Monitoring service-level performance using a key performance indicator (KPI) correlation search

• US 10,152,561 B2
• Filed: 02/03/2016
• Issued: 12/11/2018
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Choudhary, Hemendra Singh, Fletcher, Tristan Antonio, Bingham, Brian, Hsiao, Fang I., Reyes, Brian C.
• Primary Examiner(s): Whipple, Brian
• Application Number:
  US15/014,017
• Publication Number:
  US 20160216855A1
• Time in Patent Office: 1,042 Days
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

A service monitoring system executing on one or more processors may have operations that are determined by control information. Control over the operation of the service monitoring system can be exerted through the use of a graphical interface. The graphical interface may present the control information of a new or existing correlation search definition for user interaction. The service monitoring system may maintain a data store of key performance indicator (KPI) data, where a KPI value in the data store is produced by a KPI-defining search query that derives the value from machine data associated with one or more entities that perform a monitored service. A correlation search definition of the service monitoring system determines how a search of the KPI data is conducted, how its data is evaluated to determine whether a triggering condition has been met, and, if so, determines what triggered action is to be initiated.

Claims

1. A method comprising:

causing display of a graphical interface enabling user interaction to indicate control information that determines operation of a service monitoring system, the control information belonging to a definition for a correlation search, the definition having;

search information to identify relevant key performance indicator (KPI) values from a data store;

trigger determination information to tailor an evaluation of the relevant KPI values to produce a trigger determination; and

action information to specify a potential action conditioned on the trigger determination;

receiving user input in response to user interaction with the graphical interface, the user input indicating one or more definition items;

storing the definition items among one or more of the search information, the trigger determination information, and the action information of the definition;

wherein each of the KPI values is indicative of one of a plurality of KPI states and is derived, by a search query that defines the KPI, from machine data associated with one or more entities that perform a service; and

wherein the method is performed by one or more processors.

2. The method of claim 1 wherein the definition items comprise a contribution threshold corresponding to a particular KPI and a particular one of the KPI states.

3. The method of claim 1 wherein the graphical interface includes a trigger criteria interface.

4. The method of claim 1 further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection.

5. The method of claim 1 further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface having content determined based at least in part on the user selection.

6. The method of claim 1 further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including information reflecting the current performance of at least one of the KPI states for a particular KPI, the particular KPI determined by the user selection.

7. The method of claim 1 further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including an identifier, and a text and/or graphical representation of a contribution threshold value, for each of one or more of the KPI states.

8. The method of claim 1 further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs;

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including an identifier and a graphical representation of a contribution threshold value for each of one or more of the KPI states; and

wherein the graphical representation includes an interactive control enabling user adjustment of the contribution threshold value.

9. The method of claim 1 further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including, for each of one or more of the plurality of KPI states, an interface element for representing each of at least one from among a contribution threshold value, a statistical function, and a comparison operator.

10. The method of claim 1 wherein the definitions items include a duration value specifying a time frame for the relevant KPI values.

11. The method of claim 1 further comprising:

receiving user input in response to user interaction with the graphical interface, the user input indicating a search frequency; and

storing the indicated search frequency in the definition of the correlation search.

12. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of a graphical interface enabling user interaction to indicate control information that determines operation of a service monitoring system, the control information belonging to a definition for a correlation search, the definition having;

search information to identify relevant key performance indicator (KPI) values from a data store;

trigger determination information to tailor an evaluation of the relevant KPI values to produce a trigger determination; and

action information to specify a potential action conditioned on the trigger determination;

receive user input in response to user interaction with the graphical interface, the user input indicating one or more definition items;

store the definition items among one or more of the search information, the trigger determination information, and the action information of the definition; and

wherein each of the KPI values is indicative of one of a plurality of KPI states and is derived, by a search query that defines the KPI, from machine data associated with one or more entities that perform a service.

13. The system of claim 12 wherein the definition items comprise a contribution threshold corresponding to a particular KPI and a particular one of the KPI states.

14. The system of claim 12 wherein the graphical interface includes a trigger criteria interface.

15. The system of claim 12, the memory further to:

cause display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

cause display of a trigger criteria interface in response to the user selection.

16. The system of claim 12, the memory further to:

cause display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

cause display of a trigger criteria interface in response to the user selection, the trigger criteria interface having content determined based at least in part on the user selection.

17. The system of claim 12, the memory further to:

cause display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

cause display of a trigger criteria interface in response to the user selection, the trigger criteria interface including information reflecting the current performance of at least one of the KPI states for a particular KPI, the particular KPI determined by the user selection.

18. The system of claim 12, the memory further to:

cause display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

cause display of a trigger criteria interface in response to the user selection, the trigger criteria interface including an identifier, and a text and/or graphical representation of a contribution threshold value, for each of one or more of the KPI states.

19. The system of claim 12, the memory further to:

cause display of a graphical interface enabling a user selection from among one or more candidate KPIs;

cause display of a trigger criteria interface in response to the user selection, the trigger criteria interface including an identifier and a graphical representation of a contribution threshold value for each of one or more of the KPI states; and

wherein the graphical representation includes an interactive control enabling user adjustment of the contribution threshold value.

20. The system of claim 12, the memory further to:

cause display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

cause display of a trigger criteria interface in response to the user selection, the trigger criteria interface including, for each of one or more of the plurality of KPI states, an interface element for representing each of at least one from among a contribution threshold value, a statistical function, and a comparison operator.

21. The system of claim 12 wherein the definitions items include a duration value specifying a time frame for the relevant KPI values.

22. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of a graphical interface enabling user interaction to indicate control information that determines operation of a service monitoring system, the control information belonging to a definition for a correlation search, the definition having;

search information to identify relevant key performance indicator (KPI) values from a data store;

trigger determination information to tailor an evaluation of the relevant KPI values to produce a trigger determination; and

action information to specify a potential action conditioned on the trigger determination;

receiving user input in response to user interaction with the graphical interface, the user input indicating one or more definition items;

storing the definition items among one or more of the search information, the trigger determination information, and the action information of the definition;

wherein each of the KPI values is indicative of one of a plurality of KPI states and is derived, by a search query that defines the KPI, from machine data associated with one or more entities that perform a service.

23. The non-transitory computer readable storage medium of claim 22 wherein the definition items comprise a contribution threshold corresponding to a particular KPI and a particular one of the KPI states.

24. The non-transitory computer readable storage medium of claim 22 wherein the graphical interface includes a trigger criteria interface.

25. The non-transitory computer readable storage medium of claim 22, the operations further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection.

26. The non-transitory computer readable storage medium of claim 22, the operations further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface having content determined based at least in part on the user selection.

27. The non-transitory computer readable storage medium of claim 22, the operations further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including information reflecting the current performance of at least one of the KPI states for a particular KPI, the particular KPI determined by the user selection.

28. The non-transitory computer readable storage medium of claim 22, the operations further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including an identifier, and a text and/or graphical representation of a contribution threshold value, for each of one or more of the KPI states.

29. The non-transitory computer readable storage medium of claim 22, the operations further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs;

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including an identifier and a graphical representation of a contribution threshold value for each of one or more of the KPI states; and

wherein the graphical representation includes an interactive control enabling user adjustment of the contribution threshold value.

30. The non-transitory computer readable storage medium of claim 22, the operations further comprising:

causing display of a graphical interface enabling a user selection from among one or more candidate KPIs; and

causing display of a trigger criteria interface in response to the user selection, the trigger criteria interface including, for each of one or more of the plurality of KPI states, an interface element for representing each of at least one from among a contribution threshold value, a statistical function, and a comparison operator.