Thresholds for key performance indicators derived from machine data

• US 9,208,463 B1
• Filed: 10/30/2014
• Issued: 12/08/2015
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Bhide, Alok Anant, Fletcher, Tristan Antonio, Bingham, Brian John, Reyes, Brian
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/528,894
• Time in Patent Office: 404 Days
• Field of Search: 709/203, 709223-229, 709/250, 709213-214
• US Class Current: 1/1
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, identifying information for locating machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.

Claims

1. A method comprising:

accessing from stored memory a service definition for a service provided by one or more entities that each produce machine data or one or more entities about which machine data is generated, the service definition identifying the one or more entities that provide the service and, for each entity, identifying information for locating the machine data pertaining to that entity;

accessing from stored memory at least one key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to the one or more entities identified in the service definition for the service, the value indicative of how the service is performing at a point in time or during a period of time, the value indicating one of a plurality of states of the KPI;

causing display of a graphical interface enabling a user to set at least one threshold for the KPI, each threshold defining an end of a range of values representing a state of the plurality of states of the KPI;

receiving through the graphical interface an indication of the at least one threshold for the KPI and recording, in accordance with the indication, the at least one threshold in stored memory in association with the KPI; and

determining one of the plurality of states for the KPI in view of the at least one threshold, comprising automatically performing the search query for the KPI in accordance with a monitoring frequency, thereby making a transformation from machine data to derived KPI value;

wherein the method is performed by a computer system comprising one or more processing devices coupled to the stored memory of the service definition, the KPI, and the at least one threshold.

2. The method of claim 1, wherein performing the search query comprises using the information for locating the machine data pertaining to that entity to derive the value produced by the search query of the KPI.

3. The method of claim 1, wherein receiving through the graphical interface the indication of the at least one threshold comprises:

receiving, for each threshold, a value representing a minimum end of a range of values for a corresponding state of the KPI.

4. The method of claim 1, wherein receiving through the graphical interface the indication of the at least one threshold comprises:

receiving, for each threshold, a value representing a minimum end of a range of values for a corresponding state of the KPI, wherein a maximum end of the range of values for the corresponding state is either a preset value or is defined by a minimum end of a range of values of a succeeding state of the KPI.

5. The method of claim 1, wherein receiving through the graphical interface the indication of the at least one threshold comprises:

receiving, for each threshold, a name for a corresponding state of the KPI through the graphical interface; and

associating the received name with a corresponding threshold in stored memory.

6. The method of claim 1, wherein receiving through the graphical interface the indication of the at least one threshold comprises:

causing for display, for each threshold, a plurality of visual indicators;

receiving a selection, for each threshold, of at least one of the plurality of visual indicators, the selected visual indicator to represent a corresponding state of the KPI; and

associating the selected visual indicator with a corresponding threshold in stored memory.

7. The method of claim 1, wherein the graphical interface displays one or more pre-defined states for the KPI, wherein each predefined state is associated with at least one of a pre-defined name, a pre-defined value representing a minimum end of a range of values, and a predefined visual indicator.

8. The method of claim 1, wherein receiving through the graphical interface the indication of the at least one threshold comprises:

receiving, for each threshold, a value representing a minimum end of a range of values for a corresponding state of the KPI and a visual indicator representing the corresponding state of the KPI, wherein a maximum end of the range of values for the corresponding state is either a preset value or is based on the minimum end of the range of values of a subsequent state of the KPI; and

causing display of an element including sections that represent different states of the KPI, wherein an appearance of each section is based on a visual indicator of a corresponding state, and wherein a size of each section is defined by the minimum end and the maximum end of the range of values of the corresponding state.

9. The method of claim 1, further comprising:

receiving, for the at least one KPI, through the graphical interface, a maximum value and a minimum value defining a scale for a widget representing the respective KPI.

10. The method of claim 1, wherein receiving through the graphical interface an indication of the at least one threshold comprises:

enabling the user, through the graphical interface, to indicate application of the at least one threshold to a particular KPI of the service or an aggregate of a plurality of KPIs of the service.

11. The method of claim 1, further comprising:

creating one or more entity definitions that each associate one of the one or more entities with machine data pertaining to that entity.

