Splunk Inc.

Splunkinc.

Tristan Antonio Fletcher

Brian John Bingham

Alok Anant Bhide

Hemendra Singh Choudhary

Cary Glen Noel

Brian C Reyes

Ross Andrew Lazerowitz

Fang I Hsiao

Clint Sharp

Brent Stephen Boe

Michael Margulis

Anupadmaja Raghavan

Vineetha Bettaiah

John Robert Coates

Eric Nathaniel Tschetter

Arun Ramani

Alan Vincent Hardin

William Marcum

Amy Katherine Hunnel Bianchi

Omprakaash Thoppai

Subramaniam Baskaran

Alexandros Nikolaos Kompotis

Marc Andre Chene

Caleb Eugene Hanson

Daniel M Jones

Sean David McBride

Daniel Blake Partain

Dipti Prabhakar Siddamsettiwar

Leonid Alekseyev

Nicholas Matthew Tankersley

Chakravarthy Sridhar

Kan Wu

George Daloukov

Sakib Mehasanewala

Joel Schoenberg

Syam Bollu

Ramkumar Chandrasekharan

Tanner Gilligan

Asmita Puri

Ian Edward Torbett

Ayyappa Muthusami

Ramprasad Siva Golla

Xiang Zhou

Rehan Mulla

Shailendra Suryawanshi

Lila Fridley

Rochit Gupta

Alpesh Sheth

Techniques promote monitoring of hypervisor systems by presenting dynamic representations of hypervisor architectures that include performance indicators. A reviewer can interact with the representation to progressively view select lower-level performance indicators. Higher level performance indicators can be determined based on lower level state assessments. A reviewer can also view historical performance metrics and indicators, which can aid in understanding which configuration changes or system usages may have led to sub-optimal performance.

Interface for presenting performance data for hierarchical networked components represented in an expandable visualization of nodes

A service monitoring system receives receiving, via a user interface, an identification of a service of an information technology environment, and causes display of a plurality of key performance indicators (KPIs) in the user interface. Each KPI of the plurality of KPIs indicates a measure of performance for the service. The service monitoring system receives, via the user interface, an identification of a time period, and an identification of one or more visual characteristics for KPI graph lanes. Each of the KPI graph lanes is indicative of one or more KPI values of a respective KPI of the plurality of KPIs, the one or more KPI values are obtained from execution of a search query associated with the respective KPI, and the search query uses the time period to obtain the one or more KPI values. The service monitoring system causes display of a plurality of KPI graph lanes based on the one or more visual characteristics. Each graph lane provides a graphical visualization of the one or more KPI values of the respective KPI, and the display of the plurality of KPI graph lanes allows for visual correlation among the plurality of KPIs over the time period.

Defining a graphical visualization along a time-based graph lane using key performance indicators derived from machine data

An automatic service monitor in an information technology environment has its operation controlled by information that, in part, defines entities that perform services and defines key performance indicators (KPIs) that indicate measures of performance of the services. Additional information controls the operation of the service monitor with respect to identifying and adapting for KPIs based on the non-normal data caused by maintenance work or other causes. Such adaptation may include changes in how reported information appears to the user.

Providing a user interface reflecting service monitoring adaptation for maintenance downtime

Systems and methods ingest machine data including logs, metadata, and cost and usage information from multiple heterogeneous cloud services. The machine data is saved as events. An application retrieves the metadata, events, metrics, and logs and causes an easy to understand visual representation of costs, resource usage, and non-compliance for each of a client's cloud services. Further, the data across the client's multiple heterogeneous cloud services is normalized to provide visual representations that compare the costs, resource usage, and non-compliance across the client's multiple heterogeneous cloud services. Further, machine learning aspects of the application can provide recommendations and trend analysis for cloud service asset usage.

Networked cloud service monitoring

An example method of identification of related event groups for a service monitoring system includes: receiving a sample set of events from a service monitoring system; choosing, based the sample set of events, a set of fieldnames for defining factors; generating a plurality of event group definitions, wherein each event group definition of the plurality of event group definitions comprises a plurality of factors, wherein each factor of the plurality of factors is represented by a respective fieldname-value pair of an event of the sample set of events, wherein a fieldname of the respective fieldname-value pair is selected from the set of fieldnames; and determining, based on the plurality of event group definitions, one or more event groups for a plurality of events.

