Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on a source type of the plurality of first chunks. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Abstract: Systems and methods are disclosed for processing and executing queries in a data intake and query system. An indexing system of the data intake and query system receives data and stores at least a portion of it in buckets, which are then stored in a shared storage system. The indexing system merges multiple buckets to generate merged buckets and uploads the merged buckets to the shared storage system.

Abstract: The present invention is related to a method for providing dynamic indexer discovery. The method comprises receiving, from an index manager, a status indication associated with a plurality of indexers, wherein each of the plurality of indexers indexes events of raw machine-generated data received from a plurality of data collectors. The method further comprises determining a weight associated with each of the plurality of indexers and selecting an indexer from the plurality of indexers. Subsequently, the method comprises allocating data to the indexer in accordance with a respective weight assigned to the indexer and transmitting the allocated data to the indexer.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on a source type of the plurality of first chunks. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on entry boundaries in at least some of the plurality of first chunks of data. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: The technology disclosed relates to delivering frequently updated data to computing devices that make decisions about selection of resources that might be delivered in response to a request from a user. In particular, it relates to utilizing media content delivery networks to deliver non-media data that is useful in the decision-making.

Abstract: Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on entry boundaries in at least some of the plurality of first chunks of data. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Abstract: Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on entry boundaries in at least some of the plurality of first chunks of data. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Abstract: Time-series columnar-based information is received and indexed in a compute infrastructure for cost-effective cloud-based object storage. The approach leverages a file format that enables highly-performant search and retrieval of the data stored in the cloud. In operation, an indexer receives the time-series information, indexes that information according to the file format, and forwards the indexed information for storage to the object store, where it is stored as a set of time-based partitions. A partition comprises a set of files, namely, a manifest file, a data file, and an index file. These files are structured as a compact instance of a set of raw unstructured data that comprises the given partition. Highly-performant information retrieval is enabled in response to a time-bounded query, because operations at a query peer (with respect to one or more partitions) are carried out in real-time during query processing and without requiring retrieval of the data file as a whole.

Abstract: The present invention is related to a method for providing dynamic indexer discovery. The method comprises receiving, from an index manager, a status indication associated with a plurality of indexers, wherein each of the plurality of indexers indexes events of raw machine-generated data received from a plurality of data collectors. The method further comprises determining a weight associated with each of the plurality of indexers and selecting an indexer from the plurality of indexers. Subsequently, the method comprises allocating data to the indexer in accordance with a respective weight assigned to the indexer and transmitting the allocated data to the indexer.

Abstract: The present disclosure is directed to providing dynamic indexer discovery. An index manager, which may also be known as a cluster master, is configured to track the statuses and capabilities of indexers and provide the statuses and capabilities obtained from the indexers to data collectors, such as forwarders. The data collectors may use the statuses and capabilities associated with the indexers to load balance transmission of data to the indexers. Dynamic indexer discovery may eliminate the need to manually reconfigure data collectors when the status of an indexer changes because the information may be obtained from the index manager without the need to reinitialize the data collectors.

Abstract: Resegmenting chunks of data for load balancing is disclosed. A plurality of first chunks of data is received. The plurality of first chunks of data includes one or more entries that include raw data produced by a component of an information technology environment and that reflects activity in the information technology environment. The plurality of first chunks of data is resegmented into a plurality of second chunks of data based on entry boundaries in at least some of the plurality of first chunks of data. A first subset of the plurality of second chunks of data is distributed to a first indexer of a set of indexers. An occurrence of a trigger event is determined, and in response to the trigger event, a second subset of the plurality of second chunks of data is distributed to a second indexer of the set of indexers.

Abstract: The present disclosure is directed to providing dynamic indexer discovery. An index manager, which may also be known as a cluster master, is configured to track the statuses and capabilities of indexers and provide the statuses and capabilities obtained from the indexers to data collectors, such as forwarders. The data collectors may use the statuses and capabilities associated with the indexers to load balance transmission of data to the indexers. Dynamic indexer discovery may eliminate the need to manually reconfigure data collectors when the status of an indexer changes because the information may be obtained from the index manager without the need to reinitialize the data collectors.