KEY INDICATORS VIEW

• US 20130318236A1
• Filed: 07/31/2013
• Published: 11/28/2013
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Coates, John, Murphey, Lucas, Hansen, James, Hazekamp, David
• Granted Patent: US 10,574,548 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/33 Querying
• CPC Class Codes: G06F 16/383 using metadata automatically derived from the content
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data

Abstract

A system and computer-implemented is provided for displaying a configurable metric relating to an environment in a graphical display along with a value of the metric calculated over a configurable time period. The metric is used to identify events of interest in the environment based on processing real time machine data from one or more sources. The configurable metric is selected and a corresponding value is calculated based on the events of interest over the configurable time period. The value of the metric may be continuously updated in real time based on receiving additional real-time machine data and displayed in a graphical interface as time progresses. Statistical trends in the value of the metric may also be determined over the configurable time period and displayed in the graphical interface as well as an indication if the value of the metric exceeds a configurable threshold value. Further, a selection of one or more thresholds for the value of the metric may be applied and an indication displayed indicating if the threshold(s) have been exceeded.

Claims

1. A computer-implemented method comprising:

receiving, by a computer system, real time machine data from one or more sources, wherein the machine data is received at a computer system interface;

receiving, by the computer system, a signal representing a selection of a configurable metric;

calculating a value corresponding to the metric over a configurable time period; and

displaying the metric and corresponding value in a graphical interface along with real time information relating to the metric and its value.

2. The computer-implemented method of claim 1 further comprising:

updating the value of the metric continuously in real time based on receiving additional real-time data at the computer interface; and

displaying updated values of the metric in response thereto as time progresses.

3. The computer-implemented method of claim 1 further comprising displaying a trend in the value of the metric over the configurable time period.

4. The computer-implemented method of claim 1 further comprising:

receiving at the computer interface a signal representing a selection of a configurable threshold to be applied to the value of the metric; and

displaying an indicator in the graphical interface indicating if the value of the metric exceeds the threshold.

5. The computer-implemented method of claim 4 wherein the real time information includes information indicating if the threshold is being exceeded in real time.

6. The computer-implemented method of claim 1 further comprising:

receiving at the computer interface a signal representing a selection of a configurable threshold to be applied to a change in the value of the metric; and

displaying an indicator in the graphical interface indicating if the change in the value of the metric exceeds the threshold.

7. The computer-implemented method of claim 1 wherein the metric is selected from a list of predetermined metrics displayed in the graphical interface.

8. The computer-implemented method of claim 1 wherein the metric is customizable.

9. The computer-implemented method of claim 1 wherein the metric is related to security events in an environment.

10. The computer-implemented method of claim 1 further comprising displaying a drill down view of the machine data underlying the value of the selected metric upon selection using an input device of the computer system.

11. The computer-implemented method of claim 1 wherein the received machine data is processed into events of unstructured data and stored as time stamped events in a time series data store accessible via search queries generated based on the metric.

12. A system comprising:

a processor; and

a memory coupled with the processor;

a communications interface adapted to receive machine data in real time from one or more sources;

an execution unit configured to receive a selection of a configurable metric and to calculate a value corresponding to the metric over a configurable time period; and

a graphical interface for displaying the metric and corresponding value along with real time information relating to the metric and its value.

13. The system of claim 12 further comprising a time series data store in communication with the processor, the time series data store configured to receive machine data processed into time stamped events of unstructured data that are accessible via search queries based on the selected metric.

14. The system of claim 12 wherein the value of the metric is updated continuously in real time based on receiving additional real-time data at the computer interface and displayed in response thereto as time progresses.

15. The system of claim 12 wherein the graphical interface is further adapted to display statistical trends in the value of the metric over the configurable time period.

16. The system of claim 12 further comprising:

a threshold module configured to;

receive a selection of a configurable threshold to be applied to the value of the metric;

determine if the value of the metric exceeds the threshold; and

display an indicator in the graphical interface indicating if the value of the metric exceeds the threshold.

17. The system of claim 12 further comprising:

a threshold module configured to;

receive a selection of a configurable threshold to be applied to a change in the value of the metric;

determine if the change in the value of the metric exceeds the threshold; and

displaying an indicator in the graphical interface indicating if the change in the value of the metric exceeds the threshold.

18. The system of claim 12 wherein the metric is selected from a list of predetermined metrics displayed in the graphical interface.

19. The system of claim 12 wherein the metric is customizable.

20. The system of claim 12 wherein the metric is related to security events in an environment.

21. The system of claim 12 wherein the graphical display is further adapted to display a drill down view of the machine data underlying the value of the selected metric upon selection using an input device of the computer system.