Topology navigator for IT services

• US 9,491,059 B2
• Filed: 07/15/2015
• Issued: 11/08/2016
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Fletcher, Tristan Antonio, Bhide, Alok Anant, Sharp, Clint
• Primary Examiner(s): MIRZA, ADNAN M
• Application Number:
  US14/800,675
• Publication Number:
  US 20160105325A1
• Time in Patent Office: 482 Days
• Field of Search: 709/223, 709/224
• US Class Current: 1/1
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5006 Creating or negotiating SLA contracts, guarantees or penalties
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/562 Brokering proxy services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Techniques are disclosed for providing a topology navigator that may enable a user to view performance information for multiple IT services associated with a user'"'"'s IT environment. The topology navigator may include multiple display components for displaying information about the services. A first display component may display multiple services as a graph of interdependent service nodes and a second display component may display information about one or more of the service nodes. The topology navigator may enable a user to visually inspect the aggregate KPI (e.g., health score) of multiple services to identify dependent services that are of interest (e.g., low performance) and navigate through the services to identify dependent services that may adversely affect a service of interest to the user. In one example, the second display component may display key performance indicators (KPIs) associated with the dependent service and the user may select one or more of the KPIs to add them to another display component for further analysis.

Claims

1. A method comprising:

causing display of a plurality of service nodes and dependencies between the plurality of service nodes, a first service node being identified as an in-focus service node, wherein each service node represents one of a plurality of services that is provided by one or more entities, each entity corresponding to an entity definition having an identification of machine data from or about the entity, each service corresponding to a service definition associating the entity definitions for the entities that provide the service and having a key performance indicator (KPI) defined by a search query that derives a value indicating performance of the service from machine data identified in the associated entity definitions;

causing display of a presentation of information, the information related to a first service represented by the in-focus service node;

receiving a user selection of a second service node of the plurality of service nodes;

responsive to the user selection of the second service node, transitioning the in-focus service node identification from the first service node to the second service node, and updating the presentation of information with information related to the service represented by the second service node;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by one or more processing devices.

2. The method of claim 1, wherein each service node of the plurality of service nodes comprises a visual attribute indicating a value of an aggregate key performance indicator (KPI) characterizing a health of a respective service at a point in time or during a period of time.

3. The method of claim 1, wherein each service node of the plurality of service nodes indicates a value of an aggregate KPI, wherein the value of the aggregate KPI is calculated in view of multiple KPI values, each of the multiple KPI values derived by executing a search query associated with the respective KPI.

4. The method of claim 1, wherein the presentation of information comprises multiple key performance indicators (KPIs) associated with the first service represented by the in-focus service node.

5. The method of claim 1, wherein the presentation of information comprises multiple spark line widgets and each spark line widget comprises a graph of a KPI associated with the first service represented by the in-focus service node.

6. The method of claim 1, further comprising:

receiving user input identifying the first service and in accordance with the user input performing the causing display of the plurality of service nodes and the causing display of the presentation of information.

7. The method of claim 1, further comprising:

causing display of multiple time-based graphical visualizations corresponding to multiple KPIs.

8. The method of claim 1, further comprising:

receiving a user selection identifying a KPI within the presentation of information; and

in response to the user selection, causing display of a time-based graphical visualization of the KPI.

9. The method of claim 1, wherein the presentation of information comprises a static graph of a KPI and a time-based graphical visualization of the KPI that periodically updates.

10. The method of claim 1, wherein the in-focus service node includes a visual attribute that distinguishes the in-focus service node from other service nodes, wherein the visual attribute comprises a halo around the in-focus service node.

11. The method of claim 1, wherein a service node of the plurality of service nodes comprises a visual attribute that indicates an initial in-focus service node, wherein the initial in-focus service node is a service node that is in-focus when initially causing display of the service nodes.

12. The method of claim 1, further comprising causing display of an interactive element enabling a user to transition a focus from the in-focus service node back to an initial in-focus service node.

13. The method of claim 1, wherein transitioning of the in-focus service node identification from the first service node to the second service node comprises repositioning the second service node to a middle of the display of a plurality of service nodes and modifying the second service node to indicate an in-focus visualization.

14. The method of claim 1, wherein a position of each service node relative to the in-focus service node indicates a direction of a dependency between the first service represented by the in-focus service node and a service represented by a respective service node.

