INTERFACE FOR AUTOMATED SERVICE DISCOVERY IN I.T. ENVIRONMENTS

• US 20170017368A1
• Filed: 09/26/2016
• Published: 01/19/2017
• Est. Priority Date: 01/31/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Maheshwari, Sonal, Shcherbakov, Vladimir, Goyal, Mehul, Ashpole, David Gustav
• Granted Patent: US 10,198,155 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9032 Query formulation
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment

Abstract

An automatic service monitor in an information technology environment may be equipped to automatically process machine data originating from a running IT environment to identify the entities that perform services in the environment, and to reflect the discovered entities and service associations in the control and configuration data that directs the monitoring operations performed by the system. A related user interface is taught.

Claims

1. A method comprising:

causing display of a user interface including a representation of an entity and a corresponding service association, wherein an identification of the entity and the corresponding service association are determined from machine data of a field-searchable event data store related to the provision of one or more services;

receiving user input via the user interface indicating confirmation of the entity and the corresponding service association;

updating configuration data of a service monitoring system in accordance with the user input to reflect the identification of the entity and the corresponding service association;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed in a computer system comprising one or more processors.

2. The method of claim 1 wherein events of event data store each have a segment of the machine data.

3. The method of claim 1 wherein events of event data store each have a segment of the machine data and a timestamp.

4. The method of claim 1 wherein the field-searchable event data store is accessed in accordance with a late-binding schema.

5. The method of claim 1 wherein the field-searchable event data store is accessed in accordance with a late-binding schema having one or more field extraction rules.

6. The method of claim 1 wherein the machine data is produced by more than one source.

7. The method of claim 1 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

8. The method of claim 1 wherein the representation of the entity and corresponding service association appears in a row of a tabular display.

9. The method of claim 1 wherein the representation of the entity and corresponding service association appears in a row of a tabular display, the row including an interactive element enabling a user to indicate selection of the row.

10. The method of claim 1 further comprising:

receiving user input indicating a bulk action and the selection of one or more rows of a tabular display;

performing the bulk action against each row of the tabular display indicated for selection; and

wherein the representation of the entity and corresponding service association appears in a row of a tabular display, the row enabling a user to indicate selection of the row.

11. The method of claim 1 further comprising:

receiving user input indicating a bulk action and the selection of one or more rows of a tabular display;

performing the bulk action against each row of the tabular display indicated for selection; and

wherein the representation of the entity and corresponding service association appears in a row of a tabular display, the row including an interactive element enabling a user to indicate selection of the row.

12. The method of claim 1 further comprising:

receiving user input indicating a bulk action and the selection of one or more rows of a tabular display;

performing the bulk action against each row of the tabular display indicated for selection;

wherein the representation of the entity and corresponding service association appears in a row of a tabular display, the row enabling a user to indicate selection of the row; and

wherein the bulk action includes modifying the service association.

13. The method of claim 1 wherein the representation of an entity and a corresponding service association includes a graphical depiction of the entity and the service association.

14. The method of claim 1 wherein the representation of an entity and a corresponding service association includes a graphical depiction of the service association as a graphical depiction of the service completely subsuming a graphical depiction of the entity.

15. The method of claim 1 wherein the representation of an entity and a corresponding service association includes a graphical depiction of the entity and the service association, the method further comprising:

receiving pointer location information indicating user placement of a pointer over the graphical depiction of the entity;

causing the display of a user interface presenting information about the entity in response to the pointer location information.

16. The method of claim 1 further comprising:

causing the display of a user interface including information about the status of said updating configuration data of a service monitoring system.

17. The method of claim 1 further comprising:

causing the display of a user interface including a summary about entity and/or service definitions of the configuration data affected by said updating.

18. The method of claim 1 wherein the configuration data includes one or more stored definitions.

19. The method of claim 1 wherein updating the configuration data includes adding at least one service definition and at least one entity definition.

20. The method of claim 1 wherein updating the configuration data includes modifying at least one from among an existing service definition and an existing entity definition.

21. The method of claim 1 wherein automatic operations of the service monitoring system are determined at least in part by the configuration data.

22. The method of claim 1 wherein the machine data includes data of a network traffic stream.

23. The method of claim 1 wherein the machine data includes data produced by an operating system about active units of work.

24. The method of claim 1 The method of claim 1 wherein the machine data includes data of a network traffic stream and data produced by an operating system about active units of work.

25. A system comprising:

a memory; and

a processing device coupled with the memory to;

cause display of a user interface including a representation of an entity and a corresponding service association, wherein an identification of the entity and the corresponding service association are determined from machine data of a field-searchable event data store related to the provision of one or more services;

receive user input via the user interface indicating confirmation of the entity and the corresponding service association; and

update configuration data of a service monitoring system in accordance with the user input to reflect the identification of the entity and the corresponding service association;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

26. The system of claim 25 wherein events of event data store each have a segment of the machine data and a timestamp.

27. The system of claim 25 wherein the field-searchable event data store is accessed in accordance with a late-binding schema.

28. The system of claim 25 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

29. The system of claim 25 further comprising to:

receive user input indicating a bulk action and the selection of one or more rows of a tabular display; and

perform the bulk action against each row of the tabular display indicated for selection;

wherein the representation of the entity and corresponding service association appears in a row of a tabular display, the row enabling a user to indicate selection of the row.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of a user interface including a representation of an entity and a corresponding service association, wherein an identification of the entity and the corresponding service association are determined from machine data of a field-searchable event data store related to the provision of one or more services;

receiving user input via the user interface indicating confirmation of the entity and the corresponding service association; and

updating configuration data of a service monitoring system in accordance with the user input to reflect the identification of the entity and the corresponding service association;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.