Defining a graphical visualization along a time-based graph lane using key performance indicators derived from machine data

• US 9,128,995 B1
• Filed: 10/30/2014
• Issued: 09/08/2015
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Fletcher, Tristan Antonio, Bhide, Alok Anant
• Primary Examiner(s): Mamillapalli, Pavan
• Application Number:
  US14/528,978
• Time in Patent Office: 313 Days
• Field of Search: 707/722
• US Class Current: 1/1
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

A service monitoring system receives a selection of key performance indicators (KPIs) that each indicate a different aspect of how a service provided by one or more entities is performing. Each entity of the one or more entities produces machine data or wherein each entity has its operation reflected in machine data not produced by the entity. Each KPI is defined by a different search query that derives one or more values from the machine data pertaining to the one or more entities providing the service, where each of the one or more values is associated with a point in time and representing the aspect of how the service is performing at the associated point in time. For each of the selected KPIs, the service monitoring system derives the one or more values and causes display of a graphical visualization of the derived one or more values for the KPI along a time-based graph lane. The graph lanes for the selected KPIs are parallel to each other and the graphical visualizations in the graph lanes are all calibrated to a same time scale.

Claims

1. A method, comprising:

receiving a selection of key performance indicators (KPIs) that each indicate a different aspect of how a service provided by one or more entities is performing, wherein each entity of the one or more entities produces machine data or wherein each entity has its operation reflected in machine data not produced by the entity, wherein a stored entity definition records an association between each entity and its associated machine data, wherein a stored service definition associates the one or more entities that provide the service, wherein each KPI is defined by a different search query that derives one or more values from the machine data associated with the one or more entities providing the service, wherein each of the one or more values is associated with a point in time and represents the aspect of how the service is performing at the associated point in time, and wherein the machine data comprises unstructured raw machine data; and

for each of the selected KPIs;

deriving the one or more values; and

causing display of a graphical visualization of the derived one or more values for the KPI along a time-based graph lane, wherein the graph lanes for the selected KPIs are parallel to each other, and wherein the graphical visualizations in the graph lanes are all calibrated to a same time scale;

wherein the method is performed by one or more processing devices.

2. The method of claim 1, further comprising:

causing display of a timeline representing the time scale in parallel to the graph lanes.

3. The method of claim 1, wherein the graphical visualizations in the graph lanes all cover a same time range.

4. The method of claim 1, wherein the associated machine data for at least one entity comes from at least two different sources.

5. The method of claim 1, further comprising:

receiving through a graphical interface a selection of a time range for the graphical visualizations in the graph lanes.

6. The method of claim 1, wherein a time range covered by the graphical visualizations in the graph comprises a fixed period of time.

7. The method of claim 1, wherein a time range covered by the graphical visualizations in the graph comprises a rolling period of time of a set length.

8. The method of claim 1, wherein at least one of the graphical visualizations includes a line graph.

9. The method of claim 1, wherein at least one of the graphical visualizations includes an area graph.

10. The method of claim 1, wherein at least one of the graphical visualizations includes a bar chart.

11. The method of claim 1, wherein at least one of the graphical visualizations includes a heat map.

12. The method of claim 1, further comprising:

causing display of a graphical interface for selecting, from a plurality of options, a graph style for at least one of the graphical visualizations;

receiving a selection of a graph style for the at least one of the graphical visualizations; and

causing display of the at least one of the graphical visualizations in the selected graph style.

13. The method of claim 1, further comprising:

causing display, in association with a particular graph lane, a graphical interface for selecting, from a plurality of options, a graph style for displaying the graphical visualization in the associated graph lane.

14. The method of claim 1, further comprising:

receiving, through a graphical interface, a selection of a time range for the graphical visualizations in the graph lanes; and

receiving, through the graphical interface, a graph style selected from a plurality options for displaying at least one of the graphical visualizations.

15. The method of claim 1, wherein the KPIs are selected from a list of previously created KPIs displayed in a graphical interface.

