Service monitoring interface

• US 9,210,056 B1
• Filed: 01/31/2015
• Issued: 12/08/2015
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Choudhary, Hemendra Singh, Fletcher, Tristan Antonio, Bhide, Alok Anant, Hsiao, Fang I.
• Primary Examiner(s): Lin, Wen-Tai
• Application Number:
  US14/611,216
• Time in Patent Office: 311 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

One or more processing devices cause display of a service-monitoring page having a services summary region and a services aspects region. The services summary region contains an ordered plurality of interactive summary tiles, each summary tile corresponding to a respective service and providing a character or graphical representation of at least one value for an aggregate key performance indicator (KPI) characterizing the respective service as a whole. The services aspects region contains an ordered plurality of interactive aspect tiles, each aspect tile corresponding to a respective aspect KPI and providing a character or graphical representation of one or more values for the respective aspect KPI, each aspect KPI having an associated service and typifying performance for an aspect of the associated service. Each KPI is associated with a service having a service definition, each service definition has one or more entity definitions, each entity definition having information to identity machine data related to the entity, each KPI has a definition including a search query that produces a value derived from machine data identified using one or more of the entity definitions included in the service definition, and each value is indicative of how the service in whole or part is performing at a point in time or during a period of time.

Claims

1. A method, comprising:

causing display of a service-monitoring page having;

a services summary region containing an ordered plurality of interactive summary tiles, each summary tile corresponding to a respective service and providing a character or graphical representation of at least one value for an aggregate key performance indicator (KPI) characterizing the respective service as a whole,

a services aspects region containing an ordered plurality of interactive aspect tiles, each aspect tile corresponding to a respective aspect KPI and providing a character or graphical representation of one or more values for the respective aspect KPI, each aspect KPI having an associated service and typifying performance for an aspect of the associated service;

wherein each KPI is associated with a service provided by one or more entities, the service having a stored service definition, the service definition associating a stored entity definition for each of the entities, each entity definition having information to identity machine data pertaining to the respective entity from one or more sources, each KPI defined by a search query that produces a value derived from machine data identified in the entity definitions and by reference to a late-binding schema specifying how to extract information from the machine data at the time of the search query, each value indicative of how the service in whole or part is performing at a point in time or during a period of time;

wherein the machine data comprises events in an event data store, each event having a segment of raw data, said raw data comprising machine data collected directly from a plurality of machines without regard to the stored service definitions; and

wherein the method is performed by one or more processing devices.

2. The method of claim 1, wherein the correspondence between each summary tile and a respective service is based upon the position of the summary tile in the ordered plurality and the position of the aggregate KPI characterizing the respective service in a determined aggregate KPI order.

3. The method of claim 1, wherein the correspondence between each summary tile and a respective service is based upon the position of the summary tile in the ordered plurality of interactive summary tiles, and upon the position of the aggregate KPI characterizing the respective service in a determined aggregate KPI order, wherein the determined aggregate KPI order is determined in part using a state associated with each of one or more aggregate KPI'"'"'s represented in the determined aggregate KPI order.

4. The method of claim 1, wherein the correspondence between each summary tile and a respective service is based upon the position of the summary tile in the ordered plurality of interactive summary tiles, and upon the position of the aggregate KPI characterizing the respective service in a determined aggregate KPI order, wherein the determined aggregate KPI order is determined in part using a state associated with each of one or more aggregate KPI'"'"'s represented in the determined aggregate KPI order, wherein the state is determined using a threshold corresponding to a range of values for the state.

5. The method of claim 1, further comprising:

monitoring for an expiration of a refresh interval and repeating the causing display of the service-monitoring page in response to the expiration.

6. The method of claim 1, further comprising:

monitoring for an expiration of a refresh interval and repeating the causing display of the service-monitoring page in response to the expiration, and wherein the repeating the causing display of the service-monitoring page includes causing the execution of the search query defining at least one aspect KPI or aggregate KPI.

7. The method of claim 1, wherein at least one of the ordered plurality of interactive summary tiles displays a visual indication of a state indicated by a value for the aggregate KPI.

8. The method of claim 1, wherein at least one of the ordered plurality of interactive summary tiles displays a visual indication of a state indicated by a value for the aggregate KPI, wherein the indicated state is determined using a threshold corresponding to a range of values for the indicated state.

