Generating row-based and column-based chunks
First Claim
Patent Images
1. A computer-implemented method of processing events, wherein an event includes multiple fields, the method comprising:
- receiving a set of events;
generating a row-based chunk that includes the set of events and metadata about the set of events, wherein the row-based chunk is associated with a first retention policy;
generating a column-based chunk that includes metadata about the set of events and, for each event in the set of events, a value of a first field of the multiple fields, wherein the column-based chunk is associated with a second retention policy different from the first retention policy, and wherein the metadata about the set of events in the column-based chunk includes at least one of a minimum value or a maximum value of values of the first field over the events in the set of events;
reclaiming storage used by a file containing the row-based chunk according to the first retention policy; and
reclaiming storage used by a file containing the column-based chunk according to the second retention policy.
11 Assignments
0 Petitions
Accused Products
Abstract
In some examples, a set of events is received. A row-based chunk includes the set of events and metadata about the set of events is generated, and a column-based chunk that includes metadata about the set of events and, for each event in the set of events, a value of a first field of the multiple fields. The metadata about the set of events includes at least one of a minimum value or a maximum value of the first field over the events in the set of events.
-
Citations
15 Claims
-
1. A computer-implemented method of processing events, wherein an event includes multiple fields, the method comprising:
-
receiving a set of events; generating a row-based chunk that includes the set of events and metadata about the set of events, wherein the row-based chunk is associated with a first retention policy; generating a column-based chunk that includes metadata about the set of events and, for each event in the set of events, a value of a first field of the multiple fields, wherein the column-based chunk is associated with a second retention policy different from the first retention policy, and wherein the metadata about the set of events in the column-based chunk includes at least one of a minimum value or a maximum value of values of the first field over the events in the set of events; reclaiming storage used by a file containing the row-based chunk according to the first retention policy; and reclaiming storage used by a file containing the column-based chunk according to the second retention policy. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
-
receive a first set of events, each event of the first set of events including multiple fields; generate a row-based chunk that includes the first set of events and metadata about the first set of events, wherein the metadata about the first set of events includes at least one of a minimum value or maximum value of values of a first field over the events in the first set of events, and wherein the row-based chunk is associated with a first retention policy; receive a second set of events, each event of the second set of events including the multiple fields; generate a first column-based chunk that includes metadata about the second set of events and, for each event in the second set of events, a value of a second field of the multiple fields, wherein the metadata about the second set of events includes at least one of a minimum value or maximum value of values of the second field over the events in the second set of events, wherein the column-based chunk is associated with a second retention policy different from the first retention policy; reclaim storage used by a file containing the row-based chunk according to the first retention policy; and reclaim storage used by a file containing the first column-based chunk according to the second retention policy. - View Dependent Claims (9, 10, 11, 12)
-
-
13. A system comprising:
-
at least one processor; and a non-transitory storage medium storing instructions executable on the at least one processor to; receive a query comprising a search term; access a first column-based chunk that includes, for each event in a set of events, a value of a first field of multiple fields; identify a value in the first column-based chunk that matches the search term; identify an index location identifier associated with the identified value; access a second column-based chunk that includes, for each event in the set of events, a table location identifier, wherein the first column-based chunk includes values of the first field but not values of other fields of the multiple fields, and wherein the second column-based chunk includes values of a second field but not values of other fields of the multiple fields; identify the table location identifier in the second column-based chunk that is associated with the identified index location identifier; access a row-based chunk that includes each event in the set of events; and identify an event in the row-based chunk that is associated with the identified table location identifier. - View Dependent Claims (14, 15)
-
Specification