15. The method of claim 1, wherein a third service node is positioned above the in-focus service node to indicate that the first service represented by the in-focus service node is dependent upon a service represented by the third service node and a fourth service node is positioned below the in-focus service node to indicate a service represented by the fourth service node is dependent upon the first service represented by the in-focus service node.

16. The method of claim 1, wherein causing display of the plurality of service nodes and dependencies between the plurality of service nodes comprises causing for display multiple levels of interconnected service nodes, wherein a first level comprises service nodes representing services that depend upon the first service represented by the in-focus service node, a second level comprises the in-focus service node, and a third level comprises service nodes representing services that the first service represented by the in-focus service node depends upon.

17. The method of claim 1, wherein causing display of the plurality of service nodes comprises displaying a connected graph of service nodes, wherein the connected graph is limited to service nodes within a distance of one from the in-focus service node.

18. The method of claim 1, wherein the information related to the first service represented by the in-focus service node further comprises historical KPI selections associated with the first service represented by the in-focus service node.

19. The method of claim 1, further comprising:

determining the dependencies between the plurality of service nodes by analyzing a service definition associated with the first service represented by the in-focus service node.

20. A system comprising:

a memory; and

a processing device coupled with the memory to;

causing display of a plurality of service nodes and dependencies between the plurality of service nodes, a first service node being identified as an in-focus service node, wherein each service node represents one of a plurality of services that is provided by one or more entities, each entity corresponding to an entity definition having an identification of machine data from or about the entity, each service corresponding to a service definition associating the entity definitions for the entities that provide the service and having a key performance indicator (KPI) defined by a search query that derives a value indicating performance of the service from machine data identified in the associated entity definitions; and

causing display of a presentation of information, the information related to a first service represented by the in-focus service node;

receive a user selection of a second service node of the plurality of service nodes;

transition the in-focus service node identification from the first service node to the second service node responsive to the user selection of the second service node, and updating the presentation of information with information related to the service represented by the second service node; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

21. The system of claim 20, wherein each service node of the plurality of service nodes comprises a visual attribute indicating a value of an aggregate key performance indicator (KPI) characterizing a health of a respective service at a point in time or during a period of time.

22. The system of claim 20, wherein each service node of the plurality of service nodes indicates a value of an aggregate KPI, wherein the value of the aggregate KPI is calculated in view of multiple KPI values, each of the multiple KPI values derived by executing a search query associated with the respective KPI.

23. The system of claim 20, wherein the presentation of information comprises multiple key performance indicators (KPIs) associated with the first service represented by the in-focus service node.

24. The system of claim 20, wherein the presentation of information comprises multiple spark line widgets and each spark line widget comprises a graph of a KPI associated with the first service represented by the in-focus service node.

25. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

causing display of a plurality of service nodes and dependencies between the plurality of service nodes, a first service node being identified as an in-focus service node, wherein each service node represents one of a plurality of services that is provided by one or more entities, each entity corresponding to an entity definition having an identification of machine data from or about the entity, each service corresponding to a service definition associating the entity definitions for the entities that provide the service and having a key performance indicator (KPI) defined by a search query that derives a value indicating performance of the service from machine data identified in the associated entity definitions;

causing display of a presentation of information, the information related to a first service represented by the in-focus service node;

receiving a user selection of a second service node of the plurality of service nodes;

responsive to the user selection of the second service node, transitioning the in-focus service node identification from the first service node to the second service node, and updating the presentation of information with information related to the service represented by the second service node; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

26. The non-transitory computer readable storage medium of claim 25, wherein each service node of the plurality of service nodes comprises a visual attribute indicating a value of an aggregate key performance indicator (KPI) characterizing a health of a respective service at a point in time or during a period of time.

27. The non-transitory computer readable storage medium of claim 25, wherein each service node of the plurality of service nodes indicates a value of an aggregate KPI, wherein the value of the aggregate KPI is calculated in view of multiple KPI values, each of the multiple KPI values derived by executing a search query associated with the respective KPI.

28. The non-transitory computer readable storage medium of claim 25, wherein the presentation of information comprises multiple key performance indicators (KPIs) associated with the first service represented by the in-focus service node.

29. The non-transitory computer readable storage medium of claim 25, wherein the presentation of information comprises multiple spark line widgets and each spark line widget comprises a graph of a KPI associated with the first service represented by the in-focus service node.