9. The method of claim 1, wherein at least one of the ordered plurality of interactive summary tiles displays a background color indicative of a state indicated by a value for the aggregate KPI.

10. The method of claim 1, wherein at least one of the ordered plurality of interactive summary tiles displays a background color indicative of a state indicated by a value for the aggregate KPI, wherein the indicated state is determined using a threshold corresponding to a range of values for the indicated state.

11. The method of claim 1, wherein causing display of the service-monitoring page includes causing display of the service monitoring page in a first display mode wherein the plurality of interactive summary tiles are larger than when displayed in a second display mode.

12. The method of claim 1, the service monitoring page further having a notable events region containing an indication of one or more correlation searches that generate notable events.

13. The method of claim 1, the service monitoring page further having a notable events region containing an indication of one or more correlation searches that generate notable events, wherein the one or more correlation searches are chosen from among a group of correlations searches based on having generated the highest counts of notable events in a given period of time.

14. The method of claim 1, the service monitoring page further having a notable events region containing an indication for each of one or more correlation searches that generate notable events, wherein the indication for at least one of the correlation searches is interactive to enable a user to direct navigation toward a graphical user interface (GUI) displaying information related to the respective correlation search.

15. The method of claim 1, wherein at least one of the summary tiles includes an indication of an identifier for the service corresponding to the summary tile.

16. The method of claim 1, wherein at least one of the summary tiles includes an indication of an identifier for the service corresponding to the summary tile, and an indication of the state of the service corresponding to the summary tile.

17. The method of claim 1, wherein at least one of the summary tiles includes an indication of an identifier for the service corresponding to the summary tile, and an indication of the state of the service corresponding to the summary tile, and an indication of the value of the aggregate KPI over time.

18. The method of claim 1, further comprising:

causing display of a modified service-monitoring GUI page in response to receiving user input directing transition to a selection mode, the modified service monitoring GUI page enabling a user to indicate the selection of multiple aspect KPI'"'"'s by interaction with the aspect tiles corresponding to the multiple aspect KPI'"'"'s, wherein the causing display of a modified service-monitoring GUI page causes a change in appearance of the plurality of interactive aspect tiles.

19. The method of claim 1, further comprising:

causing display of a modified service-monitoring GUI page in response to receiving user input directing transition to a selection mode, the modified service monitoring GUI page enabling a user to indicate the selection of multiple aspect KPI'"'"'s by interaction with the aspect tiles corresponding to the multiple aspect KPI'"'"'s, wherein the causing display of a modified service-monitoring GUI page causes a change in appearance of the plurality of interactive aspect tiles by an increase in the interstitial space or by including a selection indicator GUI element in each tile.

20. The method of claim 1, further comprising:

causing display of a modified service-monitoring GUI page in response to receiving user input directing transition to a selection mode, the modified service monitoring GUI page enabling a user to indicate the selection of multiple aspect KPI'"'"'s by interaction with the aspect tiles corresponding to the multiple aspect KPI'"'"'s, and wherein a user indication of selection for a particular aspect KPI causes a visual indication of the selection in the aspect tile associated with the particular aspect KPI.

21. The method of claim 1, further comprising:

causing display of a modified service-monitoring GUI page in response to receiving user input directing transition to a selection mode, the modified service monitoring GUI page enabling a user to indicate a selection of multiple aspect KPI'"'"'s by interaction with the aspect tiles corresponding to the multiple aspect KPI'"'"'s, and enabling the user to direct navigation toward a first GUI displaying values for the indicated selection of multiple aspect KPI'"'"'s; and

causing display of a first GUI displaying values for the indicated selection of multiple aspect KPI'"'"'s, the values for each of indicated multiple aspect KPI'"'"'s displaying as a graphical visualization along a time-based graph lane associated with the respective KPI.

22. The method of claim 1, wherein the services summary region further contains a bar gauge indicating a distribution among one or more states of aggregate KPI'"'"'s for a first plurality of services, each aggregate KPI characterizing its associated service as a whole.

