Abstract:
An example method of determining a state of a key performance indicator (KPI) comprises: receiving one or more entity definitions, wherein each entity definition associates an entity with machine data pertaining to the entity; receiving a service definition for a service provided by one or more entities, the service definition including a reference to a corresponding entity definition of the entity definitions, wherein the service definition includes a respective reference for each of the one or more entities; receiving definitions of one or more KPIs, each KPI defined by a respective search query that produces a value derived from particular machine data, wherein the particular machine data is identified by the service definition, wherein each value is indicative of performance of the service at a point in time or during a period of time; deriving, by performing on the machine data a search query associated with the KPI, one or more KPI values for the KPI; selecting, among a plurality of states of the KPI, a state satisfying a condition applied to the one or more KPI values; and causing display of a visual indicator of the state of the KPI.
Abstract:
Systems and methods are described for performing adaptive thresholding on key performance indicator (KPI) values using an online machine learning algorithm as the KPI values or the data from which the KPI values are derived is being ingested. For example, the system can identify outliers in a moving window of KPI values. To implement the adaptive thresholding, the system may identify seasonality and/or trend components in historical KPI values. When a new KPI value is obtained, the system may remove the identified seasonality and/or trend components from the KPI value, and determine whether the modified KPI value is an outlier using sketches or quantiles. The system can then repeat this process for each subsequently received KPI value.
Abstract:
An automatic service monitor in an information technology environment has its operation controlled by information that, in part, defines entities that perform services and defines key performance indicators (KPIs) that indicate measures of performance of the services. Additional information controls the operation of the service monitor with respect to identifying and adapting for KPIs based on the non-normal data caused by maintenance work or other causes. Such adaptation may include changes in how reported information appears to the user.
Abstract:
An application executing on a mobile computing platform provides independent data channels over a mobile network to multiple separate computing systems that each maintain some data pertinent to problem determination and resolution when an incident arises in a monitored information technology (IT) environment. The application maintains and separately exercises the channels to provide timely information in a user interface that composites data to present a single interface with a multi-sourced contextual rendering. Some systems may include an IT monitoring system and a separate incident management system among its sources. Channels may include extended functionality to improve security or other aspects of communication with mobile platforms.
Abstract:
One or more processing devices access a service definition for a service provided by one or more entities that each produce machine data or about which machine data is generated. The service definition identifies the entities that provide the service and, for each entity, definitional information includes information for identifying machine data pertaining to that entity. The processing devices access a key performance indicator (KPI) for the service that is defined by a search query that produces a value derived from the machine data pertaining to the entities identified in the service definition. The value indicates how the service is performing at a point in time or during a period of time and indicates a state of the KPI. A graphical interface is displayed and an indication of at least one threshold, which defines an end of a range of values representing a state of the KPI, for the KPI is received.
Abstract:
A service monitoring system (SMS) produces key performance indicator (KPI) scores that indicate the performance of a service. To produce the KPI scores, the SMS may process the data for a large number of machine entities that perform the service. This data can be processed on a per-entity basis to produce a per-entity KPI score representing the contribution of a particular machine to the overall KPI. The per-entity KPI scores can be transformed to statistical representations which can be visualized as a distribution stream graph. The visualization may be presented with interactive aspects. Automatic entity definitions may also be generated based on content derived from the processed data.
Abstract:
One or more processing devices create one or more entity definitions that each associate an entity with machine data pertaining to that entity and create a service definition for a service provided by one or more entities. The service definition includes an entity definition for each of the one or more entities. The one or more processing devices create one or more key performance indicators (KPIs). Each KPI is defined by a search query that produces a value derived from the machine data identified in one or more of the entity definitions included in the service definition. Each value is indicative of how the service is performing at a point in time or during a period of time.
Abstract:
An automatic service monitor in an information technology environment is equipped to automatically identify and group recognized events based on user-defined criteria, and to automatically perform user-defined operations against the group and its members at the detection of user-specified conditions.
Abstract:
Techniques are disclosed for providing a topology navigator that may enable a user to view performance information for multiple IT services associated with a user's IT environment. The topology navigator may include multiple display components for displaying information about the services. A first display component may display multiple services as a graph of interdependent service nodes and a second display component may display information about one or more of the service nodes. The topology navigator may enable a user to visually inspect the aggregate KPI (e.g., health score) of multiple services to identify dependent services that are of interest (e.g., low performance) and navigate through the services to identify dependent services that may adversely affect a service of interest to the user. In one example, the second display component may display key performance indicators (KPIs) associated with the dependent service and the user may select one or more of the KPIs to add them to another display component for further analysis.
Abstract:
An automatic service monitor in an information technology environment has its operation controlled by information that, in part, define entities that perform services and define key performance indicators (KPIs) that indicate measures of performance of the services. KPIs are defined in terms of search queries applied against machine data by or about the entities that perform the services. The search query aspects of multiple KPI definitions may be tied to a shared base search. Implementation of the shared base search may permit improved performance of the service monitor and may permit a reduction in administrative burden.