Servicenow, Inc.

Kanwaldeep Kaur Dang

Stephen Scott Tucker

Purushottam Shridhar Amradkar

Qingbin Li

James Crotinger

Ritika Goyal

Kiran Kumar Bushireddy

Anand Nikhil Mehta

Chinna Babu Polinati

Bnayahu Makovsky

Swapnesh Patel

Dustin Lennon

Purushottam Amradkhar

Eugen Ardeleanu

Sridhar Chandrashekar

Vincent Seguin

Kelly Vincent

Scott Tucker

Szu-hsuan Lee

Luc John Johnson

Christopher Robert Mutzel

Greeshma Kulamarva Balasubrahmanya

Austin James Steeno

Sachin Gupta

Systems and methods are provided for dynamic selection of anomaly detection options for particular metric data. Metric data corresponding to one or more configuration items of an information technology (IT) infrastructure is collected. A selected anomaly detection action option that applies to the metric data is identified. An action is performed using the metric data, based upon the selected anomaly detection action option. A dashboard graphical user interface (GUI) display results of the action.

Dynamic anomaly reporting

The present approach relates generally to systems and methods for outputting metric data from resources with a database accessible by a client instance. The client instance is hosted by one or more data centers and accessible by one or more remote client networks. In accordance with the present approach, a request to track metric data related to a resource is received. Further, a configuration item (CI) is retrieved from a database accessible by the client instance based at least in part on data associated with the request. Further, a type of CI is identified. Even further, a resource type associated with the type of the CI is identified based at least in part on a resource abstraction layer accessible by the client instance. Further still, the resource type is linked to the resource table and metric data associated with the resource is outputted.

Systems and methods for linking metric data to resources

A computing system and method for remote monitoring and forecasting of performance of a managed network is disclosed. The computing system may be disposed within a remote network management platform and be configured for monitoring respective performance of each of a plurality of network entities of the managed network. For each network entity, an alert may be issued in response to determining that the monitored respective performance is below a respective threshold performance level. Based on analysis of a group of alerts, a likelihood may be determined that a different alert will be issued for the monitored performance of a particular network entity of the plurality for which no respective alert has yet been issued. In response to the likelihood exceeding a threshold, an alert prediction for the performance of the particular network entity may be issued together with a score corresponding to the likelihood.

Operational analytics in managed networks

A system, includes: a distributed cache that stores state information for a plurality of configuration items (CIs). Management, instrumentation, and discovery (MID) servers form a cluster, each of the MID servers including one or more processors that receive, from the distributed cache, a subset of the state information associated with assigned CIs and perform a statistical analysis on the subset of the state information.

Systems and methods for robust anomaly detection

An enterprise platform may include a time series database that may include time series data related to a plurality of configuration items associated with an enterprise. The enterprise platform may also include one or more instance data tables having instance data associated with the plurality of configuration items. The enterprise platform may also include an alert interface that may receive an indication of an alert associated with a configuration item of the plurality of configuration items and determine a subset of a plurality of metrics associated with the alert based on the configuration item and the time series data, the instance data, or both. The alert interface may then generate a plurality of visualizations for display via a user interface based on the subset of the plurality of metrics.

Alert intelligence integration

Disclosed are methods, apparatuses and systems for collecting transactional and dimensional data. One implementation includes a configuration management database, a first data collection agent operating on a first monitored server to collect metadata associated with the first monitored server from the configuration management database using the first data collection agent, collect metric data from the first monitored server regarding operation of the first monitored server, wherein the metric data includes at least one metric collected from at least one application executing on the first monitored server; and assemble the collected metric data and at least part of the collected metadata into a packet for transmission from the first monitored server to a message bus; and a distributed database configured to receive the packet from the message bus and to store the collected metric data and metadata included in the packet.

Streamlined transaction and dimension data collection

A platform includes a time series database. The platform also includes one or more instance data tables. A function library of the platform includes a set of function definitions and a scripting engine of the platform executes scripts. An advanced insight endpoint of the platform is communicatively coupled to and accessible by an advanced insights explorer user interface. The advanced insight endpoint receives one or more expressions from an expression component of the advanced insights explorer user interface, parses the one or more expressions and validates the one or more expressions against the set of function definitions. The endpoint generates and provides one or more scripts corresponding to the one or more expressions and receives results of execution the one or more scripts. Results are provided to a visualization component of the advanced insight user interface, to cause rendering of the results within the advanced insights explorer user interface.

Advanced insights explorer

An apparatus for grouping alerts generated by automated monitoring of at least an operating condition of a machine, represented as a configuration item in a configuration management database, in a computer network. A first event pattern is identified based on configuration items associated with an alert avalanche identified from received historical alert data stored in memory. A second event pattern is identified based on co-occurrences of configuration item pairs in the historical alert data and on at least one conditional probability parameter. At least one alert group is determined by comparing at least one configuration item associated with a current alert to the plurality of configuration items of the first event pattern and of the second event pattern stored in memory. A graphical display region for displaying the alert group is generated.

Management of computing system alerts

Growing community of inventors

Sammamish, WA, United States of America

Kanwaldeep Kaur Dang