Automatic event group actions

A system comprising:

• a memory;
• and a processing device coupled with the memory to:
• identify a group of events from among a plurality of events in an event datastore based at least in part on group membership criteria of an event group policy definition;
• automatically determine a satisfaction of a precondition based at least in part on information about the precondition included in the event group policy definition;
• automatically cause a group action to be performed based at least in part on the satisfaction of the precondition and on information about the group action included in the event group policy definition;
• wherein a performance of the group action updates stored information reflective of each of the events identified for the group;
• wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service;
• and wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• identifying a group of events from among a plurality of events in an event datastore based at least in part on group membership criteria of an event group policy definition;
• automatically determining a satisfaction of a precondition based at least in part on information about the precondition included in the event group policy definition;
• automatically causing a group action to be performed based at least in part on the satisfaction of the precondition and on information about the group action included in the event group policy definition;
• wherein a performance of the group action updates stored information reflective of each of the events identified for the group;
• wherein one or more events of the plurality of events in the event datastore is each a notable event produced by a correlation search against stored key performance indicator (KPI) values, each KPI value produced by a search query that defines the KPI and that derives the KPI value from machine data associated with one or more entities that perform a service, each entity having an entity definition that identifies machine data associated with the respective entity, and each said entity definition associated with a service definition representing the service;
• and wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.