Performing search queries for key performance indicators using an optimized common information model

Patent metadata

Field	Value
Publication number	US-11275775-B2
Application number	US-201514800678-A
Country	US
Kind code	B2
Filing date	Jul 15, 2015
Priority date	Oct 9, 2014
Publication date	Mar 15, 2022
Grant date	Mar 15, 2022

Abstract

Technologies are disclosed for providing a common information model. Features include: detecting a scheduled time for a key performance indicator reflecting how a service provided by one or more entities is performing, entity definition information recording the association between the entities and its machine data, service definition information associating the entities that provide the service, and the KPI being defined by a search query, including a field identifier specified in a data model, the KPI derives a value from the machine data; performing the query in response to said detecting, including: associating values in the machine data having disparate field names in accordance with disparate schemas with the field identifier specified in the data model, and processing the associated values as semantically equivalent data instances. In doing so, values having the same semantic (or related semantics) can be used together despite being associated with disparate field names from disparate schemas.

First claim

What is claimed is:

1. A method implemented by a computer system comprising one or more processors, the method comprising:
identifying a search query that derives a key performance indicator (KPI) value of a specified KPI by applying a late-binding schema to at least a portion of machine data associated with one or more entities providing an information technology (IT) service, wherein the specified KPI reflects an aspect of performance of the IT service, wherein the one or more entities are specified by an entity definition information associating each of the one or more entities with at least a corresponding portion of the machine data, wherein the corresponding portion of the machine data is generated by one of: a respective entity of one or more entities or a different entity that monitors performance of the respective entity;
continuously executing the search query in real-time;
detecting, based on a monitoring frequency associated with the specified KPI, a scheduled time for computing the specified KPI;
responsive to detecting the scheduled time, computing the specified KPI based on a result produced by the search query;
determining, based on the specified KPI and a plurality of KPI thresholds associated with the specified KPI, a state of the specified KPI;
determining, based on the state of the specified KPI and a weight coefficient associated with the specified KPI, an impact score of the specified KPI; and
updating, based on a plurality of KPIs and respective KPI impact scores, an aggregate KPI reflecting performance of the IT service, wherein the plurality of KPIs include the specified KPI.

2. The method of claim 1 , wherein the search query is defined in response to an input received via a graphical user interface (GUI).

3. The method of claim 1 , wherein the search query is defined using a data model selected from a list of available data models, wherein the list of available data models is specific to a service performance monitoring application.

4. The method of claim 1 , wherein the specified KPI is selected in response to an input received via a graphical user interface (GUI).

5. The method of claim 1 , wherein the specified KPI is associated with a point-in-time.

6. The method of claim 1 , wherein the specified KPI represents the aspect of performance of the IT service at a point-in-time.

7. The method of claim 1 , wherein the search query is defined using a data model for defining fields from multiple information sources, and wherein the data model comprises a root object and a child object.

8. The method of claim 1 , wherein the search query is defined using a data model for defining fields from multiple information sources, and wherein the data model comprises a root object and a child object, and wherein the child object is linked to the root object.

9. The method of claim 1 , wherein the search query is defined using a data model for defining fields from multiple information sources, and wherein the data model comprises a common information model (CIM).

10. A system comprising:
a memory storing a service information and an entity definition information; and
a processing device, operatively coupled to the memory, the processing device to:
identify a search query that derives a key performance indicator (KPI) value of a specified KPI by applying a late-binding schema to at least a portion of machine data associated with one or more entities providing an information technology (IT) service, wherein the specified KPI reflects an aspect of performance of the IT service, wherein the one or more entities are specified by the entity definition information associating each of the one or more entities with at least a corresponding portion of the machine data, wherein the corresponding portion of the machine data is generated by one of: a respective entity of one or more entities or a different entity that monitors performance of the respective entity;
continuously execute the search query in real-time;
detect, based on a monitoring frequency associated with the specified KPI, a scheduled time for computing the specified KPI;
responsive to detecting the scheduled time, compute the specified KPI based on a result produced by the search query;
determine, based on the specified KPI and a plurality of KPI thresholds associated with the specified KPI, a state of the specified KPI;
determine, based on the state of the specified KPI and a weight coefficient associated with the specified KPI, an impact score of the specified KPI; and
update, based on a plurality of KPIs and respective KPI impact scores, an aggregate KPI reflecting performance of the IT service, wherein the plurality of KPIs include the specified KPI.

11. The system of claim 10 , wherein the search query is defined in response to an input received via a graphical user interface (GUI).

12. The system of claim 10 , wherein the specified KPI is selected in response to an input received via a graphical user interface (GUI).

13. The system of claim 10 , wherein the KPI is associated with a point-in-time.

14. The system of claim 10 , wherein the KPI represents the aspect of performance of the IT service at a point-in-time.

15. The system of claim 10 , wherein the search query is defined using a data model for defining fields from multiple information sources, and wherein the data model comprises a root object and a child object.

16. The system of claim 10 , wherein the search query is defined using a data model for defining fields from multiple information sources, and wherein the data model comprises a root object and a child object, and wherein the child object is linked to the root object.

17. A non-transitory computer readable storage medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
identify a search query that derives a key performance indicator (KPI) value of a specified KPI by applying a late-binding schema to at least a portion of machine data associated with one or more entities providing an information technology (IT) service, wherein the specified KPI reflects an aspect of performance of the IT service, wherein the one or more entities are specified by an entity definition information associating each of the one or more entities with at least a corresponding portion of the machine data, wherein the corresponding portion of the machine data is generated by one of: a respective entity of one or more entities or a different entity that monitors performance of the respective entity;
continuously execute the search query in real-time;
detect, based on a monitoring frequency associated with the specified KPI, a scheduled time for computing the specified KPI;
responsive to detecting the scheduled time, compute the specified KPI based on a result produced by the search query;
determine, based on the specified KPI and a plurality of KPI thresholds associated with the specified KPI, a state of the specified KPI;
determine, based on the state of the specified KPI and a weight coefficient associated with the specified KPI, an impact score of the specified KPI; and
update, based on a plurality of KPIs and respective KPI impact scores, an aggregate KPI reflecting performance of the IT service, wherein the plurality of KPIs include the specified KPI.

18. The non-transitory computer readable storage medium of claim 17 , wherein the search query is defined in response to an input received via a graphical user interface (GUI).

19. The non-transitory computer readable storage medium of claim 1

Assignees

• Splunk Inc

Inventors

• Fletcher Tristan Antonio
• Sharp Clint
• Raghavan Anupadmaja

Classifications

• H04L69/329

  in the application layer [OSI layer 7] · CPC title

• G06F3/0482 Primary

  Interaction with lists of selectable items, e.g. menus · CPC title

• H04L41/5009

  Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] · CPC title

• H04L41/5032

  Generating service level reports · CPC title

• H04L41/0686

  Additional information in the notification, e.g. enhancement of specific meta-data · CPC title