Retrieving, modifying, and depositing shared search configuration into a shared data store
AssigneeSplunk Inc.
InventorsLedio Ago, Declan Gerard Shanaghy
Life of this patent
Estimating the term…
Abstract
Various embodiments describe multi-site cluster-based data intake and query systems, including cloud-based data intake and query systems. Using a hybrid search system that includes cloud-based data intake and query systems working in concert with so-called “on-premises” data intake and query systems can promote the scalability of search functionality. In addition, the hybrid search system can enable data isolation in a manner in which sensitive data is maintained “on premises” and information or data that is not sensitive can be moved to the cloud-based system. Further, the cloud-based system can enable efficient leveraging of data that may already exist in the cloud.
Claims17
A computer-implemented method comprising:
- depositing, by a first cluster of a plurality of clusters of a multi-site clustered data intake and query system dispersed across multiple data centers or buildings, a shared search configuration that is shared by the plurality of clusters and that represents a saved search that defines how the plurality of clusters retrieve or report search results based on ingested data in the plurality of clusters, into a shared data store that is shared by and located outside of the plurality of clusters;
- retrieving, by a second cluster of the plurality of clusters, through a first firewall associated with the second cluster, the shared search configuration from the shared data store;
- generating, by the second cluster, a modified shared search configuration that modifies the shared search configuration;
- and
- depositing, by the second cluster, the modified shared search configuration into the shared data store through the first firewall.
One or more non-transitory computer-readable media storing instructions thereon, the instructions, when executed by one or more processors, cause the one or more processors to perform operations comprising:
- depositing, by a first cluster of a plurality of clusters of a multi-site clustered data intake and query system dispersed across multiple data centers or buildings, a shared search configuration that is shared by the plurality of clusters and that represents a saved search that defines how the plurality of clusters retrieve or report search results based on ingested data in the plurality of clusters, into a shared data store that is shared by and located outside of the plurality of clusters;
- retrieving, by a second cluster of the plurality of clusters, through a first firewall associated with the second cluster, the shared search configuration from the shared data store;
- generating, by the second cluster, a modified shared search configuration that modifies the shared search configuration;
- and
- depositing, by the second cluster, the modified shared search configuration into the shared data store through the first firewall.
A computer-implemented system comprising:
- one or more processors and memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- depositing, by a first cluster of a plurality of clusters of a multi-site clustered data intake and query system dispersed across multiple data centers or buildings, a shared search configuration that is shared by the plurality of clusters and that represents a saved search that defines how the plurality of clusters retrieve or report search results based on ingested data in the plurality of clusters, into a shared data store that is shared by and located outside of the plurality of clusters;
- retrieving, by a second cluster of the plurality of clusters, through a first firewall associated with the second cluster, the shared search configuration from the shared data store;
- generating, by the second cluster, a modified shared search configuration that modifies the shared search configuration;
- and
- depositing, by the second cluster, the modified shared search configuration into the shared data store through the first firewall.
Dependencies are inferred from the claim text.