Portable control modules in a machine data driven service monitoring system

• US 10,417,108 B2
• Filed: 01/09/2017
• Issued: 09/17/2019
• Est. Priority Date: 09/18/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Tankersley, Nicholas Matthew, Daloukov, George Iordanov, Ramani, Arun
• Primary Examiner(s): Lewis, Cheryl
• Application Number:
  US15/402,184
• Publication Number:
  US 20170147681A1
• Time in Patent Office: 981 Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3048 where the topology of the computing system or computing system component explicitly influences the monitoring activity, e.g. serial, hierarchical systems
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/3093 Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
• CPC Class Codes: G06F 11/321 Display for diagnostics, e.g. diagnostic result display, self-test user interface
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 16/24573 using data annotations, e.g. user-defined metadata
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: G06T 11/206 Drawing of charts or graphs
• CPC Class Codes: G06T 2200/24 involving graphical user interfaces [GUIs]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

The operation of an automatic service monitoring system (SMS) is directed by stored control information. Methods and mechanisms are provided to create portable control modules based on the control information. The portable modules may be transmitted or otherwise conveyed to a second SMS and imported there to establish the control information that directs and determines operational aspects of the second SMS.

Claims

1. A method comprising:

causing display of an interface enabling a user to indicate a selection of at least one control data component of a service monitoring system (SMS);

receiving user input indicative of the selection;

constructing a data package based at least in part on the received input, the data package representing a control module and conforming to a standard representation format for a portable control module;

wherein the SMS comprises a KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the value indicative of a measure of the service at a point in time or over a period of time, each of the entities represented by an entity definition that identifies machine data pertaining to that entity, and the service represented by a service definition associated with the one or more entity definitions;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment;

whereby the operation of an active SMS instance may be controlled with information based at least in part on content of the data package; and

wherein the method is performed by a computer system comprising one or more processors.

2. The method of claim 1 wherein the at least one control data component includes information defining the service to the SMS.

3. The method of claim 1 wherein the at least one control data component includes information defining at least one of the one or more entities to the SMS.

4. The method of claim 1 wherein the at least one control data component includes information defining the KPI to the SMS.

5. The method of claim 1 wherein the at least one control data component includes information defining the service and at least one of the one or more entities to the SMS.

6. The method of claim 1 wherein the at least one control data component includes information defining the service, at least one of the one or more entities, and the KPI to the SMS.

7. The method of claim 1 wherein the at least one control data component includes information related to production of a visualization by the SMS.

8. The method of claim 1 wherein the at least one control data component includes information related to production of a modifiable dashboard template-based visualization by the SMS.

9. The method of claim 1 wherein the at least one control data component includes information related to production of a deep dive visualization by the SMS.

10. The method of claim 1 wherein the at least one control data component includes filter criteria information for associating at least one of the one or more entities with the service.

11. The method of claim 1 wherein the interface enables the user to indicate the selection of at least one control data component of the service monitoring system by interacting with one or more entries of a list of control data components of the service monitoring system.

12. The method of claim 1 wherein the interface enables the user to indicate the selection of at least one control data component of the service monitoring system by interacting with one or more entries of a list of control data components of the service monitoring system having a common type.

13. The method of claim 1 wherein constructing the data package includes templatizing one or more of the at least one control data component.

14. The method of claim 1 wherein constructing the data package includes templatizing one or more of the at least one control data component by transforming at least one instance-specific value.

15. The method of claim 1 wherein constructing the data package includes storing a representation of the control module as a file.

16. The method of claim 1 wherein constructing the data package includes storing a representation of the control module as an archive format of a file system directory branch.

17. The method of claim 1 wherein constructing the data package includes storing a representation of the control module as a compressed archive format of a file system directory branch.

18. The method of claim 1 wherein constructing the data package includes validating the content of the control module.

19. The method of claim 1 wherein constructing the data package includes validating the content of the control module based at least in part on built-in rules.

20. The method of claim 1 wherein constructing the data package includes validating the content of the control module based at least in part on user-supplied rules.

21. The method of claim 1 further comprising transmitting the data package over a network.

22. The method of claim 1 wherein the machine data includes one or more events.

23. The method of claim 1 wherein the machine data includes one or more timestamped events each having a segment of raw data.

24. The method of claim 1 wherein the machine data is ingested by a data input and query system without regard to service definition information of the service monitoring system.

25. The method of claim 1 wherein processing the search query includes applying a late-binding schema to the machine data.

26. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of an interface enabling a user to indicate a selection of at least one control data component of a service monitoring system (SMS);

receive user input indicative of the selection;

construct a data package based at least in part on the received input, the data package representing a control module and conforming to a standard representation format for a portable control module;

wherein the SMS comprises a KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the value indicative of a measure of the service at a point in time or over a period of time, each of the entities represented by an entity definition that identifies machine data pertaining to that entity, and the service represented by a service definition associated with the one or more entity definitions;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

whereby the operation of an active SMS instance may be controlled with information based at least in part on content of the data package.

27. The system of claim 26 wherein the at least one control data component includes information defining the service to the SMS.

28. The system of claim 26 wherein the at least one control data component includes information defining the KPI to the SMS.

29. The system of claim 26 wherein the interface enables the user to indicate the selection of at least one control data component of the service monitoring system by interacting with one or more entries of a list of control data components of the service monitoring system.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of an interface enabling a user to indicate a selection of at least one control data component of a service monitoring system (SMS);

receiving user input indicative of the selection;

constructing a data package based at least in part on the received input, the data package representing a control module and conforming to a standard representation format for a portable control module;

wherein the SMS comprises a KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the value indicative of a measure of the service at a point in time or over a period of time, each of the entities represented by an entity definition that identifies machine data pertaining to that entity, and the service represented by a service definition associated with the one or more entity definitions;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment;

whereby the operation of an active SMS instance may be controlled with information based at least in part on content of the data package; and

wherein the method is performed by a computer system comprising one or more processors.