US 11,809,405 B2
Generating and distributing delta files associated with mutable events in a distributed system
Amritpal Singh Bath, San Francisco, CA (US); Yuan Xu, San Francisco, CA (US); Bharath Aleti, San Francisco, CA (US); and Manu Jose, San Francisco, CA (US)
Assigned to SPLUNK INC., San Francisco, CA (US)
Filed by Splunk Inc., San Francisco, CA (US)
Filed on Oct. 30, 2020, as Appl. No. 17/084,965.
Application 17/084,965 is a continuation of application No. 15/582,458, filed on Apr. 28, 2017, granted, now 10,891,284.
Prior Publication US 2021/0049150 A1, Feb. 18, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 16/00 (2019.01); G06F 16/23 (2019.01); G06F 16/27 (2019.01); G06F 16/951 (2019.01); G06F 16/22 (2019.01); G06F 16/2458 (2019.01)
CPC G06F 16/2365 (2019.01) [G06F 16/2255 (2019.01); G06F 16/2465 (2019.01); G06F 16/27 (2019.01); G06F 16/951 (2019.01)] 22 Claims
OG exemplary drawing
 
1. A method for replicating updated data in a search environment, the method comprising:
updating, by one or more processing devices corresponding to a search head of the search environment, a local instance of a key-value data structure with input data received from one or more data sources by modifying one or more keys or one or more values associated with the key-value data structure, wherein the key-value data structure comprises key-value pairs extracted from event data indexed from the input data, wherein the search head is one of a plurality of search heads in the search environment, wherein the plurality of search heads are coordinated by a search head captain of the search environment, and wherein each search head of the plurality of search heads is associated with one or more indexers;
generating a delta file that comprises data inconsistencies between the updated local instance of the key-value data structure and a previous local instance of the key-value data structure, wherein the data inconsistencies represent modifications made to the key-value pairs during the updating; and
distributing the delta file to the one or more indexers of the search environment, wherein the distributing the delta file comprises receiving a communication from a particular indexer of the one or more indexers, the communication corresponding to a status of an application of the delta file to an instance of the key-value data structure local to the particular indexer.