Identifying system performance patterns in machine data

An apparatus for improving machine data analysis, comprising:

• a machine data receiving device, implemented at least partially in hardware, that receives machine data from two or more components in an information technology environment, the received machine data reflecting activity in the information technology environment;
• a real-time behavioral pattern recorder device, implemented at least partially in hardware, that records, in real-time, behavioral patterns among machine data from two or more different components among the two or more components in the information technology environment, the machine data among the received machine data;
• a real-time learning device, implemented at least partially in hardware, that learns, in real-time, new types of associative relationships between the behavioral patterns based on the co-occurrence of events within a time window bounded by a window threshold, wherein the window threshold changes based on data density or an amount of time available to complete the learning;
• wherein the real-time learning device analyzes the associative relationships to identify one or more associative relationships that frequently occur;
• wherein the one or more associative relationships that frequently occur are identified as representing typical system behavior in the information technology environment.

One or more non-transitory computer-readable storage media, storing software instructions for improving machine data analysis, which when executed by one or more processors cause performance of:

• receiving machine data from two or more components in an information technology environment, the received machine data reflecting activity in the information technology environment;
• recording, in real-time, behavioral patterns among machine data from two or more different components among the two or more components in the information technology environment, the machine data among the received machine data;
• learning, in real-time, new types of associative relationships between the behavioral patterns based on the co-occurrence of events within a time window bounded by a window threshold, wherein the window threshold changes based on data density or an amount of time available to complete the learning;
• analyzing the associative relationships to identify one or more associative relationships that frequently occur, wherein the one or more associative relationships that frequently occur are identified as representing typical system behavior in the information technology environment.