DYNAMIC SCHEDULING OF TASKS FOR COLLECTING AND PROCESSING DATA USING JOB CONFIGURATION DATA

• US 20150143377A1
• Filed: 01/30/2015
• Published: 05/21/2015
• Est. Priority Date: 07/29/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: BINGHAM, Brian, FLETCHER, Tristan
• Granted Patent: US 10,089,143 B2
• Time in Patent Office: Days
• US Class Current: 718/102
• CPC Class Codes: G06F 16/316 Indexing structures
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: G06F 9/5011 the resources being hardware resources other than CPUs, Servers and Terminals
• CPC Class Codes: G06F 9/5033 considering data affinity
• CPC Class Codes: G06F 9/505 considering the load
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders'"'"' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Claims

1-30. -30. (canceled)

31. A computer-implemented method, comprising:

identifying, by a scheduler, a plurality of jobs, wherein each job in the plurality of jobs comprises collecting data from one or more external sources;

transmitting, at a direction of the scheduler, credentials to each forwarder in a set of multiple forwarders, wherein each forwarder stores the credentials;

generating, by the scheduler, job configuration data that includes identification of a data collection task to perform, a data filter to apply, and a target source from which the data is to be collected;

selecting, by the scheduler, for each job a particular forwarder and assigning the job to the particular forwarder selected, wherein assigning the job to the particular forwarder takes into account information received from the particular forwarder on completion of previously assigned jobs;

transmitting, by the scheduler, the job configuration data that includes the identification of the data collection task to perform, the data filter to apply, and the target source from which the data is to be collected to the particular forwarder, and

using, by the particular forwarder, the job configuration data and the stored credentials in combination as needed to execute the job.

32. The method of claim 31, wherein the job configuration data specifies at least one client preference, comprising:

format of data output of the job; and

a relative expiration deadline of initiation of execution the job.

33. The method of claim 31, wherein the job configuration data identifies a data-request format required by a particular target source.

34. The method of claim 31, further comprising:

responsive to modifications to the job configuration data, transmitting the modified job configuration data to the each forwarder in the set of multiple forwarders.

35. The method of claim 31, further comprising:

responsive to addition of a new forwarder to the set of multiple forwarders and modifications to the job configuration data, transmitting the modified job configuration data to the new forwarder.

36. The method of claim 31, wherein the plurality of jobs includes a job to collect unstructured data from a first external source using a first application programming interface (API) and further includes a job to collect unstructured data from a second external source using a second API.

37. The method of claim 31, wherein one of the plurality of jobs includes collecting the data from an external host of a web service.

38. The method of claim 31, further comprising:

estimating a load for each forwarder in the set of forwarders based on received communications from the forwarders; and

wherein the assigning of jobs is made based on the estimated load.

39. The method of claim 31, further comprising:

receiving an identification of a new forwarder, wherein the identification of the new forwarder is received after each job in the plurality of jobs is assigned but before the selection of a further forwarder to perform a further job is made; and

adding the new forwarder to the set of forwarders, wherein selecting the further forwarder of the set of forwarders comprises comparing an estimated current workload for the new forwarder to an estimated current workload for another forwarder in the set of forwarders.

40. The method of claim 31, further comprising:

prior to selecting the particular forwarder, determining a number of worker processes present on each forwarder in the set of forwarders, wherein selecting the particular forwarder is based at least in part on the number of worker processes present on each forwarder in the set of forwarders.

41. The method of claim 31, wherein, for a first job in the plurality of jobs, the data to be collected includes unstructured data.

42. The method of claim 31, wherein a second job and one first job in the plurality of jobs pertain to data provided by a same source, and wherein the selection of the forwarder to perform the second job is made based on a bias towards assigning the second job and the one first job to a same forwarder.

43. The method of claim 31, further comprising:

accessing, at the scheduler, workload data that describes at least a collection task and a schedule of times at which the collection task is to be performed; and

dividing, by the scheduler, the workload into at least a first job of the plurality of jobs and a second job.

44. The method of claim 31, further comprising:

assigning, by the scheduler, a first job to the particular forwarder; and

wherein selecting the particular forwarder to perform a second job is based at least in part on the first job and the second job having both originated from a same workload.

45. The method of claim 31, further comprising:

maintaining capability data describing, for each forwarder in the set of forwarders, one or more handlers at the forwarder and one or more data collection tasks that each of the one or more handlers is configured to perform; and

wherein assigning each job in the plurality of jobs is based at least partially on the capability data.

