Defining a new correlation search based on fluctuations in key performance indicators displayed in graph lanes

• US 10,565,241 B2
• Filed: 11/15/2017
• Issued: 02/18/2020
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Fletcher, Tristan Antonio, Bhide, Alok Anant
• Primary Examiner(s): Mirza, Adnan M
• Application Number:
  US15/814,320
• Publication Number:
  US 20180075134A1
• Time in Patent Office: 825 Days
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A system, method and graphical user interface (GUI) for creating a new correlation search based on fluctuations in key performance indicators (KPIs) displayed in a set of graph lanes. The graph lanes may provide graphical visualizations of the KPIs associated with one or more services and may assist a user in identifying a situation (e.g., problem or a pattern of interest) in the performance of the services. The graph lanes can be adjusted (e.g., add graph lanes, zooming-in) in order to display the situation, at which point a new correlation search may be generated to detect if the situation reoccurs. The system may generate the new correlation search by iterating through the set of graph lanes and analyzing the fluctuations of each KPI to determine triggering criteria. The system may then run the correlation search and generate a notable event or alarm when the situation reoccurs.

Claims

1. A method comprising:

causing display of a set of graph lanes corresponding to a plurality of key performance indicators (KPIs) that each indicate how a service is performing during a first period of time, wherein the set of graph lanes illustrate multiple KPI values of the plurality of KPIs during the first period of time;

for each of the plurality of KPIs, determining a corresponding KPI criterion based on fluctuations in the KPI during the first period of time;

generating an aggregate triggering condition using KPI criteria determined for the plurality of KPIs;

adding the aggregate triggering condition to a definition of a correlation search, the correlation search to trigger an action when the plurality of KPIs are within a user-defined range of KPI values illustrated by the graph lanes during a second period of time, wherein the definition of the correlation search further comprising data identifying the plurality of KPIs and the action to be triggered when each of the plurality of KPIs satisfies a respective KPI criterion from the aggregate triggering condition during the second period of time; and

storing the definition of the correlation search comprising the aggregate triggering condition in computer storage to thereby direct execution of a service monitoring system;

wherein the method is performed by one or more processing devices.

2. The method of claim 1, wherein the graph lanes illustrate a plurality of KPI states corresponding to the multiple KPI values, and wherein the fluctuations in the KPI are determined based on a proportion of time the corresponding KPI is in any of the plurality of KPI states during the first period of time.

3. The method of claim 1, wherein the fluctuations in the KPI are determined based on a statistical distribution of the multiple KPI values during the first period of time.

4. The method of claim 1, wherein the set of graph lanes and the first period of time are selected by a user and correspond to a system malfunction.

5. The method of claim 1, further comprising:

receiving user input identifying one or more graph lanes of the set of graph lanes; and

updating the set of graph lanes to remove the one or more graph lanes.

6. The method of claim 1, further comprising:

receiving user input to modify a zoom level of the set of graph lanes; and

updating the first period of time being displayed to correspond with the zoom level.

7. The method of claim 1, further comprising:

receiving user input selecting a portion of the first period of time being displayed; and

wherein determining a corresponding KPI criterion is based on the fluctuations in the KPI during the portion of the first period of time.

8. The method of claim 1, wherein each of the plurality of KPIs is defined by a different search query that derives a KPI value from machine data pertaining to the service, wherein the service is provided by one or more entities and the KPI value is associated with a point-in-time and represents an aspect of how the service is performing at the point-in-time.

9. The method of claim 1, wherein the action comprises at least one of generating a notable event, sending an email or creating an incident ticket.

10. The method of claim 1, wherein the correlation search has a textual string of search processing language comprising a search query, the aggregate triggering condition and the action represented by a notable event description, wherein the notable event description is associated with a severity level for a system malfunction.

11. The method of claim 1, further comprising, identifying a search query associated with the KPI of each graph lane, wherein the correlation search comprises the search query of each graph lane.

12. The method of claim 1, further comprising, causing display of a timeline representing a time scale in parallel to the set of graph lanes, wherein the set of graph lanes are parallel with one another and are all calibrated to the time scale.

13. The method of claim 1, wherein the set of graph lanes includes multiple different graphical visualizations including at least one of a line graph, an area graph, a bar chart or a heat map.

14. The method of claim 1, further comprising receiving through a graphical interface a selection of a time range that each of the set of graph lanes cover.

