Enabling role-based operations to be performed on machine data in a machine environment

• US 10,616,236 B2
• Filed: 04/30/2018
• Issued: 04/07/2020
• Est. Priority Date: 08/12/2011
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Das, Robin Kumar, Ago, Ledio, Shanaghy, Declan Gerard, Gupta, Gaurav
• Primary Examiner(s): To, Baoquoc N
• Application Number:
  US15/967,398
• Publication Number:
  US 20180248890A1
• Time in Patent Office: 708 Days
• Field of Search: 707783, 726 27
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/134 Distributed indices
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/901 Indexing; Data structures therefor; Storage structures for retrieval from the web G06F16/951
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9537 Spatial or temporal dependent retrieval, e.g. spatiotemporal queries
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/4887 involving deadlines, e.g. rate based, periodic
• CPC Class Codes: G06F 9/5088 involving task migration
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: H04L 12/1435 volume-based
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Embodiments are directed towards a system and method for a cloud-based front end that may abstract and enable access to the underlying cloud-hosted elements and objects that may be part of a multi-tenant application, such as a search application. Search objects may be employed to access indexed objects. An amount of indexed data accessible to a user may be based on an index storage limit selected by the user, such that data that exceeds the index storage limit may continue to be indexed. Also, one or more projects can be elastically scaled for a user to provide resources that may meet the specific needs of each project.

Claims

1. A computer-implemented method, comprising:

receiving a request from a user to interact with an indexed data store associated with a project, the indexed data store storing a set of events for the project, wherein the project controls access to the indexed data store using one or more roles, and wherein at least some events in the set of events comprise a portion of raw machine data associated with a timestamp;

determining, from the one or more roles, a role for the user with respect to the project, wherein the role provides a set of permissions to the user for interacting with the set of events stored in the indexed data store;

determining, based on the set of permissions provided by the role, a set of operations that the user has permission to perform on the set of events stored in the indexed data store; and

allowing the user to perform an operation included in the set of operations, wherein the operation is performed on one or more events of the set of events stored in the indexed data store.

2. The method of claim 1, wherein the role indicates that the user has permission to access a particular subset of the set of events included in the indexed data store.

3. The method of claim 1, wherein the role indicates that the user has permission to search the set of events included in the indexed data store.

4. The method of claim 1, wherein the role indicates that the user has permission to store data in the indexed data store.

5. The method of claim 1, wherein determining the role comprises:

identifying a core user associated with the user; and

determining that the core user is assigned the role,

wherein the user inherits the role from the core user.

6. The method of claim 1, wherein the user performs the operation via an application executing in a computing environment.

7. The method of claim 1, wherein the user performs the operation via an application executing in a computing environment, and wherein the set of permissions allows the user to interact with the application.

8. The method of claim 1, wherein each portion of raw machine data reflects activity in an information technology environment.

9. The method of claim 1, wherein each portion raw machine data is produced by a component in an information technology environment.

10. One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:

receiving a request from a user to interact with an indexed data store associated with a project, the indexed data store storing a set of events for the project, wherein the project controls access to the indexed data store using one or more roles, and wherein at least some events in the set of events comprise a portion of raw machine data associated with a timestamp;

determining, from the one or more roles, a role for the user with respect to the project, wherein the role provides a set of permissions to the user for interacting with the set of events stored in the indexed data store;

determining, based on the set of permissions provided by the role, a set of operations that the user has permission to perform on the set of events stored in the indexed data store; and

allowing the user to perform an operation included in the set of operations, wherein the operation is performed on one or more events of the set of events stored in the indexed data store.

11. The one or more non-transitory computer-readable storage media of claim 10, wherein the role indicates that the user has permission to access a particular subset of the set of events included in the indexed data store.

12. The one or more non-transitory computer-readable storage media of claim 10, wherein the role indicates that the user has permission to search the set of events included in the indexed data store.

13. The one or more non-transitory computer-readable storage media of claim 10, wherein the role indicates that the user has permission to store data in the indexed data store.

14. The one or more non-transitory computer-readable storage media of claim 10, wherein determining the role comprises:

identifying a core user associated with the user; and

determining that the core user is assigned the role, wherein the user inherits the role from the core user.

15. The one or more non-transitory computer-readable storage media of claim 10, wherein the user performs the operation via an application executing in a computing environment.

16. The one or more non-transitory computer-readable storage media of claim 10, wherein the user performs the operation via an application executing in a computing environment, and wherein the set of permissions allows the user to interact with the application.

17. The one or more non-transitory computer-readable storage media of claim 10, wherein each portion of raw machine data reflects activity in an information technology environment.

18. The one or more non-transitory computer-readable storage media of claim 10, wherein each portion raw machine data is produced by a component in an information technology environment.

19. A computer system, comprising:

a memory that includes instructions; and

a processor coupled to the memory and, when executing the instructions, is configured to perform the steps of;

receiving a request from a user to interact with an indexed data store associated with a project, wherein the indexed data store storing a set of events for the project, wherein the project controls access to the indexed data store using one or more roles, and wherein at least some events in the set of events comprise a portion of raw machine data associated with a timestamp;

determining, from the one or more roles, a role for the user with respect to the project, wherein the role provides a set of permissions to the user for interacting with the set of events stored in the indexed data store;

determining, based on the set of permissions provided by the role, a set of operations that the user has permission to perform on the set of events stored the indexed data store; and

allowing the user to perform an operation included in the set of operations, wherein the operation is performed on one or more events of the set of events stored in the indexed data store.

20. The computer system of claim 19, wherein the role indicates that the user has permission to access a particular subset of the set of events included in the indexed data store.

21. The computer system of claim 19, wherein the role indicates that the user has permission to search the set of events included in the indexed data store.

22. The computer system of claim 19, wherein the role indicates that the user has permission to store data in the indexed data store.

23. The computer system of claim 19, wherein determining the role comprises:

identifying a core user associated with the user; and

determining that the core user is assigned the role, wherein the user inherits the role from the core user.

24. The computer system of claim 19, wherein the user performs the operation via an application executing in a computing environment.

25. The computer system of claim 19, wherein the user performs the operation via an application executing in a computing environment, and wherein the set of permissions allows the user to interact with the application.

26. The computer system of claim 19, wherein each portion of raw machine data reflects activity in an information technology environment.

27. The computer system of claim 19, wherein each portion raw machine data is produced by a component in an information technology environment.