CORRELATION FOR USER-SELECTED TIME RANGES OF VALUES FOR PERFORMANCE METRICS OF COMPONENTS IN AN INFORMATION-TECHNOLOGY ENVIRONMENT WITH LOG DATA FROM THAT INFORMATION-TECHNOLOGY ENVIRONMENT

• US 20140324862A1
• Filed: 01/29/2014
• Published: 10/30/2014
• Est. Priority Date: 04/30/2013
• Status: Abandoned Application

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: FLETCHER, Tristan, BINGHAM, Brian, BHIDE, Alok
• Application Number:
  US14/167,316
• Publication Number:
  US 20140324862A1
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 2201/815 Virtual
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors

Abstract

Methods and computer-program products are provided for storing a set of performance measurements relating to performance of a component in an IT environment, and associating with the performance measurement a time at which the performance measurement was obtained for each performance measurement in the set of performance measurements. The methods and computer-program products include storing portions of log data produced by the IT environment, wherein each portion of log data has an associated time; providing a graphical user interface enabling selection of a time range; and receiving through the graphical user interface a selection of a time range. The methods and computer-program products further comprise retrieving one or more performance measurements, wherein each of the retrieved performance measurements has an associated time in the selected time range; retrieving one or more portions of log data, wherein each of the retrieved portions of log data has an associated time in the selected time range; displaying an indication of the retrieved performance measurements having their associated times in the selected time range; and displaying an indication of the retrieved portions of log data having their associated times in the selected time range.

Claims

1. A computer-implemented method, comprising:

storing a set of performance measurements relating to performance of a component in an IT environment;

for each performance measurement in the set of performance measurements, associating with the performance measurement a time at which the performance measurement was obtained;

storing portions of log data obtained from log files produced by one or more hosts in the IT environment, wherein each portion of log data has an associated time;

providing a graphical user interface enabling selection of a time range;

receiving through the graphical user interface a selection of a time range;

retrieving one or more performance measurements, wherein each of the retrieved performance measurements has an associated time in the selected time range;

retrieving one or more portions of log data, wherein each of the retrieved portions of log data has an associated time in the selected time range;

displaying an indication of the retrieved performance measurements having their associated times in the selected time range; and

displaying an indication of the retrieved portions of log data having their associated times in the selected time range.

2. The method of claim 1, wherein the displayed indication of the retrieved performance measurements are displayed concurrently with the displayed indication of the retrieved portions of log data.

3. The method of claim 1, wherein the displayed indication of the retrieved performance measurements are displayed at a different time than the displayed indication of the retrieved portions of log data.

4. The method of claim 1, wherein the displayed indication of the retrieved performance measurements are displayed in a same window as the displayed indication of the retrieved portions of log data.

5. The method of claim 1, wherein the displayed indication of the retrieved performance measurements are displayed in a different window than the displayed indication of the retrieved portions of log data.

6. The method of claim 1, wherein each of the portions of log data is stored as a searchable event associated with a time stamp, and wherein the time stamp for an event that includes a given portion of log data includes the associated time for that portion of log data.

7. The method of claim 1, wherein each performance measurement is stored as a searchable event associated with a time stamp, and wherein the time stamp for an event that includes a given performance measurement includes the associated time at which the performance measurement was obtained.

8. The method of claim 1, wherein each of the portions of log data is stored as a searchable event associated with a time stamp;

wherein the time stamp for an event that includes a given portion of log data includes the associated time for that portion of log data;

wherein each performance measurement is stored as a searchable event associated with a time stamp; and

wherein the time stamp for an event that includes a given performance measurement includes the associated time at which the performance measurement was obtained.

9. The method of claim 1, further comprising receiving through the graphical user interface a selection of a type of performance measurement, and wherein retrieving the one or more performance measurements includes retrieving performance measurements of the selected type.

10. The method of claim 1, wherein the component includes a host.

11. The method of claim 1, wherein the component includes a cluster.

12. The method of claim 1, wherein the component includes a virtual machine.

13. The method of claim 1, wherein the retrieved one or more performance measurements and the retrieved one or more portions of log data relate to a same host.

14. The method of claim 1, wherein the retrieved one or more performance measurements relate to a cluster, and wherein the log data relates to a host in that cluster.

15. The method of claim 1, wherein the retrieved one or more performance measurements relate to a virtual machine, and wherein the log data relates to a host on which that virtual machine has run.

16. The method of claim 1, further comprising receiving through the graphical user interface a selection of a component, and wherein the retrieved one or more performance measurements and the retrieved one or more portions of log data relate to the same selected component.

17. The method of claim 1, wherein the performance measurements are obtained through an application programming interface (API) before being stored.

18. The method of claim 1, wherein the performance measurements are determined without reference to log data.

19. The method of claim 1, wherein the performance measurements are determined by direct observation of performance of the component.

20. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to:

store a set of performance measurements relating to performance of a component in an IT environment;

for each performance measurement in the set of performance measurements, associate with the performance measurement a time at which the performance measurement was obtained;

store portions of log data obtained from log files produced by one or more hosts in the IT environment, wherein each portion of log data has an associated time;

provide a graphical user interface enabling selection of a time range;

receive through the graphical user interface a selection of a time range;

retrieve one or more performance measurements, wherein each of the retrieved performance measurements has an associated time in the selected time range;

retrieve one or more portions of log data, wherein each of the retrieved portions of log data has an associated time in the selected time range;

display an indication of the retrieved performance measurements having their associated times in the selected time range; and

display an indication of the retrieved portions of log data having their associated times in the selected time range.