Service monitoring interface with aspect and summary indicators

• US 9,960,970 B2
• Filed: 01/29/2017
• Issued: 05/01/2018
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Original Assignee: Splunk Inc. (Cisco Systems, Inc.)
• Inventors: Choudhary, Hemendra Singh, Fletcher, Tristan Antonio, Bhide, Alok Anant, Hsiao, Fang I.
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US15/418,766
• Publication Number:
  US 20170141969A1
• Time in Patent Office: 457 Days
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Services in an operating environment are represented by stored service definitions that identify entities that perform the service. Entity definitions identify machine data pertaining to the entity. A key performance indicator (KPI) of the service characterizes the service on the whole or some aspect of it. Each KPI is defined by a search query that derives a value from machine data identified in the entity definitions. Processing devices cause display of a service-monitoring page having a services summary region and a services aspects region. The summary region displays interactive summary tiles that each correspond to a service and present information about an aggregate KPI that characterizes the service. The aspects region displays interactive aspect tiles that each correspond to a KPI characterizing some aspect of an associated service. Additional information may be included in the service-monitoring page and interaction features enable a user to navigate to enhanced information displays.

Claims

1. A method comprising:

causing display of a service-monitoring graphical user interface (GUI) comprising;

a summary region including a plurality of interactive summary tiles, and

an aspects region including a plurality of interactive aspect tiles;

wherein each of the summary tiles includes a representation of an aggregate key performance indicator (KPI) that characterizes a respective service as a whole;

wherein each of the aspect tiles includes a representation of an aspect key performance indicator (KPI) that characterizes an aspect of an associated service;

wherein each KPI relates to a service having a stored service definition that identifies one or more entities that provide the service, each entity having stored entity definition information that identifies machine data produced by or about the entity from one or more sources, and each KPI being defined by a search query that produces a value derived from machine data identified by the entity definition information, the value indicative of a measure of the service at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by one or more processing devices.

2. The method of claim 1 wherein the machine data includes machine data organized as events.

3. The method of claim 1 wherein the machine data includes timestamped events.

4. The method of claim 1 wherein the machine data includes timestamped events each having a segment of raw data.

5. The method of claim 1 wherein the machine data includes timestamped events in an event data store, each event having a segment of raw data, the raw data collected without regard to the service definition.

6. The method of claim 1 wherein the machine data includes timestamped events, and the machine data pertaining to at least one particular entity comes from at least two sources.

7. The method of claim 1 wherein the machine data includes timestamped events each having a segment of raw data, and wherein the value produced by the search query is derived by reference to at least one extraction rule specifying how to extract information from the raw data segment of at least one of the events at the time of the search query.

8. The method of claim 1:

wherein the machine data includes timestamped events each having a segment of raw data;

wherein the value produced by the search query is derived by reference to at least one extraction rule specifying how to extract information from the raw data segment of at least one of the events at the time of the search query; and

wherein the machine data identified by at least one particular entity definition comes from more than one source.

9. The method of claim 1:

wherein the machine data includes timestamped events each having a segment of raw data;

wherein the value produced by the search query is derived by reference to at least one extraction rule specifying how to extract information from the raw data segment of at least one of the events at the time of the search query; and

wherein the machine data identified by at least one entity definition has multiple formats and comes from more than one source.

10. The method of claim 1 wherein the machine data is accessed, at least in part, in accordance with a late-binding schema.

11. The method of claim 1 wherein the machine data identified by at least one particular entity definition is produced by two or more sources.

12. The method of claim 1 wherein the machine data identified by at least one entity definition is produced by the entity and at least one other source.

13. The method of claim 1 wherein the machine data identified by at least one entity definition is produced by two or more sources other than the entity.

14. The method of claim 1 wherein the representation of a particular aggregate KPI by a particular summary tile is determined with respect to an ordering of the summary tiles and an ordering of the aggregate KPIs, wherein the ordering of the aggregate KPIs is based at least in part on a state associated with each aggregate KPI.

15. The method of claim 1 wherein the representation of a particular aggregate KPI by a particular summary tile is determined with respect to an ordering of the summary tiles and an ordering of the aggregate KPIs, wherein the ordering of the aggregate KPIs is based at least in part on a state associated with each aggregate KPI, the state determined by reference to at least one threshold determining an end of a range of values for the state.

