Splunk Inc.

Brian C Reyes

Tristan Antonio Fletcher

Brian John Bingham

Alok Anant Bhide

Fang I Hsiao

Alan Vincent Hardin

Leonid Alekseyev

Hemendra Singh Choudhary

Brent Stephen Boe

Adam Jamison Oliner

Jacob Barton Leverich

Manish Sainani

Sonal Maheshwari

Anupadmaja Raghavan

Adrian E Hall

Kenneth M Sternberg

Cary Glen Noel

Michael Porath

Marshall Chalmers Agnew

Ho Lun Ng

Provided are systems and methods for determining and displaying service performance information via a graphical user interface. A method can include visually rendering a service-level dashboard reflecting performance of a service and presenting a visual indication of health of each component service and a list of events each corresponding to a change in performance of one of the component services. The method can further include responsive to receiving, via a graphical user interface (GUI), a selection of a component service, visually rendering a system-level dashboard reflecting performance of the selected component-level service, wherein the component service is performed by one or more machines, and wherein the system-level dashboard presents the machines and one or more events each corresponding to a change in performance of one of the machines.

Service analyzer interface presenting performance information of machines providing component services

A service monitoring system executing on one or more processors may have operations that are determined by control information. Control over the operation of the service monitoring system can be exerted through the use of a graphical interface. The graphical interface may present the control information of a new or existing correlation search definition for user interaction. The service monitoring system may maintain a data store of key performance indicator (KPI) data, where a KPI value in the data store is produced by a KPI-defining search query that derives the value from machine data associated with one or more entities that perform a monitored service. A correlation search definition of the service monitoring system determines how a search of the KPI data is conducted, how its data is evaluated to determine whether a triggering condition has been met, and, if so, determines what triggered action is to be initiated.

Performance monitoring using correlation search with triggering conditions

An example method of determining a state of a key performance indicator (KPI) comprises: receiving one or more entity definitions, wherein each entity definition associates an entity with machine data pertaining to the entity; receiving a service definition for a service provided by one or more entities, the service definition including a reference to a corresponding entity definition of the entity definitions, wherein the service definition includes a respective reference for each of the one or more entities; receiving definitions of one or more KPIs, each KPI defined by a respective search query that produces a value derived from particular machine data, wherein the particular machine data is identified by the service definition, wherein each value is indicative of performance of the service at a point in time or during a period of time; deriving, by performing on the machine data a search query associated with the KPI, one or more KPI values for the KPI; selecting, among a plurality of states of the KPI, a state satisfying a condition applied to the one or more KPI values; and causing display of a visual indicator of the state of the KPI.

Determining states of key performance indicators derived from machine data

Provided are systems and methods for determining and displaying service performance information via a graphical user interface. In one embodiment, a system can provide, for each of one or more machines associated with a service: obtaining performance data for the machine; and comparing the performance data for the machine to one or more predefined performance thresholds for the machine to determine a health status for the machine; and determining a health status for the service based at least in part on the health status of at least one of the one or more machines associated with the service.

Service analyzer interface with composite machine scores

One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, definitional information includes information for identifying machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.

Threshold establishment for key performance indicators derived from machine data

Monitoring I.T. service-level performance using a machine data key performance indicator (KPI) correlation search

Techniques are disclosed for providing adaptive thresholding technology for Key Performance Indicators (KPIs) that are updated using training data. Adaptive thresholding technology may automatically assign new values or adjust existing values for one or more thresholds of one or more time policies. Assigning threshold values using adaptive thresholding may involve identifying training data (e.g., historical data, simulated data, or example data) for the time frames and analyzing the training data to identify variations within the data (e.g., patterns, distributions, trends). A threshold value may be determined based on the variations and may be assigned to one or more of the thresholds without additional user intervention.

Adaptive key performance indicator thresholds updated using training data

Raw machine data are captured and may be organized as events. Entity definitions representing machine entities that perform a service identify the machine data pertaining to respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. The derivation may be performed on a per-entity basis and on the aggregate. The derived values may then be translated into a state value domain using per-entity thresholds, aggregate thresholds, or a combination.

Machine data-derived key performance indicators with per-entity states

Techniques and mechanisms are disclosed for generating and causing display of graphical interfaces which enable an interactive and flexible search results visualization process. Based on results data identified in response to execution of a search query, an interface element is displayed which enables users to select a field contained in the results data, also referred to herein as a 'dimension' or 'facet,' and for which a &#x201c;faceted&#x201d; visualization of the results data can be dynamically generated and displayed. As used herein, a faceted visualization refers to a graphical interface including display of at least two separate data visualizations generated based on a selected facet data dimension, where each separate data visualization corresponds to a distinct value of the selected facet dimension.

Generating visualizations for search results data containing multiple data dimensions

A processing device performs a search query to produce a search result set having entries having data items. A table, having rows and columns, is displayed in a user interface. Each data item of a particular entry appears in a respective column of the same row of the table. Each column may correspond to the ordinal position of its respective data item. User input is received designating, for each respective column, a field name and an entity definition component type to which the respective column pertains, and stores for each data item of the particular entry an element value of an entity definition. The element has the element name designated for the respective column in which the data item appeared, and is associated with an entity definition component having the type designated for the respective column in which the data item appeared.

Creating an entity definition from a search result set

Techniques are disclosed for providing a graphical user interface (GUI) for displaying and configuring adaptive or static thresholds for Key Performance Indicators (KPIs). The GUI may include one or more presentation schedules that may display threshold information associated with time policies. Each presentation schedule may include multiple time slots and span a portion of one or more time cycles. Some of the time slots may be associated with a specific time policy and may have a unifying appearance that distinguishes the time slots from timeslots associated with other time policies. The presentation schedules may arrange the time slots in a time grid arrangement (e.g., calendar grid view) or a graph arrangement with depictions (e.g., points, lines) that may illustrate KPI values and threshold markers that may illustrate the threshold values.

Graphical user interface for static and adaptive thresholds

Service analyzer interface

One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, identifying information for locating machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.

Growing community of inventors

Seattle, WA, United States of America

Brian C Reyes