US 12,073,103 B1
Multiple storage system event handling
Amritpal Singh Bath, Alamo, CA (US); Samat Jain, San Francisco, CA (US); Felix Jiang, San Jose, CA (US); Shanmugam Kailasam, Cupertino, CA (US); Jibang Liu, San Jose, CA (US); Isabelle Park, Glendale, CA (US); Vishal Patel, San Francisco, CA (US); Divya Vijayan, Pleasant Hill, CA (US); Jiahan Wang, San Mateo, CA (US); and Tingjin Xu, Dublin, CA (US)
Assigned to Splunk Inc., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Jul. 29, 2022, as Appl. No. 17/877,743.
Int. Cl. G06F 16/00 (2019.01); G06F 3/06 (2006.01)
CPC G06F 3/0644 (2013.01) [G06F 3/0604 (2013.01); G06F 3/0643 (2013.01); G06F 3/0683 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
obtaining, by an output processor, a plurality of events for storage on a plurality of storage systems,
wherein the plurality of storage systems comprises a first storage system and a second storage system,
wherein the first storage system comprises a first file system having a first directory structure defined by a first partitioning scheme, and
wherein the second storage system comprises a second file system having a second directory structure defined by a second partitioning scheme, the second partitioning scheme being different than the first partitioning scheme; and
for each event of the plurality of events and by the output processor:
extracting a plurality of field values from the event, and
matching the plurality of field values to a plurality of configurations of the plurality of storage systems to assign the event to at least a subset of the plurality of storage systems having a matching configuration,
wherein the matching the plurality of field values results in a first subset of events being assigned to the first storage system and a second subset of events being assigned to the second storage system, wherein the first subset of events and the second subset of events are in the plurality of events;
storing, by the output processor, the first subset of events in a first ingest module queue of a first storage system ingest module corresponding to the first storage system;
storing, by the output processor, the second subset of events in a second ingest module queue of a second storage system ingest module corresponding to the second storage system;
partitioning, by a first event partition processor of the first storage system ingest module, the first subset of events in the first ingest module queue according to the first partitioning scheme to generate a partitioned first subset of events;
partitioning, by a second event partition processor of the first storage system ingest module, the second subset of events in the second ingest module queue according to the second partitioning scheme to generate a partitioned second subset of events; and
transmitting, by the first storage system ingest module and the second storage system ingest module, the partitioned first subset of events to the first storage system and the partitioned second subset of events to the second storage system.