Enforcing dependency between pipelines

• US 9,922,082 B2
• Filed: 01/30/2015
• Issued: 03/20/2018
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Robichaud, Marc Vincent
• Primary Examiner(s): Bullock, Joshua
• Application Number:
  US14/611,007
• Publication Number:
  US 20160224624A1
• Time in Patent Office: 1,145 Days
• Field of Search: 707722
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 16/24532 of parallel queries

Abstract

A dependency is created between a first search query and a second search query. The first search query defines a first data processing pipeline and the second search query defines a second data processing pipeline that extends the first data processing pipeline. A modification is detected to the first data processing pipeline defined by the first search query. Based on the modification to the first data processing pipeline being detected, the dependency is enforced such that the second data processing pipeline is modified to extend the modified first data processing pipeline. The modification to the first data processing pipeline can include a first set of pipelined commands corresponding to the first search query being modified, and the dependency can be enforced by causing a second set of pipelined commands corresponding to the second search query to be modified to include the modified first set of pipelined commands.

Claims

1. A computer-implemented method, comprising:

storing a dependency between a first search query and a second search query, the first search query defining a first data processing pipeline and the second search query defining a second data processing pipeline in which when a portion of the second data processing pipeline is executed, the portion of the second data processing pipeline receives an output of the first data processing pipeline as an input to thereby extend the first data processing pipeline;

detecting a modification to the first data processing pipeline defined by the first search query after the storing of the dependency; and

based on the modification to the first data processing pipeline being detected, causing the stored dependency to be enforced such that the second data processing pipeline is modified to cause the portion of the second data processing pipeline to receive the output from the modified first data processing pipeline when the portion of the second data pipeline is executed.

2. The computer implemented method of claim 1, wherein the causing the dependency to be enforced comprises causing the second data processing pipeline to be automatically modified to extend the modified first data processing pipeline.

3. The computer implemented method of claim 1, wherein the first search query comprises a first plurality of pipelined commands and the second search query comprises a second plurality of pipelined commands.

4. The computer implemented method of claim 1, wherein the modification to the first data processing pipeline comprises a first set of pipelined commands corresponding to the first search query being modified, and the causing the dependency to be enforced comprises causing a second set of pipelined commands corresponding to the second search query to be modified to include the modified first set of pipelined commands.

5. The computer implemented method of claim 1, comprising:

further based on the modification to the first data processing pipeline being detected;

causing a dependency to be enforced between the first search query and a third search query, such that a third data processing pipeline defined by the third search query is modified to extend the modified first data processing pipeline, wherein the third search query defines the third data processing pipeline that extends the first data processing pipeline.

6. The computer implemented method of claim 1, wherein the causing the dependency to be enforced comprises causing a data set to be applied as the input to the portion of the second search query that is extending the first data processing pipeline.

7. The computer implemented method of claim 1, further comprising:

causing display of a selection interface that is operable by a user to select the first search query from a plurality of saved search queries, the first search query and the second search query being of the plurality of saved search queries;

based on the user selecting the first search query using the selection interface, causing display of at least some commands of the first search query in a graphical interface that is operable by the user to modify the first search query, wherein the detected modification to the first data processing pipeline defined by the first search query is caused by the user modifying the first search query using the graphical interface.

8. The computer implemented method of claim 1, further comprising:

causing display of a selection interface that is operable by a user to select an entry that stores the first search query from a plurality of saved search queries, the first search query being of the plurality of saved search queries;

based on the user selecting the entry using the selection interface;

causing display of an interface that is operable by the user to extend the first data processing pipeline by extending the first search query with additional commands; and

causing the extended first search query to be saved as the second search query that extends the first data processing pipeline, wherein a new entry is created for the second search query in the plurality of saved search queries while retaining the entry that stores the first search query without the additional commands.

9. The computer implemented method of claim 1, further comprising:

causing display of a selection interface that is operable by a user to select the first search query from a plurality of saved search queries, the first search query being of the plurality of saved search queries; and

causing the dependency between the first search query and the second search query to be created based on the user selecting the first search query from the plurality of saved search queries.

10. The computer implemented method of claim 1, wherein the detected modification to the first data processing pipeline causes a modification to an output data set corresponding to the first data processing pipeline;

and

the causing the dependency to be enforced comprises causing the modified output data set to be applied as the input to the portion of the second search query that is extending the first data processing pipeline.

11. The computer implemented method of claim 1, wherein the detected modification to the first data processing pipeline generates an output data set from the modified first date processing pipeline;

and

the causing the dependency to be enforced comprises causing the output data set to be applied as the input to the portion of the second search query that is extending the first data processing pipeline.

12. The computer implemented method of claim 1, wherein the causing the dependency to be enforced comprises causing the second search query to be modified to define the modified second data processing pipeline.

13. The computer implemented method of claim 1, further comprising causing the first search query to be executed, the executing applying a late binding schema to events, the late binding schema associated with one or more extraction rules defining one or more fields for a set of events.

