Abstract: The present disclosure provides solutions for determining the divergence (delta) between the current and previous reference data structures for mutable data in a search head. A method is provided that includes updating a pre-existing lookup table in a search head, generating a delta file that identifies the divergence between the updated and previous lookup table, and distributing the delta file to other components in the search environment. The compatibility of the delta file is checked with the local instance of the lookup table in each search component, and the lookup table is applied if compatibility is determined. However, if the delta file is determined to not be compatible with the current version of a local lookup table in an indexer, the entire lookup table sent to the requesting indexer instead.

Abstract: Systems and methods are disclosed for making space available in a local storage of a data intake and query system. A cache manager of the data intake and query system may determine an amount of storage space of a local data store that is available for use to perform a query. The cache manager may then use one or more eviction policies associated with content stored at the local data store to purge content items to evict from the local storage. The system may then retrieve content for performing the query from a remote storage and store the retrieved content at the local storage.

Abstract: Systems and methods are disclosed for making space available in a local storage of a data intake and query system. A cache manager of the data intake and query system may determine an amount of storage space of a local data store that is available for use to perform a query. The cache manager may then use one or more eviction policies associated with content stored at the local data store to purge content items to evict from the local storage. The system may then retrieve content for performing the query from a remote storage and store the retrieved content at the local storage.

Abstract: Systems and methods are disclosed for making space available in a local storage of a data intake and query system. A cache manager of the data intake and query system may determine an amount of storage space of a local data store that is available for use to perform a query. The cache manager may then use one or more eviction policies associated with content stored at the local data store to purge content items to evict from the local storage. The system may then retrieve content for performing the query from a remote storage and store the retrieved content at the local storage.

Abstract: Embodiments of the present disclosure provide solutions for determining an elected search head captain is unqualified for the position, identifying a more qualified search head, and transferring the captain position to the more qualified search head. A method is provided that includes referencing qualification parameters in an elected search head captain, determining whether the newly elected search head captain is qualified for the position based on the parameters, identifying a more qualified search head to be the search head captain if the newly elected search head captain is determined to be unqualified for the position, and transferring the position of captain to the more qualified search head. The qualification parameters may include, for example, a pre-determined static flag set by an administrator of the search environment, and configuration replication status that corresponds to the most recent configuration state of the search head as recorded by the previous search head captain.

Abstract: The present disclosure provides solutions for determining the divergence (delta) between the current and previous reference data structures for mutable data in a search head. A method is provided that includes updating a pre-existing lookup table in a search head, generating a delta file that identifies the divergence between the updated and previous lookup table, and distributing the delta file to other components in the search environment. The compatibility of the delta file is checked with the local instance of the lookup table in each search component, and the lookup table is applied if compatibility is determined. However, if the delta file is determined to not be compatible with the current version of a local lookup table in an indexer, the entire lookup table sent to the requesting indexer instead.

Abstract: The present disclosure provides solutions for determining the divergence (delta) between the current and previous reference data structures for mutable data in a search head. A method is provided that includes updating a pre-existing lookup table in a search head, generating a delta file that identifies the divergence between the updated and previous lookup table, and distributing the delta file to other components in the search environment. The compatibility of the delta file is checked with the local instance of the lookup table in each search component, and the lookup table is applied if compatibility is determined. However, if the delta file is determined to not be compatible with the current version of a local lookup table in an indexer, the entire lookup table sent to the requesting indexer instead.

Abstract: The present disclosure provides solutions for determining the divergence (delta) between the current and previous reference data structures for mutable data in a search head. A method is provided that includes updating a pre-existing lookup table in a search head, generating a delta file that identifies the divergence between the updated and previous lookup table, and distributing the delta file to other components in the search environment. The compatibility of the delta file is checked with the local instance of the lookup table in each search component, and the lookup table is applied if compatibility is determined. However, if the delta file is determined to not be compatible with the current version of a local lookup table in an indexer, the entire lookup table sent to the requesting indexer instead.

Abstract: Embodiments of the present disclosure provide solutions for determining an elected search head captain is unqualified for the position, identifying a more qualified search head, and transferring the captain position to the more qualified search head. A method is provided that includes referencing qualification parameters in an elected search head captain, determining whether the newly elected search head captain is qualified for the position based on the parameters, identifying a more qualified search head to be the search head captain if the newly elected search head captain is determined to be unqualified for the position, and transferring the position of captain to the more qualified search head. The qualification parameters may include, for example, a pre-determined static flag set by an administrator of the search environment, and configuration replication status that corresponds to the most recent configuration state of the search head as recorded by the previous search head captain.

Abstract: Disclosed are methods, systems, and computer program products for processing a file which include using a computer system that is programmed for performing a process of receiving the file in response to a request for storing the file, determining whether a database already contains the file, and storing the file in the database if the database does not already contain the file. The process may alternatively include receiving the file in response to a request for storing the file, determining whether a database already contains the file, and storing the file without storing the received file if the database already contains the file. The process may also alternatively include receiving the file in response to a request for storing the file in a database, separating the file into a plurality of portions, and storing the plurality of portions so each of the plurality of portions can be individually accessed.

Abstract: A method of processing data from a file includes obtaining a first portion of the file, creating a first compression unit by compressing at least the first portion of the file, obtaining a second portion of the file, creating a second compression unit by compressing at least the second portion of the file, and storing the first and second compression unit such that each of the first and the second compression units can be individually accessed. A method of processing data from a file includes receiving a request to access a portion of the file, determining one or more sub-units that include compressed data associated with the portion of the file, de-compressing the compressed data in the one or more sub-units to obtain de-compressed data, and transmitting the de-compressed data in response to the request.

Abstract: A method of processing data from a file includes obtaining a first portion of the file, encrypting the first portion of the file to create a first encrypted portion, obtaining a second portion of the file, encrypting the second portion of the file to create a second encrypted portion, and storing the first and second encrypted portions such that each of the first and the second encrypted portions can be individually accessed. A method of processing data from a file includes receiving a request to access a first portion of the file, wherein data in the first portion of the file is encrypted, and data in a second portion of the file is encrypted, and decrypting the data in the first portion, and not the data in the second portion.

Abstract: A method of processing data from a file includes obtaining a first portion of the file, creating a first compression unit by compressing at least the first portion of the file, obtaining a second portion of the file, creating a second compression unit by compressing at least the second portion of the file, and storing the first and second compression unit such that each of the first and the second compression units can be individually accessed. A method of processing data from a file includes receiving a request to access a portion of the file, determining one or more sub-units that include compressed data associated with the portion of the file, de-compressing the compressed data in the one or more sub-units to obtain de-compressed data, and transmitting the de-compressed data in response to the request.

Abstract: A method of processing data from a file includes obtaining a first portion of the file, encrypting the first portion of the file to create a first encrypted portion, obtaining a second portion of the file, encrypting the second portion of the file to create a second encrypted portion, and storing the first and second encrypted portions such that each of the first and the second encrypted portions can be individually accessed. A method of processing data from a file includes receiving a request to access a first portion of the file, wherein data in the first portion of the file is encrypted, and data in a second portion of the file is encrypted, and decrypting the data in the first portion, and not the data in the second portion.

Abstract: A method of processing a file includes receiving a request to store the file, receiving the file, determining whether a database already contains the file, and storing the file in the database if the database does not already contain the file. A method of processing a file includes receiving a request to store the file, receiving the file, determining whether a database already contains the file, and satisfying the request to store the file without storing the received file if the database already contains the file. A method of processing data from a file includes receiving a request to store the file in a database, receiving the file, separating the file into a plurality of portions, and storing the plurality of portions such that each of the plurality of portions can be individually accessed.