Thresholds for key performance indicators derived from machine data

• US 9,755,913 B2
• Filed: 11/05/2015
• Issued: 09/05/2017
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Bhide, Alok Anant, Bingham, Brian John, Fletcher, Tristan Antonio, Reyes, Brian
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US14/934,126
• Publication Number:
  US 20160103909A1
• Time in Patent Office: 670 Days
• Field of Search: 709203, 709223-229, 709250, 709213-214
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 16/24542 Plan optimisation
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/252 between a Database Management System and a front-end application
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 16/9038 Presentation of query results
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 Presentation of query results
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/04817 using icons graphical or visual programming using iconic symbols G06F8/34
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 9/542 : Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/0637 : Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
• CPC Class Codes: G06Q 10/0639 : Performance analysis of employees; Performance analysis of enterprise or organisation operations
• CPC Class Codes: G06Q 10/06393 : Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 : Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 : involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 43/04 : Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 43/55 : Testing of service level quality, e.g. simulating service usage
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, identifying information for locating machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.

Claims

1. A method comprising:

accessing information of a service definition from computer storage, the service definition identifying a key performance indicator (KPI) and one or more entities that provide a service, wherein;

each entity has entity definition information identifying machine data produced by or about the entity, and

the KPI is defined by a search query that produces a value derived from machine data identified in the entity definitions, the value indicative of a measure of the service at a point in time or during a period of time, and the value indicating one of a plurality of states of the KPI, thereby transforming machine data to the value indicative of the measure;

causing display of a graphical user interface (GUI) enabling a user to indicate a setting for one or more thresholds for the KPI, each threshold defining an end of a range of values corresponding to a particular state of the plurality of states of the KPI;

receiving an indication via the GUI of at least one of the thresholds for the KPI;

recording threshold information in computer storage in association with the KPI in accordance with the received indication; and

wherein the method is performed by one or more processing devices coupled to the computer storage.

2. The method of claim 1 further comprising:

determining one of the plurality of states of the KPI in view of the threshold information.

3. The method of claim 1 further comprising:

determining one of the plurality of states of the KPI in view of the threshold information, according to a frequency and/or a schedule.

4. The method of claim 1 wherein recording threshold information comprises storing the threshold information in the computer storage so as to condition an automatic process for determining one of the plurality of states of the KPI.

5. The method of claim 1 wherein the GUI further enables a user to indicate a name of the particular state.

6. The method of claim 1 wherein the GUI further enables a user to indicate a visual indicator for the particular state.

7. The method of claim 1 wherein the GUI displays a predefined name, predefined value, and predefined visual indicator for at least one state of the plurality of states of the KPI.

8. The method of claim 1 wherein receiving an indication via the GUI of the at least one threshold for the KPI comprises:

causing the display of a GUI element that represents the particular state wherein the visual appearance of the GUI element is based at least in part on the received indication.

9. The method of claim 1 The method of claim 1 wherein receiving an indication via the GUI of the at least one threshold for the KPI comprises:

causing the display of a GUI element that represents the particular state wherein the size of the GUI element is based at least in part on the received indication.

10. The method of claim 1, further comprising:

receiving, via the GUI, a maximum value and a minimum value defining a scale for a widget representing the KPI.

11. The method of claim 1 wherein the GUI further enables a user to indicate application of the at least one threshold to an aggregate KPI of the service.

12. The method of claim 1 wherein the machine data comprises timestamped events.

13. The method of claim 1 wherein the machine data comprises timestamped events each having a segment of raw data.

14. The method of claim 1 wherein the machine data comprises timestamped events of an event data store, each event having a segment of raw data and each created without regard to the service definition.

15. The method of claim 1:

wherein the machine data comprises timestamped events of an event data store, each event having a segment of raw data and each created without regard to the service definition; and

wherein the search query is executed by an event processing system.

16. The method of claim 1:

wherein the machine data comprises timestamped events each having a segment of raw data and each created without regard to the service definition; and

wherein the raw data is collected from a plurality of sources.

17. The method of claim 1:

wherein the machine data comprises timestamped events each having a segment of raw data and each created without regard to the service definition; and

wherein the value produced by the search query is derived by reference to an extraction rule specifying how to extract information from at least one of the segments of raw data at the time of the search query.

18. The method of claim 1:

wherein the machine data comprises timestamped events each having a segment of raw data and each created without regard to the service definition; and

wherein, for at least one of the entities, the machine data produced by or about the entity comes from more than one source.

19. The method of claim 1:

wherein the machine data comprises timestamped events each having a segment of raw data and each created without regard to the service definition; and

wherein, for at least one of the entities, the machine data produced by or about the entity comes in different formats and from more than one source.

20. The method of claim 1 wherein the value produced by the search query is derived by reference to a late-binding schema specifying how to extract information from the machine data at the time of the search query.

21. The method of claim 1 wherein the value produced by the search query is derived by reference to at least one extraction rule specifying how to extract information from the machine data at the time of the search query.

22. The method of claim 1 wherein the value produced by the search query is derived by reference to at least one extraction rule specifying how to extract information from a raw data segment of the machine data at the time of the search query.

23. The method of claim 1 wherein the value produced by the search query is derived by reference to a late-binding schema.

24. The method of claim 1 wherein the machine data identified by the entity definition information for at least one particular entity comes from multiple sources.

25. The method of claim 1 wherein the machine data identified by the entity definition information for at least one particular entity comes from that entity and a different source.

26. The method of claim 1 wherein the machine data identified by the entity definition information for at least one particular entity comes from at least two sources other than the entity.

27. The method of claim 1 wherein the machine data identified by the entity definition information for at least one particular entity includes data in different formats.

28. The method of claim 1 wherein the machine data identified by the entity definition information for at least one particular entity includes log data produced by that entity.

29. A system comprising:

a memory; and

a processing device coupled with the memory to;

access information of a service definition from computer storage, the service definition identifying a key performance indicator (KPI) and one or more entities that provide a service, wherein;

each entity has entity definition information identifying machine data produced by or about the entity, and

the KPI is defined by a search query that produces a value derived from machine data identified in the entity definitions, the value indicative of a measure of the service at a point in time or during a period of time, and the value indicating one of a plurality of states of the KPI, thereby transforming machine data to the value indicative of the measure;

cause display of a graphical user interface (GUI) enabling a user to indicate a setting for one or more thresholds for the KPI, each threshold defining an end of a range of values corresponding to a particular state of the plurality of states of the KPI;

receive an indication via the GUI of at least one of the thresholds for the KPI;

record threshold information in computer storage in association with the KPI in accordance with the received indication.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

accessing information of a service definition from computer storage, the service definition identifying a key performance indicator (KPI) and one or more entities that provide a service, wherein;

each entity has entity definition information identifying machine data produced by or about the entity, and

the KPI is defined by a search query that produces a value derived from machine data identified in the entity definitions, the value indicative of a measure of the service at a point in time or during a period of time, and the value indicating one of a plurality of states of the KPI, thereby transforming machine data to the value indicative of the measure;

causing display of a graphical user interface (GUI) enabling a user to indicate a setting for one or more thresholds for the KPI, each threshold defining an end of a range of values corresponding to a particular state of the plurality of states of the KPI;

receiving an indication via the GUI of at least one of the thresholds for the KPI;

recording threshold information in computer storage in association with the KPI in accordance with the received indication.