BATCH SEARCHES IN A DATA FABRIC SERVICE SYSTEM
1 Assignment
0 Petitions
Accused Products
Abstract
The disclosed embodiments include a technique to obtain search results from the application of transformation operations on partial search results obtained from across internal and/or external data sources. Examples of transformation operations include arithmetic operations such as an average, mean, count, or the like. Examples of reporting transformations include join operations, statistics, sort, top head. Hence, the search results of a search query can be derived from partial search result rather than include the actual partial search results. In this case, the ordering of the search results may be nonessential. An example of a search query that requires a transformation operation is a “batch” or “reporting” search query. The related disclosed techniques involve obtaining data stored in the bid data ecosystem, and returning that data or data derived from that data.
51 Citations
60 Claims
-
1-30. -30. (canceled)
-
31. A computer-implemented method for performing a batch search operation across one or more worker nodes, the method comprising:
-
obtaining partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query, and wherein at least one of the partial search results comprises one or more events, each event being associated with a timestamp and including raw machine data reflective of activity within an information technology infrastructure; performing one or more transformation operations on at least a portion of the partial search results to produce commonly formatted partial search results; determining which of the commonly formatted partial search results were obtained from one or more internal data sources and which of the commonly formatted partial search results were obtained from one or more external data sources; and processing the commonly formatted partial search results according to whether the commonly formatted partial search results were obtained from the one or more internal data sources or from the one or more external data sources to generate finalized partial search results. - View Dependent Claims (32, 33, 34, 35, 36, 37, 38, 39, 40)
-
-
41. A non-transitory computer-readable medium including instructions that, when executed by a processor included in a worker node, cause the processor to perform the steps of:
-
obtaining partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query, and wherein at least one of the partial search results comprises one or more events, each event being associated with a timestamp and including raw machine data reflective of activity within an information technology infrastructure; performing one or more transformation operations on at least a portion of the partial search results to produce commonly formatted partial search results; determining which of the commonly formatted partial search results were obtained from one or more internal data sources and which of the commonly formatted partial search results were obtained from one or more external data sources; and processing the commonly formatted partial search results according to whether the commonly formatted partial search results were obtained from the one or more internal data sources or from the one or more external data sources to generate finalized partial search results. - View Dependent Claims (42, 43, 44, 45, 46, 47, 48, 49, 50)
-
-
51. A system, comprising:
one or more worker nodes, wherein each worker node includes a processor and a memory that stores respective instructions, and, when each processor executes the respective instructions, the one or more worker nodes are configured to; obtain partial search results from a plurality of data sources, wherein each of the partial search results satisfies a portion of a search query, and wherein at least one of the partial search results comprises one or more events, each event being associated with a timestamp and including raw machine data reflective of activity within an information technology infrastructure; perform one or more transformation operations on at least a portion of the partial search results to produce commonly formatted partial search results; determine which of the commonly formatted partial search results were obtained from one or more internal data sources and which of the commonly formatted partial search results were obtained from one or more external data sources; and process the commonly formatted partial search results according to whether the commonly formatted partial search results were obtained from the one or more internal data sources or from the one or more external data sources to generate finalized partial search results. - View Dependent Claims (52, 53, 54, 55, 56, 57, 58, 59, 60)
Specification