Asynchronous processing of messages from multiple search peers

Patent metadata

Field	Value
Publication number	US-9509765-B2
Application number	US-201414448995-A
Country	US
Kind code	B2
Filing date	Jul 31, 2014
Priority date	Jul 31, 2014
Publication date	Nov 29, 2016
Grant date	Nov 29, 2016

Abstract

Systems and methods for asynchronous processing of messages that are received from multiple servers. An example method may comprise: receiving, by a first processing thread, in a non-blocking mode, a plurality of sub-application layer protocol packets from a plurality of servers; processing one or more sub-application layer protocol packets received from a first server of the plurality of servers, to produce a first application layer message; writing the first application layer message to a message queue; processing one or more sub-application layer protocol packets received from a second server of the plurality of servers, to produce a second application layer message; writing the second application layer message to the message queue; and reading, by two or more processing threads of a processing thread pool, two or more application layer messages including the first application layer message and the second application layer message from the message queue, to produce two or more memory data structures based on the read application layer messages.

First claim

What is claimed is:

1. A method, comprising:
transmitting, by a computer system, a search request to a plurality of search peers of a data aggregation and analysis system;
receiving, by a first processing thread of the computer system, in a non-blocking mode, a plurality of sub-application layer protocol packets from the plurality of search peers;
parsing one or more sub-application layer protocol packets received from a first search peer of the plurality of search peers, to produce a first application layer message representing a first partial response to the search request;
writing the first application layer message to a message queue;
parsing one or more sub-application layer protocol packets received from a second search peer of the plurality of search peers, to produce a second application layer message representing a second partial response to the search request;
writing the second application layer message to the message queue; and
processing, by two or more processing threads of a processing thread pool, two or more application layer messages including the first application layer message and the second application layer message from the message queue, to produce two or more memory data structures representing an aggregated response to the search request.

2. The method of claim 1 , further comprising:
placing the memory data structures into a result queue.

3. The method of claim 1 , wherein receiving the sub-application layer protocol packets comprises asynchronously accepting incoming packets over a plurality of transport layer connections.

4. The method of claim 1 , wherein receiving the sub-application layer protocol comprises processing incoming packets in an order the incoming packets were received over a plurality of transport layer connections.

5. The method of claim 1 , wherein the sub-application layer protocol is provided by one of: a transport layer protocol, a session layer protocol, or a presentation layer protocol.

6. The method of claim 1 , wherein the sub-application layer protocol is provided by HTTP protocol.

7. The method of claim 1 , wherein receiving the plurality of sub-application layer protocol packets is performed responsive to transmitting a request to the plurality of search peers.

8. The method of claim 1 , further comprising:
responsive to writing the first application layer message to the message queue, determining that a total size of messages in the message queue exceeds a certain threshold; and
notifying the first processing thread to suspend receiving packets from the first search peer.

9. The method of claim 1 , further comprising:
responsive to writing the first application layer message to a message queue, determining that a total size of messages in the message queue exceeds a certain threshold;
notifying the first processing thread to suspend receiving packets from the first search peer; and
responsive to determining that a total size of messages in the message queue falls below a certain threshold, notifying the first processing thread to resume receiving packets from the first search peer.

10. The method of claim 1 , wherein each search peer of the plurality of search peers performs map operations of a map-reduce search, to return partial results based on a subset of source data.

11. The method of claim 1 , wherein the application layer message comprises one or more events derived from time-series source data.

12. The method of claim 1 , wherein each application layer message comprises a timestamp inserted by a search peer that originated the application layer message.

13. The method of claim 1 , wherein each application layer message comprises a timestamp inserted by the first processing thread.

14. The method of claim 1 , wherein the method is performed by a search head that performs map operations of a map-reduce search.

15. The method of claim 1 , wherein parsing the sub-application layer protocol packets received from the first search peer and the second search peer is performed by a single processing thread.

16. The method of claim 1 , wherein parsing the two or more application layer messages further comprises:
splitting an application layer message of the two or more application layer messages into two or more parts based on at least one of: a defined bit position or a separator.

17. The method of claim 1 , wherein parsing the two or more application layer messages further comprises:
encoding binary data comprised an application layer message of the two or more application layer messages according to a decoding rule.

18. The method of claim 1 , wherein parsing the two or more application layer messages further comprises:
transmitting the aggregated response to a client that originated the search request.

19. A computer system, comprising:
a memory; and
one or more processing devices, coupled to the memory, to:
transmit a search request to a plurality of search peers of a data aggregation and analysis system;
receive, by a first processing thread, in a non-blocking mode, a plurality of sub-application layer protocol packets from the plurality of search peers;
parse one or more sub-application layer protocol packets received from a first search peer of the plurality of search peers, to produce a first application layer message representing a first partial response to the search request;
write the first application layer message to a message queue;
parse one or more sub-application layer protocol packets received from a second search peer of the plurality of search peers, to produce a second application layer message representing a second partial response to the search request;
write the second application layer message to the message queue; and
read, by two or more processing threads of a processing thread pool, two or more application layer messages including the first application layer message and the second application layer message from the message queue, to produce two or more memory data structures representing an aggregated response to the search request.

20. The computer system of claim 19 , wherein to receive the sub-application layer protocol packets, the one or more processing devices are to asynchronously accept incoming packets over a plurality of transport layer connections.

21. The computer system of claim 19 , wherein receiving the sub-application layer protocol comprises processing incoming packets in an order the incoming packets were received over a plurality of transport layer connections.

22. The computer system of claim 19 , wherein the sub-application layer protocol is provided by one of: a transport layer protocol, a session layer protocol, or a presentation layer protocol.

23. The computer system of claim 19 , wherein the sub-application layer protocol is provided by HTTP protocol.

24. The computer system of claim 19 , wherein the one or more processing devices are further to:
place the memory data structures into a result queue.

25. A computer-readable non-transitory storage medium comprising executable instructions that, when executed by a computer system, cause the computer system to:
transmit a search request to a plurality of search peers of a data aggregation and analysis system;
receive, by a first processing thread, in a non-blocking mode, a plurality of sub-application layer protocol packets from a plurality of search peers;
parse one or more sub-application layer protocol packets received

Assignees

• Splunk Inc

Inventors

• Pal Sourav
• Pride Christopher Madden

Classifications

• G06F17/30864

  Physics · mapped topic

• H04L67/1004 Primary

  Server selection for load balancing · CPC title

• G06F15/167

  using a common memory, e.g. mailbox · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• H04L43/16

  Threshold monitoring · CPC title