23. The method of claim 1, wherein the services summary region further contains a bar gauge indicating a distribution among one or more states of aggregate KPI'"'"'s for a first plurality of services, each aggregate KPI characterizing its associated service as a whole, the bar gauge comprising one or more portions, each portion corresponding to a respective one of the one or more states, and each portion displaying a visual attribute differently from each of the other portions.

24. The method of claim 1, wherein the services summary region further contains a bar gauge indicating a distribution among one or more states of aggregate KPI'"'"'s for a first plurality of services, each aggregate KPI characterizing its associated service as a whole, the bar gauge comprising one or more portions, each portion corresponding to a respective one of the one or more states, and each portion displaying a visual attribute differently from each of the other portions, wherein the visual attribute is color.

25. The method of claim 1, wherein the services summary region further contains a bar gauge indicating a distribution among one or more states of aggregate KPI'"'"'s for a first plurality of services, each aggregate KPI characterizing its associated service as a whole, wherein the first plurality of services includes each service having a service definition in a service monitoring system.

26. The method of claim 1, wherein one or more of the interactive aspect tiles enable a user to direct navigation toward a first graphical user interface displaying a graphical visualization of first KPI values along a time-based graph lane, wherein the first KPI values are values for the aspect KPI corresponding to the respective tile.

27. The method of claim 1, wherein one or more of the interactive aspect tiles enable a user to direct navigation toward a first graphical user interface displaying values for a plurality of KPI'"'"'s, the values for each of the plurality of KPI'"'"'s displayed as a graphical visualization along a time-based graph lane associated with the respective KPI, wherein the aspect KPI corresponding to the respective tile is among the plurality of KPI'"'"'s, and wherein each of one or more KPI'"'"'s of the service monitoring system associated with the same service as the aspect KPI are among the plurality of KPI'"'"'s.

28. The method of claim 1, wherein the aspect KPI'"'"'s, each corresponding to a respective aspect tile of the ordered plurality of interactive aspect tiles, are determined, at least in part, using a severity for each aspect KPI, the severity for each aspect KPI indicated by a value for the respective aspect KPI.

29. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of a service-monitoring page having;

a services summary region containing an ordered plurality of interactive summary tiles, each summary tile corresponding to a respective service and providing a character or graphical representation of at least one value for an aggregate key performance indicator (KPI) characterizing the respective service as a whole,

a services aspects region containing an ordered plurality of interactive aspect tiles, each aspect tile corresponding to a respective aspect KPI and providing a character or graphical representation of one or more values for the respective aspect KPI, each aspect KPI having an associated service and typifying performance for an aspect of the associated service;

wherein each KPI is associated with a service provided by one or more entities, the service having a stored service definition, the service definition associating a stored entity definition for each of the entities, each entity definition having information to identity machine data pertaining to the respective entity from one or more sources, each KPI defined by a search query that produces a value derived from machine data identified in the entity definitions and by reference to a late-binding schema specifying how to extract information from the machine data at the time of the search query, each value indicative of how the service in whole or part is performing at a point in time or during a period of time; and

wherein the machine data comprises events in an event data store, each event having a segment of raw data, said raw data comprising machine data collected directly from a plurality of machines without regard to the stored service definitions.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of a service-monitoring page having;

a services summary region containing an ordered plurality of interactive summary tiles, each summary tile corresponding to a respective service and providing a character or graphical representation of at least one value for an aggregate key performance indicator (KPI) characterizing the respective service as a whole,

a services aspects region containing an ordered plurality of interactive aspect tiles, each aspect tile corresponding to a respective aspect KPI and providing a character or graphical representation of one or more values for the respective aspect KPI, each aspect KPI having an associated service and typifying performance for an aspect of the associated service;

wherein each KPI is associated with a service provided by one or more entities, the service having a stored service definition, the service definition associating a stored entity definition for each of the entities, each entity definition having information to identity machine data pertaining to the respective entity from one or more sources, each KPI defined by a search query that produces a value derived from machine data identified in the entity definitions and by reference to a late-binding schema specifying how to extract information from the machine data at the time of the search query, each value indicative of how the service in whole or part is performing at a point in time or during a period of time; and

wherein the machine data comprises events in an event data store, each event having a segment of raw data, said raw data comprising machine data collected directly from a plurality of machines without regard to the stored service definitions.