Graphical user interface for static and adaptive thresholds

• US 10,503,348 B2
• Filed: 07/28/2017
• Issued: 12/10/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Maheshwari, Sonal, Sainani, Manish, Alekseyev, Leonid, Hardin, Alan, Leverich, Jacob Barton, Oliner, Adam Jamison, Reyes, Brian, Bhide, Alok Anant
• Primary Examiner(s): Boutah, Alina A
• Application Number:
  US15/662,916
• Publication Number:
  US 20170329462A1
• Time in Patent Office: 865 Days
• CPC Class Codes: G06F 16/2474 Sequence data queries, e.g. querying versioned data
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04812 Interaction techniques based on cursor appearance or behaviour, e.g. being affected by the presence of displayed objects
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06Q 10/109 Time management, e.g. calendars, reminders, meetings or time accounting
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

Techniques are disclosed for providing a graphical user interface (GUI) for displaying and configuring adaptive or static thresholds for Key Performance Indicators (KPIs). The GUI may include one or more presentation schedules that may display threshold information associated with time policies. Each presentation schedule may include multiple time slots and span a portion of one or more time cycles. Some of the time slots may be associated with a specific time policy and may have a unifying appearance that distinguishes the time slots from timeslots associated with other time policies. The presentation schedules may arrange the time slots in a time grid arrangement (e.g., calendar grid view) or a graph arrangement with depictions (e.g., points, lines) that may illustrate KPI values and threshold markers that may illustrate the threshold values.

Claims

1. A method comprising:

accessing stored threshold information for one or more time policies associated with a Key Performance Indicator (KPI), the KPI defined by a search query that derives a value from machine data, the value indicative of the performance of a service at a point in time or over a period of time, the service represented by a stored service definition associating one or more entities that provide the service, and each of the entities represented by a stored entity definition comprising an identification of the machine data pertaining to the entity;

determining a correspondence between one of the time policies and one or more time slots;

causing display of a user interface including a presentation schedule comprising the one or more time slots, wherein the one or more time slots have a unifying appearance;

wherein each of the one or more time policies is of a static time policy type or an adaptive time policy type, the static time policy type having a threshold with a user-indicated static threshold value, and the adaptive time policy type having a threshold with an adaptive threshold value provided automatically by the system based at least in part on historical values of the KPI, each threshold defining an end of a range of values corresponding to a KPI state;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by a computer system comprising one or more processors coupled to computer storage.

2. The method of claim 1, wherein the unifying appearance of the time slots in the presentation schedule indicates that the one or more time slots correspond to an in-focus time policy, wherein the in-focus time policy is identified based on user input.

3. The method of claim 1, wherein the unifying appearance of the one or more time slots in the presentation schedule comprises a visual attribute to distinguish the one or more time slots from a time slot that corresponds to another time policy in the presentation schedule.

4. The method of claim 1, wherein each of the time slots in the presentation schedule represents a continuous duration of time.

5. The method of claim 1, wherein each of the time policies identifies a time frame and associates the threshold of the time policy with the time frame, the time frame occurring one or more times within a time cycle.

6. The method of claim 1, wherein the unifying appearance of the time slots in the presentation schedule indicates that the one or more time slots correspond to an in-focus time policy identified based on user input, and wherein each of the time slots in the presentation schedule represents a continuous duration of time.

7. The method of claim 1, wherein the time policies comprise a static time policy and an adaptive time policy.

8. The method of claim 1, further comprising:

analyzing a plurality of historical values of the KPI within a defined window of time to determine a statistical metric indicating changes of the historical values within the defined window of time; and

updating the adaptive threshold value of at least one adaptive time policy based on the statistical metric.

9. The method of claim 1, wherein the presentation schedule comprises a depiction of a plurality of values of the KPI over a time cycle spanning the one or more time slots.

10. The method of claim 1, wherein the user interface further includes a graphical visualization associated with a particular time policy of the one or more time policies, the graphical visualization comprising a graph having a horizontal axis indicating a duration of time and a vertical axis with one or more threshold markers illustrating one or more thresholds associated with the particular time policy.

11. The method of claim 1, wherein the user interface further includes a graphical visualization comprising multiple user adjustable threshold markers and a graphical control element enabling a user to add an additional threshold to one of the time policies.

12. The method of claim 1, wherein each of the time slots in the presentation schedule includes a visual attribute to distinguish the range of values corresponding to the KPI state from a range of values corresponding to a different KPI state.

