Automatic associations in an I.T. monitoring system

• US 10,521,409 B2
• Filed: 07/29/2017
• Issued: 12/31/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Alekseyev, Leonid, Boe, Brent, Sharp, Clint
• Primary Examiner(s): Madamba, Glenford J
• Application Number:
  US15/663,747
• Publication Number:
  US 20170351720A1
• Time in Patent Office: 885 Days
• Field of Search: 709223
• CPC Class Codes: G06F 16/168 Details of user interfaces specifically adapted to file systems, e.g. browsing and visualisation, 2d or 3d GUIs query results presentation G06F16/156
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2322 using timestamps
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment

Abstract

A computer system exposes an interface for the specification of filter criteria. The filter criteria may identify control information of a service monitoring system (SMS) that defines entities in an IT environment monitored by the SMS. An association of identified entities with a monitored service may be made to direct the ongoing operation of the SMS toward the service.

Claims

1. A method comprising:

presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions for association with a service definition in computer storage, the service definition representing a service in an information technology (IT) environment, and each entity definition representing an entity in the IT environment that performs the service, each entity definition comprising information for an identification of machine data pertaining to the entity, and wherein the service definition and the entity definitions are configuration information of a service monitoring system;

storing the filter criteria in association with the service definition in response to receiving the indication of the filter criteria via the interface;

identifying one or more entity definitions based at least in part on the filter criteria and reflecting in computer storage an association of at least one of the identified entity definitions with the service definition;

wherein the machine data is produced by one or more components within the IT environment and reflects activity within the IT environment;

wherein the method is performed by one or more processing devices.

2. The method of claim 1, wherein the filter criteria is associated with an execution type, wherein the execution type is a static type or a dynamic type.

3. The method of claim 1, wherein presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions comprises enabling an indication of an execution type associated with the filter criteria.

4. The method of claim 1, wherein presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions comprises enabling an indication of an execution type associated with the filter criteria, and wherein storing the filter criteria in association with the service definition comprises storing the execution type in association with the filter criteria.

5. The method of claim 1, wherein the filter criteria comprises a name portion and a value portion.

6. The method of claim 1, wherein the filter criteria comprises a name portion and a value portion for matching to an element name and an element value, respectively, of an entity definition component.

7. The method of claim 1, wherein the filter criteria comprises a name portion and a value portion for matching to an element name and an element value, respectively, of an entity definition component, the entity definition component having an alias component type, an informational field component type, and/or a name component type.

8. The method of claim 1, further comprising:

detecting a change among a plurality of entity definitions in a data store;

accessing the stored filter criteria in response to the change detected, and performing the identifying and the reflecting using the accessed filter criteria as the filter criteria.

9. The method of claim 1, wherein presenting a service definition interface comprises displaying preview information about one or more entity definitions identified at least in part by applying indicated filter criteria.

10. The method of claim 1, wherein reflecting in computer storage an association of at least one of the identified entity definitions with the service definition comprises storing an association indicator in at least one definition from among the service definition and the identified entity definitions.

11. The method of claim 1, wherein reflecting in computer storage an association of at least one of the identified entity definitions with the service definition comprises storing the at least one identified entity definition in the service definition.

12. The method of claim 1, wherein presenting a service definition interface comprises:

causing display of a list of one or more element names and enabling a user to indicate a selection from the list; and

enabling display of a list of one or more element values corresponding to a received selection indication.

13. The method of claim 1, wherein presenting a service definition interface comprises:

causing display of a list of one or more element names from a plurality of entity definitions in a data store, and enabling a user to indicate a selection from the list; and

enabling display of a list of one or more element values from among the plurality of entity definitions and corresponding to a received selection indication.

14. The method of claim 1, wherein presenting a service definition interface comprises:

causing display of a list of one or more element names associated with a particular component type and from a plurality of entity definitions in a data store, and enabling a user to indicate a selection from the list; and

enabling display of a list of one or more element values from among the plurality of entity definitions and corresponding to a received selection indication.

15. The method of claim 1, wherein presenting a service definition interface comprises:

causing display of a list of one or more element names associated with a particular entity characteristic and from a plurality of entity definitions in a data store, and enabling a user to indicate a selection from the list; and

enabling display of a list of one or more element values from among the plurality of entity definitions and corresponding to a received selection indication;

wherein the particular entity characteristic is name, alias, and/or informational field.

16. The method of claim 1, further comprising presenting a service definition interface portion including a list of entities represented by the identified one or more entity definitions.

17. The method of claim 1, wherein the machine data pertaining to the entity includes machine data produced by the entity.

18. The method of claim 1, wherein the machine data pertaining to the entity is obtained through an application programming interface (API) from software that monitors the performance of the entity.

19. The method of claim 1, wherein the machine data pertaining to the entity is derived from network packet data that references the entity.

20. The method of claim 1, wherein the machine data pertaining to the entity is represented as events comprising a portion of raw data.

21. The method of claim 1, wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data.

22. The method of claim 1, wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested from more than one source.

23. The method of claim 1, wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested without regard to the service definition.

24. The method of claim 1, wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested from more than one source without regard to the service definition.

25. A system comprising:

a memory; and

a processing device coupled with the memory to;

present a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions for association with a service definition in computer storage, the service definition representing a service in an information technology (IT) environment, and each entity definition representing an entity in the IT environment that performs the service, each entity definition comprising information for an identification of machine data pertaining to the entity, and wherein the service definition and the entity definitions are configuration information of a service monitoring system;

store the filter criteria in association with the service definition in response to receiving the indication of the filter criteria via the interface;

identify one or more entity definitions based at least in part on the filter criteria and reflect in computer storage an association of at least one of the identified entity definitions with the service definition;

wherein the machine data is produced by one or more components within the IT environment and reflects activity within the IT environment.

26. The system of claim 25, further comprising:

detecting a change among a plurality of entity definitions in a data store;

accessing the stored filter criteria in response to the change detected, and performing the identifying and the reflecting using the accessed filter criteria as the filter criteria.

27. The system of claim 25, wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested from more than one source.

28. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions for association with a service definition in computer storage, the service definition representing a service in an information technology (IT) environment, and each entity definition representing an entity in the IT environment that performs the service, each entity definition comprising information for an identification of machine data pertaining to the entity, and wherein the service definition and the entity definitions are configuration information of a service monitoring system;

storing the filter criteria in association with the service definition in response to receiving the indication of the filter criteria via the interface;

identifying one or more entity definitions based at least in part on the filter criteria and reflecting in computer storage an association of at least one of the identified entity definitions with the service definition;

wherein the machine data is produced by one or more components within the IT environment and reflects activity within the IT environment.

29. The non-transitory computer readable storage medium of claim 28, further comprising:

detecting a change among a plurality of entity definitions in a data store;

accessing the stored filter criteria in response to the change detected, and performing the identifying and the reflecting using the accessed filter criteria as the filter criteria.

30. The non-transitory computer readable storage medium of claim 28, wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested from more than one source.