Thresholds for key performance indicators derived from machine data

摘要

One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, identifying information for locating machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.

主权项

1. A method comprising:
accessing from stored memory a service definition for a service provided by one or more entities that each produce machine data or one or more entities about which machine data is generated, the service definition identifying the one or more entities that provide the service and, for each entity, identifying information for locating the machine data pertaining to that entity; accessing from stored memory at least one key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to the one or more entities identified in the service definition for the service, the value indicative of how the service is performing at a point in time or during a period of time, the value indicating one of a plurality of states of the KPI; causing display of a graphical interface enabling a user to set at least one threshold for the KPI, each threshold defining an end of a range of values representing a state of the plurality of states of the KPI; receiving through the graphical interface an indication of the at least one threshold for the KPI and recording, in accordance with the indication, the at least one threshold in stored memory in association with the KPI; and determining one of the plurality of states for the KPI in view of the at least one threshold, comprising automatically performing the search query for the KPI in accordance with a monitoring frequency, thereby making a transformation from machine data to derived KPI value; wherein the method is performed by a computer system comprising one or more processing devices coupled to the stored memory of the service definition, the KPI, and the at least one threshold.