Monitoring an IT service at an overall level from machine data

• US 10,680,914 B1
• Filed: 05/05/2019
• Issued: 06/09/2020
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Bingham, Brian John, Choudhary, Hemendra Singh, Fletcher, Tristan Antonio
• Primary Examiner(s): Mirza, Adnan M
• Application Number:
  US16/403,549
• Time in Patent Office: 401 Days
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 10/06393 Score-carding, benchmarking or key performance indicator [KPI] analysis
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5006 Creating or negotiating SLA contracts, guarantees or penalties
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/562 Brokering proxy services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

One or more processing devices derive values indicative of various aspects or characteristics of how a particular service in an information technology (IT) environment is existing or performing at a point in time or for a period of time. The values are derived by a search query over machine data associated with the one or more entities that provide the service. The one or more processing devices determine a value for an aggregate key performance indicator (KPI) for the service to indicate or characterize the service overall from values for each of the various aspects.

Claims

1. A method, comprising:

deriving a value for each of a plurality of key performance indicators (KPIs), each KPI indicating an aspect of a service provided by one or more entities, each KPI defined by a search query that derives the value for that KPI from machine data associated with at least one of the entities that provide the service, each of the entities having a respective entity definition including information identifying the machine data associated with the respective entity, and the service having a service definition associating each of the entity definitions; and

determining a value for an aggregate KPI for the service from the values for each of the plurality of KPIs,

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment;

wherein the method is performed by a computer system comprising one or more processing devices.

2. The method of claim 1 wherein the machine data includes segments of machine data each associated with a respective timestamped event.

3. The method of claim 1 wherein the machine data associated with a particular one of the entities comes from two or more sources.

4. The method of claim 1 wherein the machine data associated with a particular one of the entities comes from a first source in accordance with a first data representation and from a second source in accordance with a second data representation.

5. The method of claim 1 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.

6. The method of claim 1, further comprising:

comparing the value for the aggregate KPI to a threshold; and

indicating an alert based on the comparison.

7. The method of claim 1, further comprising:

comparing the value for the aggregate KPI to a threshold; and

generating a notable event based on the comparison.

8. The method of claim 1, further comprising:

comparing the value for the aggregate KPI to a threshold; and

causing display of an entry in an incident-review dashboard based on the comparison.

9. The method of claim 1 wherein the search query defining a KPI derives the value for that KPI in part by applying a late-binding schema to machine data.

10. The method of claim 1 wherein the search query defining a KPI derives the value for that KPI in part by applying a late-binding schema to events containing portions of the machine data.

11. The method of claim 1 wherein deriving a value for each of a plurality of key performance indicators (KPIs) comprises executing the search query defining each KPI in accordance with a user-specified frequency.

12. The method of claim 1 wherein deriving a value for each of a plurality of key performance indicators (KPIs) comprises executing the search query defining each KPI in accordance with a user-specified schedule.

13. The method of claim 1 wherein determining the value for the aggregate KPI includes applying a weighting associated with at least one of the KPIs.

14. The method of claim 1 wherein determining the value for the aggregate KPI includes applying a user-specified weighting associated with at least one of the KPIs.

15. The method of claim 1 wherein determining the value for the aggregate KPI includes, for each KPI, applying a corresponding weighting to the value derived for the KPI.

16. The method of claim 1 wherein determining a value for an aggregate KPI is based at least in part on mapping the value for each of the plurality of KPIs to one of a plurality of states, each state defined by a range of values.

17. A system comprising:

a memory; and

a processing device coupled with the memory to perform operation comprising;

deriving a value for each of a plurality of key performance indicators (KPIs), each KPI indicating an aspect of a service provided by one or more entities, each KPI defined by a search query that derives the value for that KPI from machine data associated with at least one of the entities that provide the service, each of the entities having a respective entity definition including information identifying the machine data associated with the respective entity, and the service having a service definition associating each of the entity definitions; and

determining a value for an aggregate KPI for the service from the values for each of the plurality of KPIs,

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

18. The system of claim 17 wherein the machine data includes segments of machine data each associated with a respective timestamped event.

19. The system of claim 17 wherein the machine data associated with a particular one of the entities comes from two or more sources.

20. The system of claim 17 wherein the machine data associated with a particular one of the entities comes from a first source in accordance with a first data representation and from a second source in accordance with a second data representation.

21. The system of claim 17 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.

22. The system of claim 17 further to:

compare the value for the aggregate KPI to a threshold; and

indicate an alert based on the comparison.

23. The system of claim 17 further to:

compare the value for the aggregate KPI to a threshold; and

generate a notable event based on the comparison.

24. The system of claim 17 further to:

compare the value for the aggregate KPI to a threshold; and

cause display of an entry in an incident-review dashboard based on the comparison.

25. The system of claim 17 wherein the search query defining a KPI derives the value for that KPI in part by applying a late-binding schema to machine data.

26. The system of claim 17 wherein the search query defining a KPI derives the value for that KPI in part by applying a late-binding schema to events containing portions of the machine data.

27. The system of claim 17 wherein to derive a value for each of a plurality of key performance indicators (KPIs) comprises executing the search query defining each KPI in accordance with a user-specified frequency.

28. The system of claim 17 wherein to derive a value for each of a plurality of key performance indicators (KPIs) comprises executing the search query defining each KPI in accordance with a user-specified schedule.

29. The system of claim 17 wherein to determine the value for the aggregate KPI includes applying a user-specified weighting associated with at least one of the KPIs.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

deriving a value for each of a plurality of key performance indicators (KPIs), each KPI indicating an aspect of a service provided by one or more entities, each KPI defined by a search query that derives the value for that KPI from machine data associated with at least one of the entities that provide the service, each of the entities having a respective entity definition including information identifying the machine data associated with the respective entity, and the service having a service definition associating each of the entity definitions; and

determining a value for an aggregate KPI for the service from the values for each of the plurality of KPIs,

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.