System and method for investigating large amounts of data

Patent metadata

Field	Value
Publication number	US-9639578-B2
Application number	US-201514961830-A
Country	US
Kind code	B2
Filing date	Dec 7, 2015
Priority date	Jun 23, 2011
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

A data analysis system is proposed for providing fine-grained low latency access to high volume input data from possibly multiple heterogeneous input data sources. The input data is parsed, optionally transformed, indexed, and stored in a horizontally-scalable key-value data repository where it may be accessed using low latency searches. The input data may be compressed into blocks before being stored to minimize storage requirements. The results of searches present input data in its original form. The input data may include access logs, call data records (CDRs), e-mail messages, etc. The system allows a data analyst to efficiently identify information of interest in a very large dynamic data set up to multiple petabytes in size. Once information of interest has been identified, that subset of the large data set can be imported into a dedicated or specialized data analysis system for an additional in-depth investigation and contextual analysis.

First claim

What is claimed is:

1. A method comprising:
receiving a search parameter with a computer that is configured with an improved search mechanism;
deriving, with the computer and the improved search mechanism, a search criterion from the search parameter and using the search criterion to obtain one or more first values from a first-key value family of a key-value data repository stored in a data storage device that is coupled to the computer;
obtaining based on the one or more first values, with the computer and the improved search mechanism, one or more compressed values from a second key-value family of the key-value data repository;
wherein the key-value data repository comprises a cluster of a plurality of computing nodes:
wherein at least one key of the first key-value family is mastered by at least one node of the plurality nodes and at least one other key of the first key-value family is mastered by at least one other node of the plurality of nodes;
wherein each and every node of the cluster of nodes is configured to obtain values for any key of the first key-value family;
uncompressing, with the computer and the improved search mechanism, the one or more compressed values to produce one or more uncompressed values;
identifying, with the computer and the improved search mechanism, based on the one or more first values to identify one or more portions of the one or more uncompressed values;
returning, with the computer and the improved search mechanism, the one or more portions of the one or more uncompressed values as search results.

2. The method of claim 1 , wherein the first key-value family comprises a first set of unique keys, each key in the first set of unique keys mapping to one or more values; wherein the second key-value family comprises a second set of unique keys, each key in the second set of unique keys mapping to at least one compressed value.

3. The method of claim 1 , wherein at least one of the one or more first values comprises an identifier of a compressed value of the one or more compressed values.

4. The method of claim 1 , wherein at least one of the one or more first values comprises a key of the second key-value family.

5. The method of claim 1 , wherein at least one of the one or more first values comprises information identifying a byte sequential portion of one of the one or more uncompressed values.

6. The method of claim 1 , wherein at least one of one or more portions is a byte sequential portion of an uncompressed value of the one or more uncompressed values.

7. The method of claim 1 , wherein each key of the first key-value family is unique at least amongst all keys of the first key-value family.

8. The method of claim 1 , wherein using the search criterion to obtain the one or more first values includes selecting a key from the first key-value family that equals the search criterion.

9. A method comprising:
receiving, with a computer that is configured with an improved search mechanism, a search parameter and determining a first search criterion and one or more second search criteria based upon the search parameter;
obtaining, with the computer and the improved search mechanism, based on the first search criterion and the second search criteria, one or more first values from a first-key value family of a key-value data repository of a data storage device that is coupled to the computer;
obtaining, with the computer and the improved search mechanism, based on the one or more first values, one or more second values from a second key-value family of the key-value data repository;
obtaining, with the computer and the improved search mechanism, based on the one or more second values, one or more compressed values from a third key-value family of the key-value data repository;
wherein the key-value data repository comprises a cluster of a plurality of computing nodes:
wherein at least one key of the first key-value family is mastered by at least one node of the plurality nodes and at least one other key of the first key-value family is mastered by at least one other node of the plurality of nodes;
wherein each and every node of the cluster of nodes is configured to obtain values for any key of the first key-value family;
returning, with the computer and the improved search mechanism, one or more uncompressed portions of the one or more compressed values as search results.

10. The method of claim 9 , further comprising, using the computer and the improved search mechanism, uncompressing the one or more compressed values to produce one or more uncompressed values, and using the one or more second values to identify the one or more uncompressed portions from the one or more uncompressed values.

11. The method of claim 10 , wherein at least one of the one or more second values comprises information identifying a byte sequential portion of one of the one or more uncompressed values.

12. The method of claim 9 , wherein using the first search criterion and the second search criteria to obtain the one or more first values comprises selecting all values of a key of the first key-value family that equals the first search criterion where the selected values satisfy the second search criteria.

13. The method of claim 9 , wherein the first key-value family comprises a first set of unique keys and a set of values to which the first set of unique keys are mapped; wherein the second key-value family comprises a second set of unique keys and a set of values to which the second set of unique keys are mapped; wherein the third key-value family comprises a third set of unique keys and a set of values to which the third set of unique keys are mapped; wherein at least one value of each key in the first set of unique keys matches a key of the second set of unique keys; wherein at least one value of each key in the second set of unique keys matches a key of the third set of unique keys.

14. The method of claim 9 , wherein at least one of the one or more second values comprises an identifier of a compressed value of the one or more compressed values.

15. The method of claim 9 , wherein each key of the first key-value family is unique at least amongst all keys of the first key-value family.

16. The method of claim 10 , wherein at least one of the one or more portions is a byte sequential portion of an uncompressed value of the one or more uncompressed values.

17. A data processing system comprising:
a computer comprising one or more processors;
a key-value data repository in a data storage device that is coupled to the computer and comprising a first key-value family and a second key-value family;
an improved search mechanism in the computer and configured to:
receive a search parameter and determine a search criterion based upon the search parameter;
based on the search criterion, to obtain one or more first values from the first-key value family;
based on the one or more first values, to obtain one or more compressed values from the second key-value family;
wherein the key-value data repository comprises a cluster of a plurality of computing nodes;
wherein at least one key of the first key-value family is mastered by at least one node of the plurality nodes and at least one other key of the first key-value family is mastered by at least one other node of the plurality of nodes;
wherein each and every node of the cluster of nodes is configured to obtain values for any key of the first key-value family;
uncompress the one or more compressed values to produce one or more uncompressed values;
based on the one or more first values, to identify one or

Assignees

• Palantir Technologies Inc

Inventors

• Stowe Geoffrey
• Fischer Chris
• George Paul
• Bingham Eli
• Hill Rosco

Classifications

• G06F16/148

  File search processing · CPC title

• G06F16/9535

  Search customisation based on user profiles and personalisation · CPC title

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• G06F16/248

  Presentation of query results · CPC title

• G06F16/17

  Details of further file system functions · CPC title