GUI-triggered processing of performance data and log data from an information technology environment
First Claim
Patent Images
1. A method comprising:
- acquiring, by a computer system, a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment, the plurality of performance measurements acquired from a third-party software application that collects the performance measurements;
acquiring, by the computer system, a plurality of portions of log data representing activity of the at least one hardware or software component of the IT environment;
storing, by the computer system, the acquired performance measurements in a first time-series data store and the acquired portions of log data in a second time-series data store separate from the first time-series data store;
causing, by the computer system, display of a graphical user interface element;
inputting, by the computer system, a search criterion from a user via the graphical user interface element, the search criterion for use by the computer system as a portion of a search query;
generating, by the computer system, the search query in a search query language, the search query including the search criterion input via the graphical user interface; and
correlating, by the computer system, at least one of the performance measurements stored in the first time-series data store with at least one of the portions of log data stored in the second time-series data store, based on the search criterion, wherein said correlating includesapplying the search query, in the search query language and including the search criterion input via the graphical user interface element, to the performance measurements stored in the first time-series data store and portions of log data stored in the second time-series data store separate from the first time-series data store,causing display of an indication of a performance measurement that satisfies the search criterion, andcausing display of an indication of a portion of log data from the at least one log file, that satisfies the search criterion.
1 Assignment
0 Petitions
Accused Products
Abstract
The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.
-
Citations
28 Claims
-
1. A method comprising:
-
acquiring, by a computer system, a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment, the plurality of performance measurements acquired from a third-party software application that collects the performance measurements; acquiring, by the computer system, a plurality of portions of log data representing activity of the at least one hardware or software component of the IT environment; storing, by the computer system, the acquired performance measurements in a first time-series data store and the acquired portions of log data in a second time-series data store separate from the first time-series data store; causing, by the computer system, display of a graphical user interface element; inputting, by the computer system, a search criterion from a user via the graphical user interface element, the search criterion for use by the computer system as a portion of a search query; generating, by the computer system, the search query in a search query language, the search query including the search criterion input via the graphical user interface; and correlating, by the computer system, at least one of the performance measurements stored in the first time-series data store with at least one of the portions of log data stored in the second time-series data store, based on the search criterion, wherein said correlating includes applying the search query, in the search query language and including the search criterion input via the graphical user interface element, to the performance measurements stored in the first time-series data store and portions of log data stored in the second time-series data store separate from the first time-series data store, causing display of an indication of a performance measurement that satisfies the search criterion, and causing display of an indication of a portion of log data from the at least one log file, that satisfies the search criterion. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26)
-
-
27. A non-transitory machine-readable storage medium for use in a processing system of a data intake and query system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:
-
acquiring, by a computer system, a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment, the plurality of performance measurements acquired from a third-party software application that collects the performance measurements; acquiring, by the computer system, a plurality of portions of log data representing activity of the at least one hardware or software component of the IT environment; storing, by the computer system, the acquired performance measurements in a first time-series data store and the acquired portions of log data in a second time-series data store separate from the first data store; causing, by the computer system, display of a graphical user interface element; inputting, by the computer system, a search criterion from a user via the graphical user interface element, the search criterion for use by the computer system as a portion of a search query; generating, by the computer system, the search query in a search query language, the search query including the search criterion input via the graphical user interface; and correlating, by the computer system, at least one of the performance measurements stored in the first time-series data store with at least one of the portions of log data stored in the second time-series data store, based on the search criterion, wherein said correlating includes applying the search query, in the search query language and including the search criterion input via the graphical user interface element, to the performance measurements stored in the first time-series data store and portions of log data stored in the second time-series data store separate from the first time-series data store, causing display of an indication of a performance measurement that satisfies the search criterion, and causing display of an indication of a portion of log data from the at least one log file, that satisfies the search criterion.
-
-
28. A system comprising:
-
a communication device through which to communicate on a computer network; and at least one processor operatively coupled to the communication device and configured to perform operations including acquiring, by a computer system, a plurality of performance measurements for a performance metric associated with at least one hardware or software component of an information technology (IT) environment, the plurality of performance measurements acquired from a third-party software application that collects the performance measurements; acquiring, by the computer system, a plurality of portions of log data representing activity of the at least one hardware or software component of the IT environment; storing, by the computer system, the acquired performance measurements in a first time-series data store and the acquired portions of log data in a second time-series data store separate from the first data store; causing, by the computer system, display of a graphical user interface element; inputting, by the computer system, a search criterion from a user via the graphical user interface element, the search criterion for use by the computer system as a portion of a search query; generating, by the computer system, the search query in a search query language, the search query including the search criterion input via the graphical user interface; and correlating, by the computer system, at least one of the performance measurements stored in the first time-series data store with at least one of the portions of log data stored in the second time-series data store, based on the search criterion, wherein said correlating includes applying the search query, in the search query language and including the search criterion input via the graphical user interface element, to the performance measurements stored in the first time-series data store and portions of log data stored in the second time-series data store separate from the first time-series data store, causing display of an indication of a performance measurement that satisfies the search criterion, and causing display of an indication of a portion of log data from the at least one log file, that satisfies the search criterion.
-
Specification