Automatic associations in an I.T. monitoring system

Patent metadata

Field	Value
Publication number	US-10521409-B2
Application number	US-201715663747-A
Country	US
Kind code	B2
Filing date	Jul 29, 2017
Priority date	Oct 9, 2014
Publication date	Dec 31, 2019
Grant date	Dec 31, 2019

Abstract

A computer system exposes an interface for the specification of filter criteria. The filter criteria may identify control information of a service monitoring system (SMS) that defines entities in an IT environment monitored by the SMS. An association of identified entities with a monitored service may be made to direct the ongoing operation of the SMS toward the service.

First claim

What is claimed is:

1. A method comprising:
presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions for association with a service definition in computer storage, the service definition representing a service in an information technology (IT) environment, and each entity definition representing an entity in the IT environment that performs the service, each entity definition comprising information for an identification of machine data pertaining to the entity, and wherein the service definition and the entity definitions are configuration information of a service monitoring system;
storing the filter criteria in association with the service definition in response to receiving the indication of the filter criteria via the interface;
identifying one or more entity definitions based at least in part on the filter criteria and reflecting in computer storage an association of at least one of the identified entity definitions with the service definition;
wherein the machine data is produced by one or more components within the IT environment and reflects activity within the IT environment;
wherein the method is performed by one or more processing devices.

2. The method of claim 1 , wherein the filter criteria is associated with an execution type, wherein the execution type is a static type or a dynamic type.

3. The method of claim 1 , wherein presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions comprises enabling an indication of an execution type associated with the filter criteria.

4. The method of claim 1 , wherein presenting a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions comprises enabling an indication of an execution type associated with the filter criteria, and wherein storing the filter criteria in association with the service definition comprises storing the execution type in association with the filter criteria.

5. The method of claim 1 , wherein the filter criteria comprises a name portion and a value portion.

6. The method of claim 1 , wherein the filter criteria comprises a name portion and a value portion for matching to an element name and an element value, respectively, of an entity definition component.

7. The method of claim 1 , wherein the filter criteria comprises a name portion and a value portion for matching to an element name and an element value, respectively, of an entity definition component, the entity definition component having an alias component type, an informational field component type, and/or a name component type.

8. The method of claim 1 , further comprising:
detecting a change among a plurality of entity definitions in a data store;
accessing the stored filter criteria in response to the change detected, and performing the identifying and the reflecting using the accessed filter criteria as the filter criteria.

9. The method of claim 1 , wherein presenting a service definition interface comprises displaying preview information about one or more entity definitions identified at least in part by applying indicated filter criteria.

10. The method of claim 1 , wherein reflecting in computer storage an association of at least one of the identified entity definitions with the service definition comprises storing an association indicator in at least one definition from among the service definition and the identified entity definitions.

11. The method of claim 1 , wherein reflecting in computer storage an association of at least one of the identified entity definitions with the service definition comprises storing the at least one identified entity definition in the service definition.

12. The method of claim 1 , wherein presenting a service definition interface comprises:
causing display of a list of one or more element names and enabling a user to indicate a selection from the list; and
enabling display of a list of one or more element values corresponding to a received selection indication.

13. The method of claim 1 , wherein presenting a service definition interface comprises:
causing display of a list of one or more element names from a plurality of entity definitions in a data store, and enabling a user to indicate a selection from the list; and
enabling display of a list of one or more element values from among the plurality of entity definitions and corresponding to a received selection indication.

14. The method of claim 1 , wherein presenting a service definition interface comprises:
causing display of a list of one or more element names associated with a particular component type and from a plurality of entity definitions in a data store, and enabling a user to indicate a selection from the list; and
enabling display of a list of one or more element values from among the plurality of entity definitions and corresponding to a received selection indication.

15. The method of claim 1 , wherein presenting a service definition interface comprises:
causing display of a list of one or more element names associated with a particular entity characteristic and from a plurality of entity definitions in a data store, and enabling a user to indicate a selection from the list; and
enabling display of a list of one or more element values from among the plurality of entity definitions and corresponding to a received selection indication;
wherein the particular entity characteristic is name, alias, and/or informational field.

16. The method of claim 1 , further comprising presenting a service definition interface portion including a list of entities represented by the identified one or more entity definitions.

17. The method of claim 1 , wherein the machine data pertaining to the entity includes machine data produced by the entity.

18. The method of claim 1 , wherein the machine data pertaining to the entity is obtained through an application programming interface (API) from software that monitors the performance of the entity.

19. The method of claim 1 , wherein the machine data pertaining to the entity is derived from network packet data that references the entity.

20. The method of claim 1 , wherein the machine data pertaining to the entity is represented as events comprising a portion of raw data.

21. The method of claim 1 , wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data.

22. The method of claim 1 , wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested from more than one source.

23. The method of claim 1 , wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested without regard to the service definition.

24. The method of claim 1 , wherein the machine data pertaining to the entity is represented as events comprising a timestamped portion of raw data ingested from more than one source without regard to the service definition.

25. A system comprising:
a memory; and
a processing device coupled with the memory to:
present a service definition interface enabling user input of an indication of a filter criteria for identifying one or more entity definitions for association with a service definition in

Assignees

• Splunk Inc

Inventors

• Alekseyev Leonid
• Boe Brent
• Sharp Clint

Classifications

• H04L41/5012

  determining service availability, e.g. which services are available at a certain point in time · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• H04L41/5045

  Making service definitions prior to deployment · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• G06F16/2322

  using timestamps · CPC title