16. The method of claim 1, wherein the KPIs are selected from KPI widgets providing a numerical or graphical representation of the one or more values for corresponding KPIs displayed on a service-monitoring dashboard.

17. The method of claim 1, wherein at least two of the selected KPIs correspond to different services.

18. The method of claim 1, wherein at least two of the selected KPIs correspond to a same service.

19. The method of claim 1, wherein the search query is sent to an event processing system for execution.

20. The method of claim 1, further comprising:

receiving, through a graphical interface, an indication of a title, a description and an access permission for the graphical visualizations.

21. The method of claim 1, further comprising:

causing display of a particular search query or an identifier of the particular search query that defines at least one of the selected KPIs;

receiving input indicating that a user wants to execute the particular search query; and

based on receiving the input, causing execution of the search query.

22. The method of claim 1, wherein the one or more values for a KPI are derived from the machine data at least in part using a late-binding schema.

23. The method of claim 1, wherein the search queries that define the selected KPIs are in a search language processed by an event processing system having a late-binding schema.

24. The method of claim 1, wherein the one or more values for a KPI are derived from time-stamped events, the time-stamped events each including at least a portion of raw machine data.

25. The method of claim 1, wherein each search query is recorded in a stored KPI definition for the KPI it defines, the KPI definition associated with the service definition for the service corresponding to that KPI.

26. The method of claim 1, wherein the search query defining at least one KPI relies upon a data model.

27. A system comprising:

a memory; and

a processing device coupled with the memory to;

receive a selection of key performance indicators (KPIs) that each indicate a different aspect of how a service provided by one or more entities is performing, wherein each entity of the one or more entities produces machine data or wherein each entity has its operation reflected in machine data not produced by the entity, wherein a stored entity definition records an association between each entity and its associated machine data, wherein a stored service definition associates the one or more entities that provide the service, wherein each KPI is defined by a different search query that derives one or more values from the machine data associated with the one or more entities providing the service, wherein each of the one or more values is associated with a point in time and represents the aspect of how the service is performing at the associated point in time, and wherein the machine data comprises unstructured raw machine data; and

for each of the selected KPIs;

derive the one or more values; and

cause display of a graphical visualization of the derived one or more values for the KPI along a time-based graph lane, wherein the graph lanes for the selected KPIs are parallel to each other, and wherein the graphical visualizations in the graph lanes are all calibrated to a same time scale.

28. The system of claim 27, the processing device further to:

receive, through a graphical interface, a selection of a time range for the graphical visualizations in the graph lanes; and

receive, through the graphical interface, a graph style selected from a plurality options for displaying at least one of the graphical visualizations.

29. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

receiving a selection of key performance indicators (KPIs) that each indicate a different aspect of how a service provided by one or more entities is performing, wherein each entity of the one or more entities produces machine data or wherein each entity has its operation reflected in machine data not produced by the entity, wherein a stored entity definition records an association between each entity and its associated machine data, wherein a stored service definition associates the one or more entities that provide the service, wherein each KPI is defined by a different search query that derives one or more values from the machine data associated with the one or more entities providing the service, wherein each of the one or more values is associated with a point in time and represents the aspect of how the service is performing at the associated point in time, and wherein the machine data comprises unstructured raw machine data; and

for each of the selected KPIs;

deriving the one or more values; and

causing display of a graphical visualization of the derived one or more values for the KPI along a time-based graph lane, wherein the graph lanes for the selected KPIs are parallel to each other, and wherein the graphical visualizations in the graph lanes are all calibrated to a same time scale;

wherein the operations are performed by the one or more processing devices.

30. The non-transitory computer readable storage medium of claim 29, wherein the operations further comprise:

receiving, through a graphical interface, a selection of a time range for the graphical visualizations in the graph lanes; and

receiving, through the graphical interface, a graph style selected from a plurality options for displaying at least one of the graphical visualizations.