Monitoring service-level performance using key performance indicators derived from machine data

• US 9,130,860 B1
• Filed: 10/30/2014
• Issued: 09/08/2015
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Boe, Brent, Bingham, Brian, Fletcher, Tristan Antonio, Coates, John Robert
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/528,858
• Time in Patent Office: 313 Days
• Field of Search: 709/203, 709223-229, 709/250
• US Class Current: 1/1
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

One or more processing devices create one or more entity definitions that each associate an entity with machine data pertaining to that entity and create a service definition for a service provided by one or more entities. The service definition includes an entity definition for each of the one or more entities. The one or more processing devices create one or more key performance indicators (KPIs). Each KPI is defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions included in the service definition. Each value is indicative of how the service is performing at a point in time or during a period of time.

Claims

1. A method, comprising:

creating and storing one or more entity definitions that each associate an entity with machine data pertaining to that entity;

creating and storing a service definition for a service provided by one or more entities, the service definition referencing a corresponding one of said entity definitions for each of the one or more entities;

creating one or more key performance indicators (KPIs), each KPI defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions referenced in the service definition, each value indicative of how the service is performing at a point in time or during a period of time;

automatically performing the search query for at least one of the KPIs in accordance with a monitoring frequency, thereby making a transformation from machine data to derived KPI value; and

wherein the method is performed by a computing system comprising one or more processing devices coupled to computer memory for storing the service definition, entity definitions, and one or more KPIs.

2. The method of claim 1, wherein automatically performing the search query for at least one of the KPIs further comprises determining different values for the KPI over different periods of time.

3. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition includes machine data produced by the entity or about the entity.

4. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition is derived from different sources.

5. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition includes data in different formats.

6. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition includes log data produced by the entity.

7. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition is obtained through an application programming interface (API) from software that monitors the performance of the entity.

8. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition is derived from network packet data that references the entity.

9. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition is represented as events comprising a portion of raw data.

10. The method of claim 1, wherein the machine data associated with a particular entity by an entity definition is represented as events comprising a portion of raw data, and

wherein the entity definition associates the events with the particular entity using field criteria for one or more fields that a search can use to locate the events.

11. The method of claim 1, wherein the entity includes at least one of a host machine, a virtual machine, a switch, a firewall, a router, or a sensor.

12. The method of claim 1, wherein the entity comprises a component of an information technology environment.

13. The method of claim 1, wherein the service definition includes an indication that the service is dependent on another service for which a service definition has been created.

14. The method of claim 1, wherein the search query defining at least one KPI relies upon a data model.

15. The method of claim 1, wherein creating one or more KPIs comprises:

causing display of identifiers for the entities that provide the service;

receiving a selection of one or more of the identifiers;

identifying the subset of entity definitions corresponding to the entities identified by the selected identifiers; and

generating the search query to derive the value for the KPI only from the machine data identified in the subset of entity definitions.

16. The method of claim 1, further comprising defining a threshold for at least one KPI.

17. The method of claim 1, wherein the value for the KPI is derived at least in part with a value extracted from a field in events representing the machine data.

18. The method of claim 1, wherein the value for the KPI is derived from the machine data by calculating a statistic.

19. The method of claim 1, wherein the value for the KPI is derived from the machine data by counting a number of results satisfying criteria included in the search query.

20. The method of claim 1, further comprising automatically identifying an entity in machine data, and wherein at least one entity definition is created in response to identifying the automatically identified entity.

21. The method of claim 1, further comprising causing display of an identifier for at least one of the KPIs in a dashboard creation screen that enables a user to position the KPI identifier to indicate where on the dashboard the corresponding KPI should appear.

22. The method of claim 1, further comprising causing display of visualizations of the one or more KPIs in parallel lanes along a timeline axis.

23. The method of claim 1, further comprising calculating an aggregate KPI from values from two or more KPIs.

24. The method of claim 1, wherein the value for the KPI is determined from a value extracted from the machine data using a late-binding schema.

25. The method of claim 1, further comprising receiving a selection of the entity definitions from a user through a graphical user interface, and wherein the entity definitions are included in the service definition in response to their selection.

26. The method of claim 1, wherein the creating and storing one or more entity definitions further comprises storing the entity definitions in a key-value store, a configuration file, a lookup file, a database, or metadata fields associated with events representing the machine data.

27. The method of claim 1, wherein creating an entity definition comprises receiving from a user an identifying name for referencing the entity definition, and wherein creating the service definition comprises receiving from a user an identifying name for referencing the service definition.

28. The method of claim 1, wherein creating the one or more KPIs comprises receiving from a user an identifying name for referencing each KPI.

29. A system comprising:

a memory; and

a processing device coupled with the memory to;

create and store one or more entity definitions that each associate an entity with machine data pertaining to that entity;

create and store a service definition for a service provided by one or more entities, the service definition referencing a corresponding one of said entity definitions for each of the one or more entities;

create one or more key performance indicators (KPIs), each KPI defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions referenced in the service definition, the value indicative of how the service is performing at a point in time or during a period of time; and

automatically perform the search query for at least one of the KPIs in accordance with a monitoring frequency, thereby making a transformation from machine data to derived KPI value.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

creating and storing one or more entity definitions that each associate an entity with machine data pertaining to that entity;

creating and storing a service definition for a service provided by one or more entities, the service definition referencing a corresponding one of said entity definitions for each of the one or more entities;

creating one or more key performance indicators (KPIs), each KPI defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions referenced in the service definition, each value indicative of how the service is performing at a point in time or during a period of time; and

automatically performing the search query for at least one of the KPIs in accordance with a monitoring frequency, thereby making a transformation from machine data to derived KPI value.