14. The computer implemented method of claim 1, wherein the modification to the first data processing pipeline defined by the first search query comprises a modification to the first search query.

15. The computer implemented method of claim 1, wherein the second data processing pipeline is modified to extend the modified first data processing pipeline while loaded into a search interface displaying an output data set of the second data processing pipeline, and further based on the modification to the first data processing pipeline being detected, automatically causing display of a new output data set corresponding to the modified second data processing pipeline in the search interface.

16. The computer implemented method of claim 1, comprising causing the first search query to be executed to generate an output data set;

and

causing the output data set to be displayed in a search interface, the output data set comprising a plurality of time-stamped events, each of the plurality of time-stamped events comprising event raw data.

17. The computer implemented method of claim 1, comprising causing the second search query to be executed to generate an output data set;

and

causing the output data set to be displayed in a search interface, the output data set comprising a plurality of time-stamped events, each of the plurality of time-stamped events comprising event raw data.

18. A computer-implemented system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including;

storing a dependency between a first search query and a second search query, the first search query defining a first data processing pipeline and the second search query defining a second data processing pipeline in which when a portion of the second data processing pipeline is executed, the portion of the second data processing pipeline receives an output of the first data processing pipeline as an input to thereby extend the first data processing pipeline;

detecting a modification to the first data processing pipeline defined by the first search query after the storing of the dependency; and

based on the modification to the first data processing pipeline being detected, causing the stored dependency to be enforced such that the second data processing pipeline is modified to cause the portion of the second data processing pipeline to receive the output from the modified first data processing pipeline when the portion of the second data pipeline is executed.

19. The system of claim 18, wherein the causing the dependency to be enforced comprises causing the second data processing pipeline to be automatically modified to extend the modified first data processing pipeline.

20. The system of claim 18, wherein the first search query comprises a first plurality of pipelined commands and the second search query comprises a second plurality of pipelined commands.

21. The system of claim 18, wherein the modification to the first data processing pipeline comprises a first set of pipelined commands corresponding to the first search query being modified, and the causing the dependency to be enforced comprises causing a second set of pipelined commands corresponding to the second search query to be modified to include the modified first set of pipelined commands.

22. The system of claim 18, the operations comprising:

further based on the modification to the first data processing pipeline being detected;

causing a dependency to be enforced between the first search query and a third search query such that a third data processing pipeline defined by the third search query is modified to extend the modified first data processing pipeline, wherein the third search query defines the third data processing pipeline that extends the first data processing pipeline.

23. The system of claim 18, wherein the causing the dependency to be enforced comprises causing a data set to be applied as the input to the portion of the second search query that is extending the first data processing pipeline.

24. The system of claim 18, the operations further comprising:

causing display of a selection interface that is operable by a user to select the first search query from a plurality of saved search queries, the first search query and the second search query being of the plurality of saved search queries;

based on the user selecting the first search query using the selection interface, causing display of at least some commands of the first search query in a graphical interface that is operable by the user to modify the first search query, wherein the detected modification to the first data processing pipeline defined by the first search query is caused by the user modifying the first search query using the graphical interface.

25. One or more non-volatile computer-storage media storing computer-useable instructions that, when executed by at least one computing device, cause the at least one computing device to perform a method, the method comprising:

storing a dependency between a first search query and a second search query, the first search query defining a first data processing pipeline and the second search query defining a second data processing pipeline in which when a portion of the second data processing pipeline is executed, the portion of the second data processing pipeline receives an output of the first data processing pipeline as an input to thereby extend the first data processing pipeline;

detecting a modification to the first data processing pipeline defined by the first search query after the storing of the dependency; and

based on the modification being detected, causing the stored dependency to be enforced such that the second data processing pipeline is modified to cause the portion of the second data processing pipeline to receive the output from the modified first data processing pipeline when the portion of the second data pipeline is executed.

26. The one or more computer-storage media of claim 25, wherein the causing the dependency to be enforced comprises causing the second data processing pipeline to be automatically modified to extend the modified first data processing pipeline.

27. The one or more computer-storage media of claim 25, wherein the first search query comprises a first plurality of pipelined commands and the second search query comprises a second plurality of pipelined commands.

28. The one or more computer-storage media of claim 25, wherein the modification to the first data processing pipeline comprises a first set of pipelined commands corresponding to the first search query being modified, and the causing the dependency to be enforced comprises causing a second set of pipelined commands corresponding to the second search query to be modified to include the modified first set of pipelined commands.

29. The one or more computer-storage media of claim 25, the operations comprising:

further based on the modification to the first data processing pipeline being detected;

causing a dependency to be enforced between the first search query and a third search query such that a third data processing pipeline defined by the third search query is modified to extend the modified first data processing pipeline, wherein the third search query defines the third data processing pipeline that extends the first data processing pipeline.

30. The one or more computer-storage media of claim 25, wherein the causing the dependency to be enforced comprises causing a data set to be applied as the input to the portion of the second search query that is extending the first data processing pipeline.