Splunk Inc.

Splunkinc.

Alok Anant Bhide

Tristan Antonio Fletcher

Brian John Bingham

Brian C Reyes

Alan Vincent Hardin

Leonid Alekseyev

Cary Glen Noel

Fang I Hsiao

Sonal Maheshwari

Hemendra Singh Choudhary

Ross Andrew Lazerowitz

Poorva Malviya

Adam Jamison Oliner

Jacob Barton Leverich

Manish Sainani

Brent Stephen Boe

Vineetha Bettaiah

Adrian E Hall

George Daloukov

Nicholas Matthew Tankersley

Arun Ramani

Anupadmaja Raghavan

Asmita Puri

Kan Wu

Rochit Gupta

Clint Sharp

Rehan Mulla

A service monitoring system receives receiving, via a user interface, an identification of a service of an information technology environment, and causes display of a plurality of key performance indicators (KPIs) in the user interface. Each KPI of the plurality of KPIs indicates a measure of performance for the service. The service monitoring system receives, via the user interface, an identification of a time period, and an identification of one or more visual characteristics for KPI graph lanes. Each of the KPI graph lanes is indicative of one or more KPI values of a respective KPI of the plurality of KPIs, the one or more KPI values are obtained from execution of a search query associated with the respective KPI, and the search query uses the time period to obtain the one or more KPI values. The service monitoring system causes display of a plurality of KPI graph lanes based on the one or more visual characteristics. Each graph lane provides a graphical visualization of the one or more KPI values of the respective KPI, and the display of the plurality of KPI graph lanes allows for visual correlation among the plurality of KPIs over the time period.

Defining a graphical visualization along a time-based graph lane using key performance indicators derived from machine data

Network connected devices are controlled via the transmission of action messages to prevent or correct conditions that impair the operation of the networked information technology (IT) assets. The service monitoring system (SMS) monitoring the IT environment groups together related notable events that are received during system operation. Automatic processes dynamically determine grouping operations that automatically correlate the events without requiring, for example, a set of declarative grouping rules. Event grouping may be performed on a by-service basis to facilitate the complex processing of predicting undesirable system conditions that may be prevented or reduced by transmission of the action messages to the appropriate assets. Event grouping operations may be directed with control information maintained via user interface.

Managing event group definitions in service monitoring systems

An automatic service monitor in an information technology environment has its operation controlled by information that, in part, defines entities that perform services and defines key performance indicators (KPIs) that indicate measures of performance of the services. Additional information controls the operation of the service monitor with respect to identifying and adapting for KPIs based on the non-normal data caused by maintenance work or other causes. Such adaptation may include changes in how reported information appears to the user.

Providing a user interface reflecting service monitoring adaptation for maintenance downtime

One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

Lower-tier application deployment for higher-tier system

The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Correlating data based on user-specified search criteria

An example method of determining a state of a key performance indicator (KPI) comprises: receiving one or more entity definitions, wherein each entity definition associates an entity with machine data pertaining to the entity; receiving a service definition for a service provided by one or more entities, the service definition including a reference to a corresponding entity definition of the entity definitions, wherein the service definition includes a respective reference for each of the one or more entities; receiving definitions of one or more KPIs, each KPI defined by a respective search query that produces a value derived from particular machine data, wherein the particular machine data is identified by the service definition, wherein each value is indicative of performance of the service at a point in time or during a period of time; deriving, by performing on the machine data a search query associated with the KPI, one or more KPI values for the KPI; selecting, among a plurality of states of the KPI, a state satisfying a condition applied to the one or more KPI values; and causing display of a visual indicator of the state of the KPI.

Determining states of key performance indicators derived from machine data

In some embodiments, in response to the user selecting a first node in the tree to be pinned, the system displays a first detail panel for the first node, wherein the first detail panel displays state information for the first node, wherein the state information is frozen at the time of pinning. Moreover, in response to the user selecting a second node in the tree to be pinned, the system displays a second detail panel for the second node, wherein the second detail panel displays state information for the second node, wherein the state information is frozen at the time of pinning. Note that the first detail panel is displayed concurrently with the second detail panel to facilitate comparing state information between the first and second nodes.

