An automatic service monitor in an information technology environment may be equipped to automatically process machine data originating from a running IT environment to identify the entities that perform services in the environment, and to reflect the discovered entities and service associations in the control and configuration data that directs the monitoring operations performed by the system.