US 12,066,995 B2
Generating a query response by combining partial results from separate partitions of event records
David Ryan Marquardt, San Francisco, CA (US); Stephen Phillip Sorkin, San Francisco, CA (US); and Steve Yu Zhang, San Francisco, CA (US)
Assigned to SPLUNK INC., San Francisco, CA (US)
Filed by SPLUNK INC., San Francisco, CA (US)
Filed on Sep. 23, 2021, as Appl. No. 17/482,781.
Application 17/482,781 is a continuation of application No. 16/451,450, filed on Jun. 25, 2019, granted, now 11,163,738.
Application 16/451,450 is a continuation of application No. 15/705,875, filed on Sep. 15, 2017, granted, now 10,387,396, issued on Aug. 20, 2019.
Application 15/705,875 is a continuation of application No. 15/007,185, filed on Jan. 26, 2016, granted, now 9,817,854, issued on Nov. 14, 2017.
Application 15/007,185 is a continuation of application No. 14/815,973, filed on Aug. 1, 2015, granted, now 9,990,386, issued on Jun. 5, 2018.
Application 14/815,973 is a continuation of application No. 14/170,159, filed on Jan. 31, 2014, granted, now 9,128,985, issued on Sep. 8, 2015.
Application 14/170,159 is a continuation of application No. 13/756,147, filed on Jan. 31, 2013, granted, now 8,682,925, issued on Mar. 25, 2014.
Prior Publication US 2022/0012221 A1, Jan. 13, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 7/00 (2006.01); G06F 16/00 (2019.01); G06F 16/22 (2019.01); G06F 16/2453 (2019.01); G06F 16/2455 (2019.01); G06F 16/248 (2019.01); G06F 16/28 (2019.01); G06F 16/951 (2019.01)
CPC G06F 16/2228 (2019.01) [G06F 16/00 (2019.01); G06F 16/24539 (2019.01); G06F 16/2455 (2019.01); G06F 16/248 (2019.01); G06F 16/284 (2019.01); G06F 16/951 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method for generating a query response, the method comprising:
creating two or more partitions of event records that are field searchable and time-stamped from raw data stored in a data store, wherein each event record in the two or more partitions of event records includes a portion of the raw data and is associated with a time stamp derived from the raw data, wherein each of the two or more partitions of event records are stored at a different one of a plurality of distributed locations in the data store, and wherein each of the plurality of distributed locations is associated with a different indexer that manages a respective partition of event records;
indexing and storing each event record of each of the two or more partitions of event records;
generating a respective summarization table for each partition of the two or more partitions that:
identifies a field value comprising a value that corresponds to an associated field extracted from a respective record; and
for the field value, includes a posting value to the respective event record within a respective partition, wherein the respective event record contains the field value for the associated field;
generating one or more partial results for a received query using summarization tables for the two or more partitions by executing the received query individually across each summarization table for a respective partition; and
generating a response to the received query by combining the one or more partial results.