US 12,248,484 B2
Reassigning processing tasks to an external storage system
Sourav Pal, Foster City, CA (US); Arindam Bhattacharjee, Fremont, CA (US); and Wayne Patterson, Burlingame, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Oct. 18, 2019, as Appl. No. 16/657,894.
Application 16/657,894 is a continuation in part of application No. 16/398,038, filed on Apr. 29, 2019, granted, now 11,580,107.
Application 16/398,038 is a continuation in part of application No. 16/147,165, filed on Sep. 28, 2018, granted, now 10,956,415.
Application 16/147,165 is a continuation in part of application No. 16/051,197, filed on Jul. 31, 2018, granted, now 11,663,227.
Application 16/051,197 is a continuation in part of application No. 15/665,197, filed on Jul. 31, 2017, granted, now 11,461,334.
Application 16/051,197 is a continuation in part of application No. 15/665,279, filed on Jul. 31, 2017, granted, now 11,416,528.
Application 16/051,197 is a continuation in part of application No. 15/665,148, filed on Jul. 31, 2017, granted, now 10,726,009.
Application 16/051,197 is a continuation in part of application No. 15/665,302, filed on Jul. 31, 2017, granted, now 10,795,884.
Application 16/051,197 is a continuation in part of application No. 15/665,187, filed on Jul. 31, 2017, granted, now 11,232,100.
Application 16/051,197 is a continuation in part of application No. 15/665,339, filed on Jul. 31, 2017, abandoned.
Application 16/051,197 is a continuation in part of application No. 15/665,248, filed on Jul. 31, 2017, granted, now 11,163,758.
Application 16/051,197 is a continuation in part of application No. 15/665,159, filed on Jul. 31, 2017, granted, now 11,281,706.
Prior Publication US 2020/0050607 A1, Feb. 13, 2020
Int. Cl. G06F 16/2458 (2019.01); G06F 16/2453 (2019.01)
CPC G06F 16/2471 (2019.01) [G06F 16/24549 (2019.01)] 30 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving, at a data intake and query system comprising one or more hardware processors, a query;
determining, by accessing a configuration file, that the query references an external search for a remote data store that stores data referenced by the external search, wherein the external search comprises a subquery of the query that is identified from the configuration file based at least in part on a reference within the query;
determining that the remote data store includes processing capabilities;
determining a type of processing capabilities of the remote data store;
identifying additional processing to be performed on results of the external search based on the query;
determining an amount of time to perform the additional processing at the remote data store;
determining that the amount of time to perform the additional processing at the remote data store does not exceed a threshold time, wherein the threshold time is based at least in part on an amount of time to perform the additional processing at the data intake and query system, and wherein the threshold time is based at least in part on an amount of computing resources available at the data intake and query system to execute the additional processing; and
in response to determining that the amount of time to perform the additional processing at the remote data store does not exceed the threshold time,
generating additional processing instructions based on the identified additional processing to be performed on the results of the external search and the determined type of processing capabilities of the remote data store; and
communicating the external search in combination with the additional processing instructions to the remote data store to perform preprocessing of search results of the external search to obtain a modified result of the external search to be received from the remote data store in place of the search results, wherein the amount of time to perform the additional processing at the remote data store further comprises an amount of time to transmit the modified result of the external search to the data intake and query system, and wherein the modified result of the external search comprises a reduced data set and wherein the amount of time to transmit the modified result of the external search accounts for a reduced transmission time to transmit the reduced data set.