13. The method of claim 1, further comprising:

receiving user input adjusting a threshold marker of the threshold of one of the time policies; and

updating a value of the threshold.

14. The method of claim 1, further comprising:

receiving a first user input identifying one of the time policies; and

receiving a second user input to change the identified time policy from an adaptive time policy type to a static time policy type.

15. The method of claim 1, wherein the presentation schedule comprises a time grid illustrating one or more time frames of one or more in-focus time policies.

16. The method of claim 1, the user interface further including a second presentation schedule and a listing of the time policies, wherein an identification of one of the time policies causes the presentation schedule and the second presentation schedule to be updated to display threshold information associated with the identified time policy.

17. The method of claim 1, wherein the user interface further comprises a hover display that provides threshold information when user input identifies one or more of the time slots.

18. The method of claim 1, wherein the presentation schedule comprises a graph having a first depiction and a second depiction, the first depiction illustrating a contribution of a first entity to the KPI and the second depiction illustrating a contribution of a second entity to the KPI.

19. The method of claim 1, wherein the presentation schedule comprises a first depiction corresponding to values of the KPI derived from a portion of training data associated with a first time cycle and a second depiction corresponding to values of the KPI derived from a portion of training data associated with a second time cycle.

20. The method of claim 1, further comprising running the search query defining the KPI to derive the value of the KPI and determining the KPI state corresponding to the range of values that includes the derived value of the KPI.

21. The method of claim 1, wherein the machine data is stored as time-stamped events.

22. The method of claim 1, wherein the machine data is stored as time-stamped events, where each time-stamped event includes a portion of raw machine data.

23. The method of claim 1, wherein the machine data is stored as time-stamped events including portions of raw machine data and is accessed using a late-binding schema.

24. The method of claim 1, wherein the search query uses a late-binding schema to extract values indicative of the performance of the service from time-stamped events after the search query is initiated.

25. The method of claim 1, wherein the machine data pertaining to an entity of the one or more entities comprises heterogeneous machine data from multiple sources.

26. The method of claim 1, wherein the machine data pertaining to an entity of the one or more enties comprises machine data from the entity and another entity.

27. A system comprising:

a memory; and

a processing device coupled with the memory to;

access stored threshold information for one or more time policies associated with a Key Performance Indicator (KPI), the KPI defined by a search query that derives a value from machine data, the value indicative of the performance of a service at a point in time or over a period of time, the service represented by a stored service definition associating one or more entities that provide the service, and each of the entities represented by a stored entity definition comprising an identification of the machine data pertaining to the entity;

determine a correspondence between one of the time policies and one or more time slots;

cause display of a user interface including a presentation schedule comprising the one or more time slots, wherein the one or more time slots have a unifying appearance;

wherein each of the one or more time policies is of a static time policy type or an adaptive time policy type, the static time policy type having a threshold with a user-indicated static threshold value, and the adaptive time policy type having a threshold with an adaptive threshold value provided automatically by the system based at least in part on historical values of the KPI, each threshold defining an end of a range of values corresponding to a KPI state; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

28. The system of claim 27, wherein the unifying appearance of the time slots in the presentation schedule indicates that the time slots correspond to an in-focus time policy, wherein the in-focus time policy is identified based on user input.

29. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, causes the processing device to perform operations comprising:

accessing stored threshold information for one or more time policies associated with a Key Performance Indicator (KPI), the KPI defined by a search query that derives a value from machine data, the value indicative of the performance of a service at a point in time or over a period of time, the service represented by a stored service definition associating one or more entities that provide the service, and each of the entities represented by a stored entity definition comprising an identification of the machine data pertaining to the entity;

determining a correspondence between one of the time policies and one or more time slots;

causing display of a user interface including a presentation schedule comprising the one or more time slots, wherein the one or more time slots have a unifying appearance;

wherein each of the one or more time policies is of a static time policy type or an adaptive time policy type, the static time policy type having a threshold with a user-indicated static threshold value, and the adaptive time policy type having a threshold with an adaptive threshold value provided automatically by the system based at least in part on historical values of the KPI, each threshold defining an end of a range of values corresponding to a KPI state; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

30. The non-transitory computer readable storage medium of claim 29, wherein the unifying appearance of the time slots in the presentation schedule indicates that the time slots correspond to an in-focus time policy, wherein the in-focus time policy is identified based on user input.