Machine data-derived key performance indicators with per-entity states
Raw machine data are captured and may be organized as events. Entity definitions representing machine entities that perform a service identify the machine data pertaining to respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. The derivation may be performed on a per-entity basis and on the aggregate. The derived values may then be translated into a state value domain using per-entity thresholds, aggregate thresholds, or a combination.
1. A method comprising:
causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states;
receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface;
storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds;
wherein the derived value for the KPI reflects a measure of the performance of the service; and
wherein the method is performed by a computer system comprising one or more processors coupled to computer storage.
2. The method of claim 1 wherein the determining of the KPI state includes:
determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and
selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.
3. The method of claim 1 wherein the determining of the KPI state includes:
determining an overall contribution by applying a determination component of the search query to the machine data;
determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and
selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.
4. The method of claim 1 further comprising:
causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.
5. The method of claim 1 further comprising:
causing display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity.
6. The method of claim 1 wherein the service corresponds to a service definition in computer storage associating the one or more entities that provide the service.
7. The method of claim 1 wherein the service corresponds to a service definition in computer storage associating an entity definition for each of the one or more entities that provide the service, each of said entity definitions identifying machine data pertaining to the respective entity.
8. The method of claim 1 wherein the machine data associated with at least one of the entities comes from more than one source.
9. The method of claim 1 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.
10. The method of claim 1 wherein the machine data are represented as stored event instances each having a segment of raw machine data.
11. A system comprising:
a memory; and
a processing device coupled with the memory to:
cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states;
receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; and
store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds.
12. The system of claim 11 wherein the determining of the KPI state includes:
determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and
selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.
13. The system of claim 11 wherein the determining of the KPI state includes:
determining an overall contribution by applying a determination component of the search query to the machine data;
determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and
selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.
14. The system of claim 11 further comprising to:
cause display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.
15. The system of claim 11 further comprising to:
cause display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity.
16. The system of claim 11 wherein the service corresponds to a service definition in computer storage associating the one or more entities that provide the service.
17. The system of claim 11 wherein the service corresponds to a service definition in computer storage associating an entity definition for each of the one or more entities that provide the service, each of said entity definitions identifying machine data pertaining to the respective entity.
18. The system of claim 11 wherein the machine data associated with at least one of the entities comes from more than one source.
19. The system of claim 11 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.
20. The system of claim 11 wherein the machine data are represented as stored event instances each having a segment of raw machine data.
21. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states;
receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface;
storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; and
wherein the derived value for the KPI reflects a measure of the performance of the service.
22. The non-transitory computer readable storage medium of claim 21 wherein the determining of the KPI state includes:
determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and
selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.
23. The non-transitory computer readable storage medium of claim 21 wherein the determining of the KPI state includes:
determining an overall contribution by applying a determination component of the search query to the machine data;
determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and
selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.
24. The non-transitory computer readable storage medium of claim 21 , the operations further comprising:
causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.
25. The non-transitory computer readable storage medium of claim 21 , the operations further comprising:
causing display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity.
26. The non-transitory computer readable storage medium of claim 21 wherein the service corresponds to a service definition in computer storage associating the one or more entities that provide the service.
27. The non-transitory computer readable storage medium of claim 21 wherein the service corresponds to a service definition in computer storage associating an entity definition for each of the one or more entities that provide the service, each of said entity definitions identifying machine data pertaining to the respective entity.
28. The non-transitory computer readable storage medium of claim 21 wherein the machine data associated with at least one of the entities comes from more than one source.
29. The non-transitory computer readable storage medium of claim 21 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.
30. The non-transitory computer readable storage medium of claim 21 wherein the machine data are represented as stored event instances each having a segment of raw machine data.