15. The method of claim 1, wherein the service may comprise multiple services and the set of graph lanes comprise at least two graph lanes corresponding to a first service and at least two graph lanes corresponding to a second service.

16. The method of claim 1, wherein the first period of time displayed by the set of graph lanes comprises a rolling period of time equal to the duration of the first period of time.

17. The method of claim 1, wherein the graph lanes display the multiple KPI values derived from raw machine data at least in part using a late-binding schema.

18. The method of claim 1, wherein each of the multiple KPI states is defined by a KPI threshold and a range of KPI values.

19. The method of claim 1, wherein a value of the KPI is derived from time-stamped events, the time-stamped events each including at least a portion of raw machine data.

20. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of a set of graph lanes corresponding to a plurality of key performance indicators (KPIs) that each indicate how a service is performing during a first period of time, wherein the set of graph lanes illustrate multiple KPI values of the plurality of KPIs during the first period of time;

for each of the plurality of KPIs, determine a corresponding KPI criterion based on fluctuations in the KPI during the first period of time;

generate an aggregate triggering condition using KPI criteria determined for the plurality of KPIs;

add the aggregate triggering condition to a definition of a correlation search, the correlation search to trigger an action when the plurality of KPIs are within a user-defined range of KPI values illustrated by the graph lanes during a second period of time, wherein the definition of the correlation search further comprising data identifying the plurality of KPIs and the action to be triggered when each of the plurality of KPIs satisfies a respective KPI criterion from the aggregate triggering condition during the second period of time; and

store the definition of the correlation search comprising the aggregate triggering condition in computer storage to thereby direct execution of a service monitoring system.

21. The system of claim 20, wherein the graph lanes illustrate a plurality of KPI states corresponding to the multiple KPI values, and wherein the fluctuations in the KPI are determined based on a proportion of time the corresponding KPI is in any of the plurality of KPI states during the first period of time.

22. The system of claim 20, wherein the fluctuations in the KPI are determined based on a statistical distribution of the multiple KPI values during the first period of time.

23. The system of claim 20, wherein the set of graph lanes and the first period of time are selected by a user and correspond to a system malfunction.

24. The system of claim 20, wherein the processing device is further to:

receive user input identifying one or more graph lanes of the set of graph lanes; and

update the set of graph lanes to remove the one or more graph lanes.

25. The system of claim 20, wherein the processing device is further to:

receive user input to modify a zoom level of the set of graph lanes; and

update the first period of time being displayed to correspond with the zoom level.

26. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

causing display of a set of graph lanes corresponding to a plurality of key performance indicators (KPIs) that each indicate how a service is performing during a first period of time, wherein the set of graph lanes illustrate multiple KPI values of the plurality of KPIs during the first period of time;

for each of the plurality of KPIs, determining a corresponding KPI criterion based on fluctuations in the KPI during the first period of time;

generating an aggregate triggering condition using KPI criteria determined for the plurality of KPIs;

adding the aggregate triggering condition to a definition of a correlation search, the correlation search to trigger an action when the plurality of KPIs are within a user-defined range of KPI values illustrated by the graph lanes during a second period of time, wherein the definition of the correlation search further comprising data identifying the plurality of KPIs and the action to be triggered when each of the plurality of KPIs satisfies a respective KPI criterion from the aggregate triggering condition during the second period of time; and

storing the definition of the correlation search comprising the aggregate triggering condition in computer storage to thereby direct execution of a service monitoring system;

wherein the method is performed by one or more processing devices.

27. The non-transitory computer readable storage medium of claim 26, wherein the graph lanes illustrate a plurality of KPI states corresponding to the multiple KPI values, and wherein the fluctuations in the KPI are determined based on a proportion of time the corresponding KPI is in any of the plurality of KPI states during the first period of time.

28. The non-transitory computer readable storage medium of claim 26, wherein the fluctuations in the KPI are determined based on a statistical distribution of the multiple KPI values during the first period of time.

29. The non-transitory computer readable storage medium of claim 26, wherein the set of graph lanes and the first period of time are selected by a user and correspond to a system malfunction.

30. The non-transitory computer readable storage medium of claim 26, further comprising:

receiving user input identifying one or more graph lanes of the set of graph lanes; and

updating the set of graph lanes to remove the one or more graph lanes.

31. The non-transitory computer readable storage medium of claim 26, further comprising:

receiving user input to modify a zoom level of the set of graph lanes; and

updating the first period of time being displayed to correspond with the zoom level.