System monitoring with key performance indicators from shared base search of machine data
An automatic service monitor in an information technology environment has its operation controlled by information that, in part, define entities that perform services and define key performance indicators (KPIs) that indicate measures of performance of the services. KPIs are defined in terms of search queries applied against machine data by or about the entities that perform the services. The search query aspects of multiple KPI definitions may be tied to a shared base search. Implementation of the shared base search may permit improved performance of the service monitor and may permit a reduction in administrative burden.
1. A computer-implemented method comprising:
creating and storing one or more entity definitions that each identify machine data produced by or about an entity, the machine data produced by one or more components within an information technology environment and reflecting activity within the information technology environment;
creating and storing a service definition for a service provided by one or more entities, the service definition associating a corresponding one of said entity definitions for each of one or more entities that provide the service;
providing a user interface to receive user input for a search definition of a shared search to be executed to produce two or more metric values associated with two or more key performance indicators (KPIs), wherein the user interface comprises a metric portion to specify one or more metrics for each of the KPIs;
creating and storing the search definition for the shared search that produces the two or more metric values each characterizing a different aspect of machine data identified in the entity definitions associated with the service definition;
creating definitions for each of the two or more KPIs, each KPI associated with a different one of the metric values produced by the shared search and each KPI indicative of how the service is performing at a point in time or during a period of time;
accessing, by one or more processing devices, data identifying a monitoring schedule that is stored in memory to control execution of a search query; and
repeatedly executing, by the one or more processing devices, the search query based at least in part on the search definition of the shared search in accordance with the monitoring schedule to produce values for each of the two or more KPIs in accordance with the monitoring schedule, wherein the values for the two or more KPIs are derived from the machine data during each single execution of the search query.
2. The method of claim 1 , wherein repeatedly executing the search query further includes producing per-entity values corresponding to the values for each of the KPIs during each single execution of the search query.
3. The method of claim 1 , further comprising:
changing the search definition in response to additional user input and automatically making corresponding changes to the definitions for the KPIs.
4. The method of claim 1 , wherein providing the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information.
5. The method of claim 1 , wherein providing the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information including a search identifier, the monitoring schedule, and a calculation window.
6. The method of claim 1 , wherein providing the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information including search definition information related to per-entity processing and to service entity filtering.
7. The method of claim 1 , wherein providing the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information including a search identifier, the monitoring schedule, a calculation window, and search definition information related to per-entity processing and to service entity filtering.
8. The method of claim 1 , wherein the machine data identified by at least one particular entity definition is derived from different sources.
9. The method of claim 1 , wherein the machine data identified by at least one particular entity definition includes data in different formats.
10. The method of claim 1 , wherein the machine data identified by at least one particular entity definition includes log data produced by the corresponding entity.
11. The method of claim 1 , wherein the machine data identified by at least one particular entity definition is represented as events comprising a portion of raw data.
12. The method of claim 1 , wherein the machine data identified by at least one particular entity definition is represented as events comprising a portion of raw data and wherein the particular entity definition identifies the machine data by reference to one or more fields of a late-binding schema.
13. A system comprising:
a memory; and
a processing device coupled with the memory to:
create and store one or more entity definitions that each identify machine data produced by or about an entity, the machine data produced by one or more components within an information technology environment and reflecting activity within the information technology environment;
create and store a service definition for a service provided by one or more entities, the service definition associating a corresponding one of said entity definitions for each of one or more entities that provide the service;
provide a user interface to receive user input for a search definition of a shared search to be executed to produce two or more metric values associated with two or more key performance indicators (KPIs), wherein the user interface comprises a metric portion to specify one or more metrics for each of the KPIs;
create and store the search definition for the shared search that produces the two or more metric values each characterizing a different aspect of machine data identified in the entity definitions associated with the service definition;
create definitions for each of the two or more KPIs, each KPI associated with a different one of the metric values produced by the shared search and each KPI indicative of how the service is performing at a point in time or during a period of time;
access, by the processing device, data identifying a monitoring schedule that is stored in memory to control execution of a search query; and
repeatedly execute, by the processing device, the search query based at least in part on the search definition of the shared search in accordance with the monitoring schedule to produce values for each of the two or more KPIs in accordance with the monitoring schedule, wherein the values for the two or more KPIs are derived from the machine data during each single execution of the search query.