46. The method of claim 31, further comprising:

wherein the scheduler executes at a particular computing device;

wherein the set of forwarders executes at a first set of one or more computing devices that includes at least one computing device other than the particular computing device; and

wherein the plurality of indexers execute at a second set of one or more computing devices that is different than the first set of one or more computing devices.

47. The method of claim 31, wherein assigning a second job to the particular forwarder is based at least in part on the received communication not including a communication that indicates that a first forwarder has completed a first job to which the first forwarder was assigned.

48. A system, comprising:

a plurality of data processors associated with a scheduler and a set of forwarders; and

a non-transitory computer-readable storage medium containing instructions which when executed on the plurality of data processors, cause the processors to perform operations including;

identifying, by a scheduler, a plurality of jobs, wherein each job in the plurality of jobs comprises collecting data from one or more external sources;

transmitting, at a direction of the scheduler, credentials to each forwarder in a set of multiple forwarders, wherein each forwarder stores the credentials;

generating, by the scheduler, job configuration data that includes identification of a data collection task to perform, a data filter to apply, a target source from which the data is to be collected, and a particular indexer in a plurality of indexers to receive the data;

selecting, by the scheduler, for each job a particular forwarder and assigning the job to the particular forwarder selected, wherein assigning the job to the particular forwarder takes into account information received from the particular forwarder on completion of previously assigned jobs;

transmitting, by the scheduler, the job configuration data that includes the identification of a data collection task to perform, a data filter to apply, and a target source from which the data is to be collected to the particular forwarder; and

using, by the particular forwarder, the job configuration data and the stored credentials in combination as needed to execute the job.

49. The method of claim 48, wherein the job configuration data specifies at least one client preference, comprising:

format of data output of the job; and

a relative expiration deadline of initiation of execution the job.

50. The system of claim 48, wherein the job configuration data identifies a data-request format required by a particular target source.

51. The system of claim 48, further comprising:

responsive to modifications to the job configuration data, transmitting the modified job configuration data to the each forwarder in the set of multiple forwarders.

52. The system of claim 48, further comprising:

responsive to addition of a new forwarder to the set of multiple forwarders and modifications to the job configuration data, transmitting the modified job configuration data to the new forwarder.

53. The system of claim 48, wherein the plurality of jobs includes a job to collect unstructured data from a first external source using a first application programming interface (API) and further includes a job to collect unstructured data from a second external source using a second API.

54. The system of claim 48, wherein one of the plurality of jobs includes collecting the data from an external host of a web service.

55. The system of claim 48, wherein the operations further comprise:

estimating a load for each forwarder in the set of forwarders based on the received communication; and

wherein the selection is made based on the estimated loads.

56. The system of claim 48, wherein the operations further comprise:

receiving an identification of a new forwarder, wherein the identification of the new forwarder is received after each job in the plurality of jobs is assigned but before the selection of a further forwarder to perform a further job is made; and

adding the new forwarder to the set of forwarders, wherein selecting the further forwarder of the set of forwarders comprises comparing an estimated current workload for the new forwarder to an estimated current workload for another forwarder in the set of forwarders.

58. The system of claim 58, wherein, for a first job in the plurality of jobs, the data to be collected includes unstructured data.

57. The system of claim 58, wherein the operations further comprise:

prior to selecting the particular forwarder, determining a number of worker processes present on each forwarder in the set of forwarders, wherein selecting the particular forwarder is based at least in part on the number of worker processes present on each forwarder in the set of forwarders.

59. The system of claim 58, wherein a second job and one first job in the plurality of jobs pertain to data provided by a same source, and wherein the selection of the forwarder to perform the second job is made based on a bias towards assigning the second job and the one first job to a same forwarder.

60. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a plurality of data processors associated with a scheduler and a set of forwarders to:

identify, by a scheduler, a plurality of jobs, wherein each job in the plurality of jobs comprises collecting data from one or more external sources;

transmit, at a direction of the scheduler, credentials to each forwarder in a set of multiple forwarders, wherein each forwarder stores the credentials;

generate, by the scheduler, job configuration data that includes identification of a data collection task to perform, a data filter to apply, a target source from which the data is to be collected, and a particular indexer in a plurality of indexers to receive the data;

select, by the scheduler, for each job a particular forwarder and assign the job to the particular forwarder selected, wherein assigning the job to the particular forwarder takes into account information received from the particular forwarder on completion of previously assigned jobs;

transmit, by the scheduler, the job configuration data that includes the identification of a data collection task to perform, a data filter to apply, and a target source from which the data is to be collected to the particular forwarder, and

use, by the particular forwarder, the job configuration data and the stored credentials in combination as needed to execute the job.