Monitoring tree with performance states

An automatic service monitor in an information-technology environment performs regular search queries against generated machine data to derive performance measurements. The information technology environment is defined in terms of services provided by entities, and the performance measurements are defined as key performance indicators (KPIs) of the services. Generated machine data used by the search queries pertain to the entities performing the service. Definitional information for the services, entities, and KPIs is administered by a user to control the operation of the service monitor. Various aspects of such definitional information as well as related performance measurement information may be presented in a unified console display tailored to, and organized around, a particular service. The console display may serve as a central launch point by supporting user interaction to navigate to other specialized monitoring interfaces.

Service detail monitoring console

One or more processing devices derive values indicative of various aspects of how a particular service in an information technology (IT) environment is performing at a point in time or for a period of time. The values are derived by a search query over machine data associated with the one or more entities that provide the service. The one or more processing devices define and apply time varying static thresholds in respect to the values. A user (e.g., IT manager) may be enabled to manipulate or define multiple sets of KPI thresholds that vary over time.

Threshold-based determination of key performance indicator values

The disclosed embodiments include a method for identifying a performance metric to diagnose a cause of a performance issues of virtual machine. The method includes obtaining data of a virtual machine, an indication that a storage volume contains data of the virtual machine, data about the storage volume, and an identification of the storage volume. The data of the virtual machine is correlated with the data about the storage volume based on the indication that the storage volume contains data of the virtual machine and the identification of the storage volume. A performance metric is identified based at least in part on an outcome of the correlating. The performance metric indicates that the storage volume is a cause of a performance issue of the virtual machine. A state related to the storage volume is changed to mitigate the cause of the performance issue of the virtual machine.

User interface for correlation of virtual machine information and storage information

A method is disclosed that includes receiving a request to display a service-monitoring user interface that illustrates performance of one or more services that are each provided by one or more entities. Each service is associated with a stored service definition that identifies the one or more entities, and each entity is associated with stored entity definition information that identifies machine data produced by or about the entity from one or more sources. The method further includes causing display of the service-monitoring user interface illustrating performance of each service via an aggregate key performance indicator (KPI) that characterizes a respective service as a whole, and a plurality of aspect KPIs that each characterize an aspect of an associated service. Each KPI is defined by a search query that produces a value derived from the machine data identified by the entity definition information, the value indicative of a measure of the service at a point in time or during a period of time. The machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

Service monitoring interface with an aggregate key performance indicator of a service and aspect key performance indicators of aspects of the service

A service monitoring system (SMS) produces key performance indicator (KPI) scores that indicate the performance of a service. To produce the KPI scores, the SMS may process the data for a large number of machine entities that perform the service. This data can be processed on a per-entity basis to produce a per-entity KPI score representing the contribution of a particular machine to the overall KPI. The per-entity KPI scores can be transformed to statistical representations which can be visualized as a distribution stream graph. The visualization may be presented with interactive aspects.

Per-entity breakdown of key performance indicators

Service monitoring adaptation for maintenance downtime

During operation, the system obtains hypervisor data for a set of virtual machines, wherein the hypervisor data was received from one or more hypervisors while the set of virtual machines was running on the hypervisors. The system also obtains operating system data for the set of virtual machines, wherein the operating system data was received from a set of operating systems while the set of operating systems was running on the set of virtual machines. Next, the system correlates hypervisor data for a virtual machine with corresponding operating system data for the virtual machine. Finally, the system presents the correlated hypervisor data and operating system data for the virtual machine to a user.

Presenting hypervisor data for a virtual machine with associated operating system data

One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, definitional information includes information for identifying machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.

Growing community of inventors

Mountain View, CA, United States of America

Alok Anant Bhide