US 12,141,137 B1
Query translation for an external data system
Raman Arora, Seattle, WA (US); Ankit Jain, Sunnyvale, CA (US); Meng Su, Sunnyvale, CA (US); Hailun Yan, Sunnyvale, CA (US); and Sophia Rui Zhu, Los Gatos, CA (US)
Assigned to Cisco Technology, Inc., San Jose, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Jul. 29, 2022, as Appl. No. 17/816,132.
Claims priority of provisional application 63/366,229, filed on Jun. 10, 2022.
Int. Cl. G06F 7/00 (2006.01); G06F 16/2452 (2019.01); G06F 16/2458 (2019.01)
CPC G06F 16/2452 (2019.01) [G06F 16/2477 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
receiving, at a computing device of a first query system, a first query in a first query language, the first query identifying a set of data and a manner of processing the set of data, wherein the first query includes a time-based query command;
processing the first query to determine the set of data includes a dataset residing in a shared storage system and accessible via a second query system using a second query language that is different from the first query language;
translating the first query into a second query in the second query language, wherein translating the first query comprises:
identifying a time range associated with the time-based query command,
generating at least one timestamp modification query command in the second query language for the second query to modify timestamps of events of the dataset based on the time range associated with the time-based query command,
generating at least one event organization query command in the second query language for the second query to organize the events of the dataset based on the time range associated with the time-based query command,
identifying a first query command in the first query proximate the time-based query command, and
copying the at least one timestamp modification query command into multiple locations of the second query based on the first query command;
communicating the second query to a search coordinator of a second query system, wherein the search coordinator executes the second query on the dataset and generates first results;
retrieving the first results generated by the search coordinator;
processing the first results to determine second results; and
communicating the second results to a computing device associated with a user.