21. The method of claim 1, further comprising:

receiving, from the indexer of the cluster of indexers, a message indicating that the indexer has deleted existing summary data for a grouped subset of data stored by the indexer;

sending instructions to the identified one or more other indexers to delete the existing summary data stored at the identified one or more other indexers.

22. The method of claim 1, further comprising:

receiving, from the indexer of the cluster of indexers, a message indicating that the indexer has trimmed existing summary data for a grouped subset of data stored by the indexer;

sending instructions to the identified one or more other indexers to trim the existing summary data stored at the identified one or more peer indexers.

23. The method of claim 1, wherein the indexer has primary responsibility for responding to search queries for data stored by the grouped subset of data, and wherein the one or more other indexers do not respond to searches for data stored by the copy of the grouped subset of data.

24. The method of claim 1, wherein identifying the one or more other indexers of the group of indexers includes determining that the one or more other indexers store a searchable copy of the grouped subset of data.

25. The method of claim 1, wherein causing the summary data to be sent to the one or more others indexers causes the one or more other indexers to store the summary data in a storage location identified by the grouped subset of data, a search head identifier, and an identifier of the summary data.

26. The method of claim 1, further comprising sending, by a master node of the group of indexers, summary data replication instructions to the indexer, the summary data replication instructions causing the indexer to send the summary data to the identified one or more other indexers of the group of indexers;

wherein the summary replication instructions further cause the indexer to;

lock a storage location storing the summary data;

create a copy of the summary data; and

send the copy of the summary data to the one or more peer indexers.

27. The method of claim 1, wherein the grouped subset of data includes a plurality of events, each event of the plurality of events associated with a timestamp and including a portion of the raw data received by the indexer.

28. The method of claim 1, wherein the grouped subset of data includes a plurality of events, and wherein the one or more results are based on one or more events of the plurality of events.

29. One or more non-transitory computer-readable storage media, storing instructions which, when executed by one or more processors, cause performance of:

determining that an indexer of a group of indexers has summary data for a grouped subset of data stored by the indexer, the grouped subset of data including raw data received by the indexer and representative of the performance or operation of one or more components of an information technology (IT) environment, the summary data storing one or more results based on at least one search query for data from the grouped subset of data;

identifying one or more other indexers of the group of indexers that store a copy of the grouped subset of data and do not have a copy of the summary data;

causing the summary data to be sent to the identified one or more other indexers of the group of indexers.

30. An apparatus, comprising:

a subsystem, implemented at least partially in hardware, that determines that an indexer of a group of indexers has summary data for a grouped subset of data stored by the indexer, the grouped subset of data including raw data received by the indexer and representative of the performance or operation of one or more components of an information technology (IT) environment, the summary data storing one or more results based on at least one search query for data from the grouped subset of data;

a subsystem, implemented at least partially in hardware, that identifies one or more other indexers of the group of indexers that store a copy of the grouped subset of data and do not have a copy of the summary data;

a subsystem, implemented at least partially in hardware, that causes the summary data to be sent to the identified one or more other indexers of the group of indexers.