Monitoring IT services from machine data with time varying static thresholds

• US 10,572,518 B2
• Filed: 10/31/2017
• Issued: 02/25/2020
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Fletcher, Tristan Antonio, Bhide, Alok Anant
• Primary Examiner(s): Mirza, Adnan M
• Application Number:
  US15/799,403
• Publication Number:
  US 20180052912A1
• Time in Patent Office: 847 Days
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

One or more processing devices derive values indicative of various aspects of how a particular service in an information technology (IT) environment is performing at a point in time or for a period of time. The values are derived by a search query over machine data associated with the one or more entities that provide the service. The one or more processing devices define and apply time varying static thresholds in respect to the values. A user (e.g., IT manager) may be enabled to manipulate or define multiple sets of KPI thresholds that vary over time.

Claims

1. A method comprising:

sending a first network transmission for causing display of a graphical user interface (GUI) identifying a key performance indicator (KPI) for a service, the KPI defined by a search query that produces a KPI value derived from machine data pertaining to one or more entities providing the service, the KPI value indicative of a performance assessment for the service at a point in time or during a period of time;

receiving a second network transmission comprising a user input, via the GUI, specifying different sets of KPI thresholds for the KPI, each set of KPI thresholds corresponding to a distinct time frame, a KPI threshold in each set of KPI thresholds associated with a range of values corresponding to a particular KPI state from among a set of KPI states; and

determining a KPI state by;

executing the search query against the machine data to produce a KPI value indicative of a performance assessment for the service at a point in time or during a period of time;

identifying one of the sets of KPI thresholds comprising a time frame covering the point in time or the period of time; and

selecting the KPI state from the set of KPI states corresponding to the identified set of KPI thresholds based on the KPI value;

wherein the method is performed by one or more processing devices.

2. The method of claim 1, wherein the GUI displays a marker corresponding to a KPI threshold of the identified set of KPI thresholds.

3. The method of claim 1, further comprising:

causing display of a graphical representation of multiple KPI values along with markers corresponding to each KPI threshold of the identified set of KPI thresholds.

4. The method of claim 1, wherein the GUI enables a user to adjust an existing KPI threshold of the identified set of KPI thresholds.

5. The method of claim 1, wherein the different sets of KPI thresholds comprise a first set, a second set and a third set, wherein the first set corresponds to a time frame comprising a week day, wherein the second set corresponds to a time frame comprising a weekend and the third set comprises a holiday.

6. The method of claim 1, wherein a KPI threshold is based on at least one of an hour of a day, a day of a week, or a month of a year.

7. The method of claim 1, further comprising:

receiving a user input requesting generation of a suggested KPI threshold;

comparing KPI values within a first time frame with KPI values within a second time frame to identify a difference in KPI values; and

generating one or more suggested KPI thresholds based on the difference in the KPI values.

8. The method of claim 1, wherein each set of KPI states comprises at least a critical state and a non-critical state, and wherein a specific KPI value occurring during a first time frame corresponds to the critical state and the same specific KPI value occurring during a second time frame corresponds to the non-critical state.

9. The method of claim 1, wherein the identified set of KPI thresholds includes a first threshold corresponding to a normal state and a second threshold corresponding to a warning state, and the normal state is selected when the KPI value is between the first threshold and the second threshold.

10. The method of claim 1, wherein the particular KPI state is defined by two KPI thresholds that identify ends of the range, a first KPI threshold defining the minimum value of the range and a second KPI threshold defining the maximum value of the range.

11. The method of claim 1, wherein the KPI threshold represents an end of the range and comprises either a minimum value of the range or the maximum value of the range.

12. The method of claim 1, wherein the machine data comprises one or more of web access logs, email logs, DNS logs or authentication logs.

13. The method of claim 1, wherein each of the entities providing the service is any one of:

a server, a database, an application, or a network source.

14. The method of claim 1, wherein executing the search query comprises:

applying a late-binding schema to a plurality of events comprising the machine data, the late-binding schema associated with one or more extraction rules defining one or more fields in the plurality of events.

15. The method of claim 1, further comprising causing display of another GUI that visually illustrates the selected state of the KPI.

