Machine Data-Derived Key Performance Indicators with Per-Entity States

摘要

Raw machine data are captured and may be organized as events. Entity definitions representing machine entities that perform a service identify the machine data pertaining to respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. The derivation may be performed on a per-entity basis and on the aggregate. The derived values may then be translated into a state value domain using per-entity thresholds, aggregate thresholds, or a combination.

主权项

1. A method comprising:
causing display of a user interface having a threshold portion associated with a KPI, the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; wherein the derived value for the KPI reflects a measure of the performance of the service; and wherein the method is performed by a computer system comprising one or more processors coupled to computer storage.