12. The method of claim 1, wherein the machine data pertaining to a particular entity includes machine data produced by the entity or about the entity.

13. The method of claim 1, wherein the machine data pertaining to a particular entity is derived from different sources.

14. The method of claim 1, wherein the machine data pertaining to a particular entity includes data in different formats.

15. The method of claim 1, wherein the machine data pertaining to a particular entity includes log data produced by the entity.

16. The method of claim 1, wherein the machine data pertaining to a particular entity is obtained through an application programming interface (API) from software that monitors the performance of the entity.

17. The method of claim 1, wherein the machine data pertaining to a particular entity is derived from network packet data that referenced the entity.

18. The method of claim 1, wherein the machine data pertaining to a particular entity is represented as events comprising a portion of raw data.

19. The method of claim 1, wherein the machine data pertaining to a particular entity is represented as events comprising a portion of raw data, and

wherein the information for locating the machine data pertaining to that entity associates the events with the particular entity using field criteria for one or more fields extractable from the portion of raw data.

20. The method of claim 1, wherein the one or more entities include at least one of a host machine, a virtual machine, a switch, a firewall, a router, or a sensor.

21. The method of claim 1, wherein the one or more entities comprise a component of an information technology environment.

22. The method of claim 1, wherein the service definition includes an indication that the service is dependent on another service having a respective service definition in stored memory.

23. The method of claim 1, wherein the search query defining a corresponding KPI relies upon a data model.

24. The method of claim 1, wherein the value for the KPI is based at least in part on a value extracted from a field in events representing the machine data.

25. The method of claim 1, wherein the value for the KPI is derived from the machine data by calculating a statistic.

26. The method of claim 1, wherein the value for the KPI is derived from the machine data by counting a number of results satisfying criteria included in the search query.

27. The method of claim 1, wherein the value for the KPI is derived at least in part from a value extracted from the machine data using a late-binding schema.

28. A system comprising:

a memory; and

a processing device coupled with the memory to;

access from the memory a service definition for a service provided by one or more entities that each produce machine data or one or more entities about which machine data is generated, the service definition identifying the one or more entities that provide the service and, for each entity, identifying information for locating the machine data pertaining to that entity;

access from the memory at least one key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to the one or more entities identified in the service definition for the service, the value indicative of how the service is performing at a point in time or during a period of time, the value indicating one of a plurality of states of the KPI;

cause display of a graphical interface enabling a user to set at least one threshold for the KPI, each threshold defining an end of a range of values representing a state of the plurality of states of the KPI; and

receive through the graphical interface an indication of the at least one threshold for the KPI and store in the memory, in accordance with the indication, the at least one threshold in association with the KPI; and

determine one of the plurality of states for the KPI in view of the at least one threshold, comprising to automatically perform the search query for the KPI in accordance with a monitoring frequency, thereby to make a transformation from machine data to derived KPI value.

29. The system of claim 28, wherein to perform the search comprises using the information for locating the machine data pertaining to that entity to derive the value produced by the search query of the KPI.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

accessing from stored memory a service definition for a service provided by one or more entities that each produce machine data or one or more entities about which machine data is generated, the service definition identifying the one or more entities that provide the service and, for each entity, identifying information for locating the machine data pertaining to that entity;

accessing from stored memory at least one key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to the one or more entities identified in the service definition for the service, the value indicative of how the service is performing at a point in time or during a period of time, the value indicating one of a plurality of states of the KPI;

causing display of a graphical interface enabling a user to set at least one threshold for the KPI, each threshold defining an end of a range of values representing a state of the plurality of states of the KPI; and

receiving through the graphical interface an indication of the at least one threshold for the KPI and recording, in accordance with the indication, the at least one threshold in stored memory in association with the KPI; and

determining one of the plurality of states for the KPI in view of the at least one threshold, comprising automatically performing the search query for the KPI in accordance with a monitoring frequency, thereby making a transformation from machine data to derived KPI value;

wherein the operations are performed by a computer system comprising the one or more processing devices coupled to the stored memory of the service definition, the KPI, and the at least one threshold.