Automatic event group action interface

• US 10,193,775 B2
• Filed: 09/26/2016
• Issued: 01/29/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Fletcher, Tristan Antonio, Choudhary, Hemendra Singh, Lazerowitz, Ross Andrew, Sridhar, Chakravarthy
• Primary Examiner(s): Choi, David E
• Application Number:
  US15/276,750
• Publication Number:
  US 20170046374A1
• Time in Patent Office: 855 Days
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06Q 10/20 Administration of product repair or maintenance
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters

Abstract

An automatic service monitor in an information technology environment is equipped to automatically identify and group recognized events based on user-defined criteria, and to automatically perform user-defined operations against the group and its members at the detection of user-specified conditions. A related user interface is taught.

Claims

1. A method comprising:

causing display of an interface enabling a user to indicate information to control the operation of a service monitoring system to automatically identify and update a group of events from among a plurality of events in an event datastore;

receiving user input via the interface including;

an indication of group membership criteria;

an indication of a causable group action;

an indication of a precondition related to the causable group action;

creating an event group policy definition in computer storage based at least in part on the group membership criteria, the causable group action, and the precondition;

wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by one or more processing devices.

2. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data.

3. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data;

and

wherein the event datastore and the machine data event datastore are a common datastore.

4. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of events each including a segment of machine data and a timestamp.

5. The method of claim 1 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema.

6. The method of claim 1 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema having one or more field extraction rules.

7. The method of claim 1 wherein the machine data is produced by more than one source.

8. The method of claim 1 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

9. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore.

10. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and a group breaking condition.

11. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and an identification of a source of information descriptive of the group.

12. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore and an identification of a group splitting field.

13. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, an identification of a group splitting field, and a group breaking condition.

14. The method of claim 1 wherein the indication of the causable group action indicates whether the causable action applies to all or some of the events of the group.

15. The method of claim 1 wherein the indication of the causable group action indicates the identification of a field to be modified.

16. The method of claim 1 wherein the indication of the causable group action indicates a field value to store.

17. The method of claim 1 wherein the indication of the precondition indicates at least one from among a group size limit, a group time limit, and an event identification.

18. The method of claim 1 wherein the indication of the precondition indicates at least one group time limit from among a group timespan limit and a group idle time limit.

19. The method of claim 1 wherein to update a group of events includes at least one from among modifying a stored representation of each of the events of the group and modifying a stored collective representation of the group.

20. The method of claim 1 wherein to update a group of events includes causing the performance of the causable action in response to a satisfaction of the precondition and wherein the causable action stores a particular value in a particular field of each of the events of the event group.

21. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of an interface enabling a user to indicate information to control the operation of a service monitoring system to automatically identify and update a group of events from among a plurality of events in an event datastore;

receive user input via the interface including;

an indication of group membership criteria;

an indication of a causable group action;

an indication of a precondition related to the causable group action;

create an event group policy definition in computer storage based at least in part on the group membership criteria, the causable group action, and the precondition;

wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

22. The system of claim 21 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data.

23. The system of claim 21 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of events each including a segment of machine data and a timestamp.

24. The system of claim 21 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema.

25. The system of claim 21 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema having one or more field extraction rules.

26. The system of claim 21 wherein the machine data is produced by more than one source.

27. The system of claim 21 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

28. The system of claim 21 wherein the group membership criteria includes a matching criteria for field data of the event datastore.

29. The system of claim 21 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and a group breaking condition.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of an interface enabling a user to indicate information to control the operation of a service monitoring system to automatically identify and update a group of events from among a plurality of events in an event datastore;

receiving user input via the interface including;

an indication of group membership criteria;

an indication of a causable group action;

an indication of a precondition related to the causable group action;

creating an event group policy definition in computer storage based at least in part on the group membership criteria, the causable group action, and the precondition;

wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.