Splunk Inc.

Splunkinc.

Brent Stephen Boe

Tristan Antonio Fletcher

Brian John Bingham

Fang I Hsiao

John Robert Coates

Brian C Reyes

Alan Vincent Hardin

Alok Anant Bhide

Sonal Maheshwari

Leonid Alekseyev

Clint Sharp

Rehan Mulla

Rochit Gupta

One or more processing devices cause display of a user interface that identifies a service definition representing a service, receive input identifying an entity, where the service is performed at least in part by the entity, and store the service definition representing the service in association with an entity definition representing the entity. The entity definition comprises information identifying data pertaining to the entity in a datastore of machine data that reflects activity in an information technology environment produced by a plurality of components of the information technology environment. The one or more processing devices receive input pertaining to a search definition representing a search producing a measure of the service, and store the search definition representing the search, where the search produces the measure of the service using at least a portion of the data pertaining to the entity.

Monitoring service-level performance using defined searches of machine data

An automatic service monitor in an information technology environment has its operation controlled by information that, in part, define entities that perform services and define key performance indicators (KPIs) that indicate measures of performance of the services. KPIs are defined in terms of search queries applied against machine data by or about the entities that perform the services. The search query aspects of multiple KPI definitions may be tied to a shared base search. Implementation of the shared base search may permit improved performance of the service monitor and may permit a reduction in administrative burden.

System monitoring with key performance indicators from shared base search of machine data

One or more processing devices create one or more entity definitions that each associate an entity with machine data pertaining to that entity and create a service definition for a service provided by one or more entities. The service definition includes an entity definition for each of the one or more entities. The one or more processing devices create one or more search queries that each produce a value derived from the machine data identified in one or more of the entity definitions included in the service definition. Each value is indicative of how the service is performing at a point in time or during a period of time and may be a key performance indicator for the service.

A computer system exposes an interface for the specification of filter criteria. The filter criteria may identify control information of a service monitoring system (SMS) that defines entities in an IT environment monitored by the SMS. An association of identified entities with a monitored service may be made to direct the ongoing operation of the SMS toward the service.

Automatic associations in an I.T. monitoring system

A processing device performs a search query to produce a search result set having entries having data items. A table, having rows and columns, is displayed in a user interface. Each data item of a particular entry appears in a respective column of the same row of the table. Each column may correspond to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each data item of the particular entry an element value of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Creating an entity definition from a search result set

One or more processing devices create one or more entity definitions that each associate an entity with machine data pertaining to that entity and create a service definition for a service provided by one or more entities. The service definition includes an entity definition for each of the one or more entities. The one or more processing devices create one or more key performance indicators (KPIs). Each KPI is defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions included in the service definition. Each value is indicative of how the service is performing at a point in time or during a period of time.

Monitoring service-level performance using key performance indicators derived from machine data

Processing devices receive a file having entries having data items separated by delimiters. Each data item has an ordinal position. The processing device(s) cause display of a table, having rows and columns, in a graphical user interface. Each data items of a particular entry appears in a respective column of the same row. Each column corresponds to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each of the data items of the particular entry a value of an element of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Creating an entity definition from a file

A computer system determines if events in a machine data store satisfy event selection criteria. The events may pertain to a service entity represented by a stored entity definition. The entity definition may include information to identify the events from the machine data. Other informational fields in the entity definition may be effectively attributed to the identified events and take part in satisfying the event selection criteria.

Identifying events using informational fields

A processing device performs a search query to produce a search result set having entries having data items. Each data item has an ordinal position. A table, having rows and columns, is displayed in a graphical user interface. Each data item of a particular entry appears in a respective column of the same row of the table. Each column corresponds to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each data item of the particular entry an element value of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Creating entity definition from a search result set

A computer system determines if events in a machine data store satisfy event selection criteria, the event selection criteria including a first field-value pair. To determine if one of the events satisfies the event selection criteria, the computer system compares the first field-value pair of the event selection criteria with a second field-value pair from an entity definition associated with the event by using a third field-value pair from data corresponding to the event in the machine data store.

Growing community of inventors

San Francisco, CA, United States of America

Brent Stephen Boe