Monitoring service-level performance using key performance indicators derived from machine data

• US 9,755,912 B2
• Filed: 07/31/2015
• Issued: 09/05/2017
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Boe, Brent, Bingham, Brian, Coates, John Robert, Fletcher, Tristan Antonio
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/815,888
• Publication Number:
  US 20160103878A1
• Time in Patent Office: 767 Days
• Field of Search: 709203, 709223-229, 709250
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

One or more processing devices create one or more entity definitions that each associate an entity with machine data pertaining to that entity and create a service definition for a service provided by one or more entities. The service definition includes an entity definition for each of the one or more entities. The one or more processing devices create one or more key performance indicators (KPIs). Each KPI is defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions included in the service definition. Each value is indicative of how the service is performing at a point in time or during a period of time.

Claims

1. A method comprising:

accessing a search query from computer storage and executing the search query automatically on a repeated basis, wherein, for each execution, the search query transforms machine data to a value by deriving the value from machine data associated with one or more entities that provide a service, the value indicating a measure of performance of the service at a point in time or over a period of time; and

representing each derived value in computer storage to produce a recorded time series for the measure;

wherein each of the one or more entities is represented in computer storage by an entity definition that associates the entity with machine data pertaining to the entity, and each entity definition is included in a service definition representing the service in computer storage;

wherein the machine data reflects activity in an information technology environment and is produced by one or more components of the information technology environment;

wherein the method is performed by a computer system comprising one or more processors coupled to the computer storage.

2. The method of claim 1 wherein the measure of performance of the service is based at least in part on a measure of a computing resource.

3. The method of claim 1 wherein the search query defines a Key Performance Indicator (KPI) associated with the service.

4. The method of claim 1 wherein the search query defines a Key Performance Indicator (KPI) associated with the service and the value indicative of a measure of performance of the service is indicative of a measure of an aspect of the service.

5. The method of claim 1 wherein the search query is included in the service definition.

6. The method of claim 1 wherein the search query is included in the service definition and defines a Key Performance Indicator (KPI).

7. The method of claim 1 wherein the machine data pertaining to the entity is produced by more than one source.

8. The method of claim 1 wherein the machine data pertaining to the entity is produced by the entity and by a source that is not the entity.

9. The method of claim 1 wherein the machine data pertaining to the entity is machine data produced by or about the entity.

10. The method of claim 1 wherein the machine data associated with one or more entities that provide the service comprises event data.

11. The method of claim 1 wherein the machine data associated with one or more entities that provide the service comprises timestamped event data.

12. The method of claim 1 wherein the machine data associated with one or more entities that provide the service comprises events, each event comprising a segment of raw machine data.

13. The method of claim 1 wherein the machine data associated with one or more entities that provide the service comprises unstructured data.

14. The method of claim 1 wherein the machine data pertaining to the entity is produced by more than one source and comprises unstructured data.

15. The method of claim 1 wherein the machine data pertaining to the entity is produced by more than one source and comprises unstructured data stored as timestamped events.

16. The method of claim 1 further comprising causing the display of a graphical user interface comprising a graphical representation of at least a portion of the recorded time series.

17. The method of claim 1 further comprising causing the display of a graphical user interface comprising a representation of at least a portion of the recorded time series, the representation comprising at least one from among a line graph, a spark line, and a trend indicator.

18. The method of claim 1 wherein the search query is sent to an event processing system for execution.

19. The method of claim 1 wherein the search query is sent to an event processing system for execution, the event processing system storing the machine data as events.

20. The method of claim 1 wherein the search query is sent to an event processing system for execution, the event processing system storing the machine data as events, and accessing the machine data of events, at least in part, with a late-binding schema.

21. The method of claim 1 wherein the search query derives the value from machine data accessed with a late-binding-schema.

22. The method of claim 1 wherein the repeated basis is based on a defined frequency.

23. The method of claim 1 wherein the repeated basis is based on a schedule.

24. The method of claim 1 further comprising:

causing the display of a graphical user interface enabling a user to indicate a monitoring frequency;

receiving a user input indicating the monitoring frequency;

associating the monitoring frequency indicated by the user input with the search query; and

wherein the repeated basis is based on the monitoring frequency associated with the search query.

25. A system comprising:

a memory; and

a processing device coupled with the memory to;

access a search query from computer storage and executing the search query automatically on a repeated basis, wherein, for each execution, the search query transforms machine data to a value by deriving the value from machine data associated with one or more entities that provide a service, the value indicating a measure of performance of the service at a point in time or over a period of time; and

represent each derived value in computer storage to produce a recorded time series for the measure;

wherein each of the one or more entities is represented in computer storage by an entity definition that associates the entity with machine data pertaining to the entity, and each entity definition is included in a service definition representing the service in computer storage;

wherein the machine data reflects activity in an information technology environment and is produced by one or more components of the information technology environment.

26. The system of claim 25 wherein the machine data pertaining to the entity is produced by more than one source.

27. The system of claim 25 wherein the machine data associated with one or more entities that provide the service comprises events, each event comprising a segment of raw machine data.

28. The system of claim 25 wherein the search query derives the value from machine data accessed with a late-binding-schema.

29. The system of claim 25 wherein the search query is included in the service definition and defines a Key Performance Indicator (KPI).

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to:

access a search query from computer storage and executing the search query automatically on a repeated basis, wherein, for each execution, the search query transforms machine data to a value by deriving the value from machine data associated with one or more entities that provide a service, the value indicating a measure of performance of the service at a point in time or over a period of time; and

represent each derived value in computer storage to produce a recorded time series for the measure;

wherein each of the one or more entities is represented in computer storage by an entity definition that associates the entity with machine data pertaining to the entity, and each entity definition is included in a service definition representing the service in computer storage;

wherein the machine data reflects activity in an information technology environment and is produced by one or more components of the information technology environment.