Mapping key performance indicators derived from machine data to dashboard templates

Patent metadata

Field	Value
Publication number	US-9596146-B2
Application number	US-201615012817-A
Country	US
Kind code	B2
Filing date	Feb 1, 2016
Priority date	Oct 9, 2014
Publication date	Mar 14, 2017
Grant date	Mar 14, 2017

Abstract

Raw machine data are captured and organized as events. Entity definitions representing machine entities that perform a service identify the machine data associated with respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. A dashboard template having an identifier for the KPI is presented by a graphical interface. The identifier presents at a user-designated location and may be a widget that provides a numerical or graphical representation of one or more values for the KPI. Embodiments may allow modification of the template.

First claim

What is claimed is:

1. A method comprising:
causing display of a dashboard template in a graphical interface having an identifier for a KPI at a designated location, the KPI defined by a search query that derives one or more values for the KPI from machine data identified in stored entity definitions for one or more entities that perform a service, the one or more values reflecting a measure of the service;
wherein the KPI and the designated location are based on dashboard specification information in computer storage, the dashboard specification information based at least in part on prior user input;
wherein each stored entity definition identifies machine data generated by or about a corresponding one of the entities, and is associated with a stored service definition for the service;
wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and
wherein the method is performed by a computer system comprising one or more processors coupled to the computer storage.

2. The method of claim 1 wherein the machine data associated with one of the entities comes from more than one source.

3. The method of claim 1 wherein the machine data are organized as events each having a segment of raw machine data.

4. The method of claim 1 wherein the search query is in a format for execution by an event processing system.

5. The method of claim 1 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.

6. The method of claim 1 wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI.

7. The method of claim 1 wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI and having a style indicated in the dashboard specification information.

8. The method of claim 1 wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI, and wherein the identifier for the KPI includes the widget.

9. The method of claim 1 wherein causing the display further includes enabling user interaction to modify the dashboard specification information.

10. The method of claim 1 wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to a background of the dashboard template.

11. The method of claim 1 wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to a background of the dashboard template, the background comprising an image.

12. The method of claim 1 wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to a second KPI.

13. The method of claim 1 wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to at least one of the designated location and the KPI.

14. A system comprising:
a memory; and
a processing device coupled with the memory to:
cause display of a dashboard template in a graphical interface having an identifier for a KPI at a designated location, the KPI defined by a search query that derives one or more values for the KPI from machine data identified in stored entity definitions for one or more entities that perform a service, the one or more values reflecting a measure of the service;
wherein the KPI and the designated location are based on dashboard specification information in computer storage, the dashboard specification information based at least in part on prior user input;
wherein each stored entity definition identifies machine data generated by or about a corresponding one of the entities, and is associated with a stored service definition for the service; and
wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

15. The system of claim 14 wherein the search query is in a format for execution by an event processing system.

16. The system of claim 14 wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI.

17. The system of claim 14 wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI, and wherein the identifier for the KPI includes the widget.

18. The system of claim 14 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source.

19. The system of claim 14 wherein the machine data associated with one of the entities comes from more than one source.

20. The system of claim 14 wherein the machine data are organized as events each having a segment of raw machine data.

21. The system of claim 14 wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI and having a style indicated in the dashboard specification information.

22. The system of claim 14 wherein to cause the display further includes enabling user interaction to modify the dashboard specification information.

23. The system of claim 14 wherein to cause the display further includes enabling user interaction to modify the dashboard specification information related to at least one of the designated location and the KPI.

24. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
causing display of a dashboard template in a graphical interface having an identifier for a KPI at a designated location, the KPI defined by a search query that derives one or more values for the KPI from machine data identified in stored entity definitions for one or more entities that perform a service, the one or more values reflecting a measure of the service;
wherein the KPI and the designated location are based on dashboard specification information in computer storage, the dashboard specification information based at least in part on prior user input;
wherein each stored entity definition identifies machine data generated by or about a corresponding one of the entities, and is associated with a stored service definition for the service; and
wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

25. The non-transi

Assignees

• Splunk Inc

Inventors

• Coates John Robert
• Malviya Poorva
• Bingham Brian John

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• G06F3/0481

  based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance · CPC title

• G06F16/26

  Visual data mining; Browsing structured data · CPC title

• G06F3/04817

  using icons (graphical or visual programming using iconic symbols G06F8/34) · CPC title

• H04L41/0806

  for initial configuration or provisioning, e.g. plug-and-play · CPC title