16. The method of claim 1, wherein selecting the KPI state based on the KPI value comprises comparing the KPI value with multiple ranges of values and determining that the KPI value is within the range of values.

17. The method of claim 1, wherein the sets of KPI thresholds include a first set of KPI thresholds for a first time frame and a second set of KPI thresholds for a second time frame and both the first time frame and the second time frame are included within a repeating time cycle, and during each repeating time cycle the first set of KPI thresholds and the second set of KPI thresholds are applied to respective KPI values, wherein the repeating time cycle is based on a day, a week or a month.

18. A system comprising:

a memory; and

a processing device coupled with the memory to;

send a first network transmission to cause display of a graphical user interface (GUI) identifying a key performance indicator (KPI) for a service, the KPI defined by a search query that produces a KPI value derived from machine data pertaining to one or more entities providing the service, the KPI value indicative of a performance assessment for the service at a point in time or during a period of time;

receive a second network transmission comprising a user input, via the GUI, specifying different sets of KPI thresholds for the KPI, each set of KPI thresholds corresponding to a distinct time frame, a KPI threshold in each set of KPI thresholds associated with a range of values corresponding to a particular KPI state from among a set of KPI states; and

determine a KPI state, wherein to determine the KPI state the processing device is further to;

execute the search query against the machine data to produce a KPI value indicative of a performance assessment for the service at a point in time or during a period of time;

identify one of the sets of KPI thresholds comprising a time frame covering the point in time or the period of time; and

select the KPI state from the set of KPI states corresponding to the identified set of KPI thresholds based on the KPI value.

19. The system of claim 18, wherein the GUI displays a marker corresponding to a KPI threshold of the identified set of KPI thresholds.

20. The system of claim 18, wherein the processing device further to:

cause display of a graphical representation of multiple KPI values along with markers corresponding to each KPI threshold of the identified set of KPI thresholds.

21. The system of claim 18, wherein the GUI provides for manual adjustment of an existing KPI threshold within the identified set of KPI thresholds.

22. The system of claim 18, wherein the different sets of KPI thresholds comprise a first set, a second set and a third set, wherein the first set corresponds to a time frame comprising a week day, wherein the second set corresponds to a time frame comprising a weekend and the third set comprises a holiday.

23. The system of claim 18, wherein the processing device is further to:

receive a user input requesting generation of a suggested KPI threshold; and

generate one or more suggested KPI thresholds based on values derived from the machine data.

24. The system of claim 18, wherein each set of KPI states comprises at least a critical state and a non-critical state.

25. The system of claim 18, wherein a KPI state of the set of KPI states is defined by two KPI thresholds, a first KPI threshold defining the minimum value of the range and a second KPI threshold defining the maximum value of the range.

26. The system of claim 18, wherein the machine data comprises one or more of web access logs, email logs, DNS logs or authentication logs.

27. The system of claim 18, wherein each of the entities providing the service is any one of:

a server, a database, an application, or a network source.

28. The system of claim 18, wherein to execute the search query the processing device is further to:

apply a late-binding schema to a plurality of events comprising the machine data, the late-binding schema associated with one or more extraction rules defining one or more fields in the plurality of events.

29. The system of claim 18, wherein the processing device is further to cause display of another GUI that visually illustrates the selected state of the KPI.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

sending a first network transmission for causing display of a graphical user interface (GUI) identifying a key performance indicator (KPI) for a service, the KPI defined by a search query that produces a KPI value derived from machine data pertaining to one or more entities providing the service, the KPI value indicative of a performance assessment for the service at a point in time or during a period of time;

receiving a second network transmission comprising a user input, via the GUI, specifying different sets of KPI thresholds for the KPI, each set of KPI thresholds corresponding to a distinct time frame, a KPI threshold in each set of KPI thresholds associated with a range of values corresponding to a particular KPI state from among a set of KPI states; and

determining a KPI state by;

executing the search query against the machine data to produce a KPI value indicative of a performance assessment for the service at a point in time or during a period of time;

identifying one of the sets of KPI thresholds comprising a time frame covering the point in time or the period of time; and

selecting the KPI state from the set of KPI states corresponding to the identified set of KPI thresholds based on the KPI value.