Identification of related event groups for IT service monitoring system

One or more processing devices cause display of a user interface that identifies a service definition representing a service, receive input identifying an entity, where the service is performed at least in part by the entity, and store the service definition representing the service in association with an entity definition representing the entity. The entity definition comprises information identifying data pertaining to the entity in a datastore of machine data that reflects activity in an information technology environment produced by a plurality of components of the information technology environment. The one or more processing devices receive input pertaining to a search definition representing a search producing a measure of the service, and store the search definition representing the search, where the search produces the measure of the service using at least a portion of the data pertaining to the entity.

Monitoring service-level performance using defined searches of machine data

A service monitoring system executing on one or more processors may have operations that are determined by control information. Control over the operation of the service monitoring system can be exerted through the use of a graphical interface. The graphical interface may present the control information of a new or existing correlation search definition for user interaction. The service monitoring system may maintain a data store of key performance indicator (KPI) data, where a KPI value in the data store is produced by a KPI-defining search query that derives the value from machine data associated with one or more entities that perform a monitored service. A correlation search definition of the service monitoring system determines how a search of the KPI data is conducted, how its data is evaluated to determine whether a triggering condition has been met, and, if so, determines what triggered action is to be initiated.

Performance monitoring using correlation search with triggering conditions

One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

Lower-tier application deployment for higher-tier system

The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Correlating data based on user-specified search criteria

A service monitoring system (SMS) produces key performance indicator (KPI) scores that indicate the performance of a service. To produce the KPI scores, the SMS may process the data for a large number of machine entities that perform the service. This data can be processed on a per-entity basis to produce a per-entity KPI score representing the contribution of a particular machine to the overall KPI. The per-entity KPI scores can be transformed to statistical representations which can be visualized as a distribution stream graph. The visualization may be presented with interactive aspects. Automatic entity definitions may also be generated based on content derived from the processed data.

Automatic entity definitions based on derived content

A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Data intake and query system with distributed data acquisition, indexing and search

Technologies are disclosed for providing a common information model. Features include: detecting a scheduled time for a key performance indicator reflecting how a service provided by one or more entities is performing, entity definition information recording the association between the entities and its machine data, service definition information associating the entities that provide the service, and the KPI being defined by a search query, including a field identifier specified in a data model, the KPI derives a value from the machine data; performing the query in response to said detecting, including: associating values in the machine data having disparate field names in accordance with disparate schemas with the field identifier specified in the data model, and processing the associated values as semantically equivalent data instances. In doing so, values having the same semantic (or related semantics) can be used together despite being associated with disparate field names from disparate schemas.

Evaluating key performance indicators of information technology service

An example method of determining a state of a key performance indicator (KPI) comprises: receiving one or more entity definitions, wherein each entity definition associates an entity with machine data pertaining to the entity; receiving a service definition for a service provided by one or more entities, the service definition including a reference to a corresponding entity definition of the entity definitions, wherein the service definition includes a respective reference for each of the one or more entities; receiving definitions of one or more KPIs, each KPI defined by a respective search query that produces a value derived from particular machine data, wherein the particular machine data is identified by the service definition, wherein each value is indicative of performance of the service at a point in time or during a period of time; deriving, by performing on the machine data a search query associated with the KPI, one or more KPI values for the KPI; selecting, among a plurality of states of the KPI, a state satisfying a condition applied to the one or more KPI values; and causing display of a visual indicator of the state of the KPI.

Determining states of key performance indicators derived from machine data

A computer implemented method includes establishing, by a data intake and query system, a network connection between the data intake and query system and an application and infrastructure monitoring platform. The data intake and query system receives a data stream from the application and infrastructure monitoring platform. The computer implemented method further includes transforming the data stream while receiving the data stream to obtain a transformed data stream. Further, the transformed data stream is analyzed while receiving the data stream to generate analysis results, which are presented.

Monitoring platform job integration in computer analytics system

In some embodiments, in response to the user selecting a first node in the tree to be pinned, the system displays a first detail panel for the first node, wherein the first detail panel displays state information for the first node, wherein the state information is frozen at the time of pinning. Moreover, in response to the user selecting a second node in the tree to be pinned, the system displays a second detail panel for the second node, wherein the second detail panel displays state information for the second node, wherein the state information is frozen at the time of pinning. Note that the first detail panel is displayed concurrently with the second detail panel to facilitate comparing state information between the first and second nodes.

Monitoring tree with performance states

Growing community of inventors

Pacifica, CA, United States of America

Tristan Antonio Fletcher