Automatic event group action interface

Patent metadata

Field	Value
Publication number	US-10193775-B2
Application number	US-201615276750-A
Country	US
Kind code	B2
Filing date	Sep 26, 2016
Priority date	Oct 9, 2014
Publication date	Jan 29, 2019
Grant date	Jan 29, 2019

Abstract

An automatic service monitor in an information technology environment is equipped to automatically identify and group recognized events based on user-defined criteria, and to automatically perform user-defined operations against the group and its members at the detection of user-specified conditions. A related user interface is taught.

First claim

What is claimed is:

1. A method comprising: causing display of an interface enabling a user to indicate information to control the operation of a service monitoring system to automatically identify and update a group of events from among a plurality of events in an event datastore; receiving user input via the interface including: an indication of group membership criteria; an indication of a causable group action; an indication of a precondition related to the causable group action; creating an event group policy definition in computer storage based at least in part on the group membership criteria, the causable group action, and the precondition; wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service; wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and wherein the method is performed by one or more processing devices.

2. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data.

3. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data; and
wherein the event datastore and the machine data event datastore are a common datastore.

4. The method of claim 1 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of events each including a segment of machine data and a timestamp.

5. The method of claim 1 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema.

6. The method of claim 1 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema having one or more field extraction rules.

7. The method of claim 1 wherein the machine data is produced by more than one source.

8. The method of claim 1 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

9. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore.

10. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and a group breaking condition.

11. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, and an identification of a source of information descriptive of the group.

12. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore and an identification of a group splitting field.

13. The method of claim 1 wherein the group membership criteria includes a matching criteria for field data of the event datastore, an identification of a group splitting field, and a group breaking condition.

14. The method of claim 1 wherein the indication of the causable group action indicates whether the causable action applies to all or some of the events of the group.

15. The method of claim 1 wherein the indication of the causable group action indicates the identification of a field to be modified.

16. The method of claim 1 wherein the indication of the causable group action indicates a field value to store.

17. The method of claim 1 wherein the indication of the precondition indicates at least one from among a group size limit, a group time limit, and an event identification.

18. The method of claim 1 wherein the indication of the precondition indicates at least one group time limit from among a group timespan limit and a group idle time limit.

19. The method of claim 1 wherein to update a group of events includes at least one from among modifying a stored representation of each of the events of the group and modifying a stored collective representation of the group.

20. The method of claim 1 wherein to update a group of events includes causing the performance of the causable action in response to a satisfaction of the precondition and wherein the causable action stores a particular value in a particular field of each of the events of the event group.

21. A system comprising: a memory; and a processing device coupled with the memory to: cause display of an interface enabling a user to indicate information to control the operation of a service monitoring system to automatically identify and update a group of events from among a plurality of events in an event datastore; receive user input via the interface including: an indication of group membership criteria; an indication of a causable group action; an indication of a precondition related to the causable group action; create an event group policy definition in computer storage based at least in part on the group membership criteria, the causable group action, and the precondition; wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service; and wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

22. The system of claim 21 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of machine data events each including a segment of the machine data.

23. The system of claim 21 wherein the machine data associated with one or more entities are represented in a field-searchable machine data event datastore having a plurality of events each including a segment of machine data and a timestamp.

24. The system of claim 21 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema.

25. The system of claim 21 wherein the field-searchable machine data event datastore is accessed in accordance with a late-binding schema having one or more field extraction rules.

26. The system of claim 21 wherein the machine data is produced by more than one source.

27. The system of claim 21 wherein the machine data is produced by a plurality of sources

Assignees

• Splunk Inc

Inventors

• Fletcher Tristan Antonio
• Choudhary Hemendra Singh
• Lazerowitz Ross Andrew
• Sridhar Chakravarthy

Classifications

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L43/08 Primary

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• G06F3/04842

  Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) · CPC title

• G06F3/0484

  for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range · CPC title