14. The system of claim 13 , wherein to repeatedly execute the search query further includes producing per-entity values corresponding to the values for each of the KPIs during each single execution of the search query.
15. The system of claim 13 , further comprising to:
change the search definition in response to additional user input and automatically making corresponding changes to the definitions for the KPIs.
16. The system of claim 13 , wherein to provide the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information.
17. The system of claim 13 , wherein to provide the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information including a search identifier, the monitoring schedule, and a calculation window.
18. The system of claim 13 , wherein to provide the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information including search definition information related to per-entity processing and to service entity filtering.
19. The system of claim 13 , wherein to provide the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information including a search identifier, the monitoring schedule, a calculation window, and search definition information related to per-entity processing and to service entity filtering.
20. The system of claim 13 , wherein the machine data identified by at least one particular entity definition is derived from different sources.
21. The system of claim 13 , wherein the machine data identified by at least one particular entity definition includes data in different formats.
22. The system of claim 13 , wherein the machine data identified by at least one particular entity definition includes log data produced by the corresponding entity.
23. The system of claim 13 , wherein the machine data identified by at least one particular entity definition is represented as events comprising a portion of raw data.
24. The system of claim 13 , wherein the machine data identified by at least one particular entity definition is represented as events comprising a portion of raw data and wherein the particular entity definition identifies the machine data by reference to one or more fields of a late-binding schema.
25. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
creating and storing one or more entity definitions that each identify machine data produced by or about an entity, the machine data produced by one or more components within an information technology environment and reflecting activity within the information technology environment;
creating and storing a service definition for a service provided by one or more entities, the service definition associating a corresponding one of said entity definitions for each of one or more entities that provide the service;
providing a user interface to receive user input for a search definition of a shared search to be executed to produce two or more metric values associated with two or more key performance indicators (KPIs), wherein the user interface comprises a metric portion to specify one or more metrics for each of the KPIs;
creating and storing the search definition for the shared search that produces the two or more metric values each characterizing a different aspect of machine data identified in the entity definitions associated with the service definition;
creating definitions for each of the two or more KPIs, each KPI associated with a different one of the metric values produced by the shared search and each KPI indicative of how the service is performing at a point in time or during a period of time;
accessing data identifying a monitoring schedule that is stored in memory to control execution of a search query; and
repeatedly executing the search query based at least in part on the search definition of the shared search in accordance with the monitoring schedule to produce values for each of the two or more KPIs in accordance with the monitoring schedule, wherein the values for the two or more KPIs are derived from the machine data during each single execution of the search query.
26. The non-transitory computer readable storage medium of claim 25 , wherein repeatedly executing the search query further includes producing per-entity values corresponding to the values for each of the KPIs during each single execution of the search query.
27. The non-transitory computer readable storage medium of claim 25 , the operations further comprising:
changing the search definition in response to additional user input and automatically making corresponding changes to the definitions for the KPIs.
28. The non-transitory computer readable storage medium of claim 25 , wherein providing the user interface to receive the user input for the search definition includes causing the display and processing of the user interface enabling a user to view, add, and/or make changes to search definition information.
29. The non-transitory computer readable storage medium of claim 25 , wherein the machine data identified by at least one particular entity definition is derived from different sources.
30. The non-transitory computer readable storage medium of claim 25 , wherein the machine data identified by at least one particular entity definition is represented as events comprising a portion of raw data and wherein the particular entity definition identifies the machine data by reference to one or more fields of a late-binding schema.