Incident review interface

• US 10,503,746 B2
• Filed: 07/28/2017
• Issued: 12/10/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Choudhary, Hemendra Singh, Noel, Cary Glen
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US15/663,700
• Publication Number:
  US 20170337252A1
• Time in Patent Office: 865 Days
• Field of Search: 709223
• CPC Class Codes: G06F 16/2428 Query predicate definition using graphical user interfaces, including menus and forms G06F16/2423 takes precedence
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 16/248 Presentation of query results
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A computing machine performs a correlation search against KPI data for one or more services using a selection criteria and a triggering condition. When the triggering condition is satisfied a notable event or incident is created and information about the notable event is presented using a user interface that may have interactive elements.

Claims

1. A method comprising:

performing a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that derives a value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, thereby transforming machine data to the value indicating the measure, wherein the correlation search comprises a search criteria pertaining to stored values of the one or more KPIs, and a triggering condition specifying a determination including at least one value derived from stored values identified by the search criteria;

automatically recording a notable event in computer storage in response to a satisfaction of the triggering condition; and

causing display of a user interface presenting information pertaining to the notable event;

wherein the method is performed by one or more processing devices coupled to the computer storage.

2. The method of claim 1 wherein the presented information includes information identifying the service.

3. The method of claim 1 wherein the presented information includes at least one from among an identification of the service, a time associated with the correlation search, an identification of the correlation search, and a severity associated with the triggering condition.

4. The method of claim 1 wherein the presented information includes information identifying one or more services associated with the correlation search.

5. The method of claim 1 wherein the correlation search is associated with a respective service by having search criteria pertaining to at least one KPI of the respective service.

6. The method of claim 1 wherein the search criteria pertains to an aggregate KPI characterizing the service as a whole and the triggering condition is based at least in part on a KPI state indicated by aggregate KPI data that satisfies the search criteria.

7. The method of claim 1 wherein the search criteria pertains to an aspect KPI characterizing an aspect of the service, and the triggering condition is based at least in part on a KPI state indicated by aspect KPI data that satisfies the search criteria.

8. The method of claim 1 wherein causing display of the user interface is preconditioned on the notable event satisfying a filter criteria.

9. The method of claim 1 wherein causing display of the user interface is preconditioned on the notable event satisfying a filter criteria pertaining to a severity level.

10. The method of claim 1 wherein causing display of the user interface is preconditioned on the notable event satisfying a filter criteria pertaining to a severity level wherein the filter criteria is based at least in part on an indication of a user selection of the severity level from a severity chart of a graphical user interface component.

11. The method of claim 1 further comprising causing display of the user interface with information pertaining to two or more stored notable events, the notable events determined according to event filtering criteria indicated by user input.

12. The method of claim 1 further comprising causing display of the user interface with a list of selectable action options with respect to the notable event.

13. The method of claim 1 further comprising causing display of the user interface with a list of selectable action options for the notable event.

14. The method of claim 1 further comprising causing display of the user interface with selectable action options for the notable event, the selectable action options including at least one from among an option for a visualization of correlation search results over time and an option for a time-based visualization of one or more KPIs contributing to the correlation search.

15. The method of claim 1 further comprising:

causing the display of a visualization of correlation search results over time in response to user interaction with the user interface.

16. The method of claim 1 further comprising:

causing the display of a time-based visualization of one or more KPIs contributing to the correlation search in response to user interaction with the user interface.

17. The method of claim 1 wherein the corresponding machine data for a particular one of the entities includes machine data from the entity and from a different source.

18. The method of claim 1 wherein the corresponding machine data for a particular one of the entities includes machine data from two or more sources.

19. The method of claim 1 wherein the machine data is represented as events.

20. The method of claim 1 wherein the machine data is represented as events each comprising a segment of raw data.

21. The method of claim 1 wherein the machine data is represented as timestamped events each comprising a segment of raw data.

22. The method of claim 1 wherein the correlation search is associated with no service other than the service.

23. The method of claim 1 wherein the service definition includes an indication of a dependency between the service and one or more other services.

24. The method of claim 1 wherein the service definition includes information about one or more dependencies between the service and one or more related services.

25. The method of claim 1 wherein the service definition includes information indicating one or more dependencies between the service and one or more related services, and further comprising causing display of the user interface with information about the related services based at least in part on the dependencies.

26. The method of claim 1 wherein automatically recording a notable event comprises creating an incident ticket.

27. The method of claim 1 further comprising automatically creating an incident ticket in response to a satisfaction of the triggering condition.

28. The method of claim 1 further comprising automatically creating, in response to a satisfaction of the triggering condition, an incident ticket in accordance with configuration information of the correlation search.

29. A system comprising:

a memory; and

a processing device coupled with the memory to;

perform a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that derives a value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, thereby transforming machine data to the value indicating the measure, wherein the correlation search comprises a search criteria pertaining to stored values of the one or more KPIs, and a triggering condition specifying a determination including at least one value derived from stored values identified by the search criteria;

automatically record a notable event in computer storage in response to a satisfaction of the triggering condition; and

cause display of a user interface presenting information pertaining to the notable event.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

performing a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that derives a value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, thereby transforming machine data to the value indicating the measure, wherein the correlation search comprises a search criteria pertaining to stored values of the one or more KPIs, and a triggering condition specifying a determination including at least one value derived from stored values identified by the search criteria;

automatically recording a notable event in computer storage in response to a satisfaction of the triggering condition; and

causing display of a user interface presenting information pertaining to the notable event.