Searching indexed data based on user roles

• US 9,516,029 B2
• Filed: 06/09/2015
• Issued: 12/06/2016
• Est. Priority Date: 08/12/2011
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Das, Robin Kumar, Ago, Ledio, Shanaghy, Declan Gerard, Gupta, Gaurav
• Primary Examiner(s): To, Baoquoc N
• Application Number:
  US14/735,120
• Publication Number:
  US 20150281243A1
• Time in Patent Office: 546 Days
• Field of Search: 707/741
• US Class Current: 1/1
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/134 Distributed indices
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/901 Indexing; Data structures therefor; Storage structures for retrieval from the web G06F16/951
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9537 Spatial or temporal dependent retrieval, e.g. spatiotemporal queries
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 9/4887 involving deadlines, e.g. rate based, periodic
• CPC Class Codes: G06F 9/5088 involving task migration
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: H04L 12/1435 volume-based
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Embodiments are directed towards a system and method for a cloud-based front end that may abstract and enable access to the underlying cloud-hosted elements and objects that may be part of a multi-tenant application, such as a search application. Search objects may be employed to access indexed objects. An amount of indexed data accessible to a user may be based on an index storage limit selected by the user, such that data that exceeds the index storage limit may continue to be indexed. Also, one or more projects can be elastically scaled for a user to provide resources that may meet the specific needs of each project.

Claims

1. A method, comprising:

determining at least one role for each project of a plurality of projects, wherein a role describes permissions for a user for interacting with resources associated with a project;

receiving a request from a first user to search indexed data in a data store for a particular project;

determining a role of the first user for the particular project;

determining whether the first user has permission to search indexed data in the data store based on the role determined for the first user, wherein the role of the first user for the particular project grants the first user permission to search indexed data in the data store for the particular project;

allowing the first user to search indexed data in the data store for the particular project to produce a result indicative of the performance or security of an information technology system in which the machine data was generated when the role indicates that the first user has permission to search indexed data in the data store for the particular project;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the role of the first user for the particular project grants the first user permission to provide data to be indexed in an index store.

3. The method of claim 1, wherein the role of the first user for the particular project grants the first user permission to provide data to be indexed in an index store and grants the first user permission to search indexed data in the index store.

4. The method of claim 1, wherein the role of the first user for the particular project grants the first user permission to access cloud-based resources.

5. The method of claim 1, wherein the search is performed by a cloud-based search application.

6. The method of claim 1, wherein the particular project comprises:

receiving raw data.

7. The method of claim 1, wherein the particular project comprises:

storing indexed data.

8. The method of claim 1, wherein the particular project comprises:

dividing raw data into time stamped searchable events, storing the time-stamped searchable events, and searching the time-stamped searchable events.

9. The method of claim 1, further comprising:

receiving input corresponding to an invitation to provide access to the particular project to a second user;

wherein the second user inherits the role for the particular project from the first user.

10. The method of claim 1, wherein the plurality of projects reside in a cloud-based, multi-tenant environment sharing a common application program.

11. An apparatus, comprising:

a subsystem, implemented at least partially in hardware, that determines at least one role for each project of a plurality of projects, wherein a role describes permissions for a user for interacting with resources associated with a project;

a subsystem, implemented at least partially in hardware, that receives a request from a first user to search indexed data in a data store for a particular project;

a subsystem, implemented at least partially in hardware, that determines a role of the first user for the particular project;

a subsystem, implemented at least partially in hardware, that determines whether the first user has permission to search indexed data in the data store based on the role determined for the first user, wherein the role of the first user for the particular project grants the first user permission to search indexed data in the data store for the particular project;

a subsystem, implemented at least partially in hardware, that allows the first user to search indexed data in the data store for the particular project to produce a result indicative of the performance or security of an information technology system in which the machine data was generated when the role indicates that the first user has permission to search indexed data in the data store for the particular project.

12. The apparatus of claim 11, wherein the role of the first user for the particular project grants the first user permission to provide data to be indexed in an index store.

13. The apparatus of claim 11, wherein the role of the first user for the particular project grants the first user permission to provide data to be indexed in an index store and grants the first user permission to search indexed data in the index store.

14. The apparatus of claim 11, wherein the role of the first user for the particular project grants the first user permission to access cloud-based resources.

15. The apparatus of claim 11, wherein the search is performed by a cloud-based search application.

16. The apparatus of claim 11, wherein the particular project comprises:

receiving raw data.

17. The apparatus of claim 11, wherein the particular project comprises:

storing indexed data.

18. The apparatus of claim 11, wherein the particular project comprises:

dividing raw data into time stamped searchable events, storing the time-stamped searchable events, and searching the time-stamped searchable events.

19. The apparatus of claim 11, further comprising:

a subsystem, implemented at least partially in hardware, that receives input corresponding to an invitation to provide access to the particular project to a second user;

wherein the second user inherits the role for the particular project from the first user.

20. The apparatus of claim 11, wherein the plurality of projects reside in a cloud-based, multi-tenant environment sharing a common application program.

21. A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

determining at least one role for each project of a plurality of projects, wherein a role describes permissions for a user for interacting with resources associated with a project;

receiving a request from a first user to search indexed data in a data store for a particular project;

determining a role of the first user for the particular project;

determining whether the first user has permission to search indexed data in the data store based on the role determined for the first user, wherein the role of the first user for the particular project grants the first user permission to search indexed data in the data store for the particular project;

allowing the first user to search indexed data in the data store for the particular project to produce a result indicative of the performance or security of an information technology system in which the machine data was generated when the role indicates that the first user has permission to search indexed data in the data store for the particular project.

22. The non-transitory computer-readable medium of claim 21, wherein the role of the first user for the particular project grants the first user permission to provide data to be indexed in an index store.

23. The non-transitory computer-readable medium of claim 21, wherein the role of the first user for the particular project grants the first user permission to provide data to be indexed in an index store and grants the first user permission to search indexed data in the index store.

24. The non-transitory computer-readable medium of claim 21, wherein the role of the first user for the particular project grants the first user permission to access cloud-based resources.

25. The non-transitory computer-readable medium of claim 21, wherein the search is performed by a cloud-based search application.

26. The non-transitory computer-readable medium of claim 21, wherein the particular project comprises:

receiving raw data.

27. The non-transitory computer-readable medium of claim 21, wherein the particular project comprises:

storing indexed data.

28. The non-transitory computer-readable medium of claim 21, wherein the particular project comprises:

dividing raw data into time stamped searchable events, storing the time-stamped searchable events, and searching the time-stamped searchable events.

29. The non-transitory computer-readable medium of claim 21, further comprising:

receiving input corresponding to an invitation to provide access to the particular project to a second user;

wherein the second user inherits the role for the particular project from the first user.

30. The non-transitory computer-readable medium of claim 21, wherein the plurality of projects reside in a cloud-based, multi-tenant environment sharing a common application program.