Site-based search affinity

摘要

According to various embodiments, techniques are described for managing data within a multi-site clustered data intake and query system. A data intake and query system as described herein generally refers to a system for collecting, retrieving, and analyzing data. In this context, a clustered data intake and query system generally refers to a system environment that is configured to provide data redundancy and other features that improve the availability of data stored by the system. For example, a clustered data intake and query system may be configured to store multiple copies of data stored by the system across multiple components such that recovery from a failure of one or more of the components is possible by using copies of the data stored elsewhere in the cluster.

主权项

1. A method comprising:
receiving, at an indexer, a set of search affinity identifiers; wherein each search affinity identifier of the set of search affinity identifiers indicates, for a particular subset of data accessible to the indexer and for a particular site of a plurality of sites from which a query may originate, whether the indexer has primary responsibility for responding to queries originating from the particular site based on data from the particular subset of data; wherein each site of the plurality of sites represents a user-specified grouping of one or more computing resources corresponding to a particular geographic location; receiving, from a first search head located at a first site, (i) a first query to search a subset of data accessible to the indexer, and (ii) a first site identifier identifying the first site at which the first search head is located; determining, based on both the first site identifier and a particular search affinity identifier of the set of search affinity identifiers, that the indexer is to respond to the first query with a result from searching the subset of data; in response to determining that the indexer is to respond to the first query, sending, to the first search head, the result from searching the subset of data.