16. The method of claim 1 further comprising:

monitoring for an expiration of a refresh interval and refreshing the display of the service-monitoring GUI in response to the expiration.

17. The method of claim 1 wherein the representation of an aggregate KPI included in at least one of the summary tiles includes a visual indication of a determined state of the aggregate KPI.

18. The method of claim 1 wherein the representation of an aggregate KPI included in at least one of the summary tiles includes a background color corresponding to a determined state of the aggregate KPI.

19. The method of claim 1 wherein causing the display of the service-monitoring GUI comprises causing the display in a first display mode wherein the summary tiles are larger than when displayed in a second display mode.

20. The method of claim 1, the service-monitoring GUI further having a notable events region comprising an indication of one or more correlation searches that generate notable events.

21. The method of claim 1, the service-monitoring GUI further having a notable events region comprising an indication of one or more correlation searches that generate notable events, the correlation searches selected on the basis of having generated the highest counts of notable events over a period of time.

22. The method of claim 1, the service-monitoring GUI further having a notable events region comprising an indication of one or more correlation searches that generate notable events, wherein the indication for at least one of the correlation searches is interactive to enable a user to navigate toward a GUI display with additional information related to the respective correlation search.

23. The method of claim 1 wherein at least one of the summary tiles includes an identifier for the service corresponding to the summary tile and an indication of the state of the service corresponding to the summary tile.

24. The method of claim 1 wherein at least one of the summary tiles includes an identifier for the service corresponding to the summary tile, an indication of the state of the service corresponding to the summary tile, and an indication of the value over time of the aggregate KPI represented by the summary tile.

25. The method of claim 1, further comprising:

causing display of a modified service-monitoring GUI in response to receiving user input directing transition to a selection mode, the modified service monitoring GUI enabling a user to indicate the selection of multiple aspect KPI'"'"'s by interaction with the aspect tiles corresponding to the multiple aspect KPI'"'"'s, wherein the causing display of a modified service-monitoring GUI page causes a change in appearance of the plurality of interactive aspect tiles.

26. The method of claim 1, further comprising:

causing display of a modified service-monitoring GUI in response to receiving user input directing transition to a selection mode, the modified service monitoring GUI enabling a user to indicate a selection of multiple aspect KPI'"'"'s by interaction with the aspect tiles corresponding to the multiple aspect KPI'"'"'s; and

causing display of information of an aspect KPI as a graphical visualization along a time-based graph lane, for each aspect KPI included in the selection of multiple aspect KPI'"'"'s received via the modified service-monitoring GUI.

27. The method of claim 1 wherein the summary region further includes a visual depiction showing a distribution among one or more states of aggregate KPI'"'"'s of a plurality of services.

28. The method of claim 1 wherein one or more of the interactive aspect tiles each enable a user to direct navigation toward a display having a graphical visualization of data of the aspect KPI represented by the respective aspect tile, the graphical visualization appearing along a time-based graph lane.

29. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of a service-monitoring graphical user interface (GUI) comprising;

a summary region including a plurality of interactive summary tiles, and

an aspects region including a plurality of interactive aspect tiles;

wherein each of the summary tiles includes a representation of an aggregate key performance indicator (KPI) that characterizes a respective service as a whole;

wherein each of the aspect tiles includes a representation of an aspect key performance indicator (KPI) that characterizes an aspect of an associated service;

wherein each KPI relates to a service having a stored service definition that identifies one or more entities that provide the service, each entity having stored entity definition information that identifies machine data produced by or about the entity from one or more sources, and each KPI being defined by a search query that produces a value derived from machine data identified by the entity definition information, the value indicative of a measure of the service at a point in time or during a period of time; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of a service-monitoring graphical user interface (GUI) comprising;

a summary region including a plurality of interactive summary tiles, and

an aspects region including a plurality of interactive aspect tiles;

wherein each of the summary tiles includes a representation of an aggregate key performance indicator (KPI) that characterizes a respective service as a whole;

wherein each of the aspect tiles includes a representation of an aspect key performance indicator (KPI) that characterizes an aspect of an associated service;

wherein each KPI relates to a service having a stored service definition that identifies one or more entities that provide the service, each entity having stored entity definition information that identifies machine data produced by or about the entity from one or more sources, and each KPI being defined by a search query that produces a value derived from machine data identified by the entity definition information, the value indicative of a measure of the service at a point in time or during a period of time; and

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.