# US 10,503,348 B2 · Graphical user interface for static and adaptive thresholds > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,348 B2 - Document ID: US10503348B2 - Status: Granted - Kind: B2 - Application number: 15/662,916 - Filed: 2017-07-28 - Published: 2017-11-16 - Granted: 2019-12-10 - Earliest claimed: 2014-10-09 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Sonal Maheshwari; Manish Sainani; Leonid Alekseyev; Alan Hardin; Jacob Barton Leverich; Adam Jamison Oliner; Brian Reyes; Alok Anant Bhide - Web page: https://patentgrep.com/patent/US10503348B2 ## CPC - G06F 3/0481: based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance - G06F 3/04812: Interaction techniques based on cursor appearance or behaviour, e.g. being affected by the presence of displayed objects - G06F 16/2474: {Sequence data queries, e.g. querying versioned data} - G06F 16/248: Presentation of query results - G06Q 10/06393: {Score-carding, benchmarking or key performance indicator [KPI] analysis} - G06Q 10/109: Time management, e.g. calendars, reminders, meetings or time accounting - G06T 11/26: Drawing of charts or graphs - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques are disclosed for providing a graphical user interface (GUI) for displaying and configuring adaptive or static thresholds for Key Performance Indicators (KPIs). The GUI may include one or more presentation schedules that may display threshold information associated with time policies. Each presentation schedule may include multiple time slots and span a portion of one or more time cycles. Some of the time slots may be associated with a specific time policy and may have a unifying appearance that distinguishes the time slots from timeslots associated with other time policies. The presentation schedules may arrange the time slots in a time grid arrangement (e.g., calendar grid view) or a graph arrangement with depictions (e.g., points, lines) that may illustrate KPI values and threshold markers that may illustrate the threshold values. ## Claims ### Claim 1 A method comprising: accessing stored threshold information for one or more time policies associated with a Key Performance Indicator (KPI), the KPI defined by a search query that derives a value from machine data, the value indicative of the performance of a service at a point in time or over a period of time, the service represented by a stored service definition associating one or more entities that provide the service, and each of the entities represented by a stored entity definition comprising an identification of the machine data pertaining to the entity; determining a correspondence between one of the time policies and one or more time slots; causing display of a user interface including a presentation schedule comprising the one or more time slots, wherein the one or more time slots have a unifying appearance; wherein each of the one or more time policies is of a static time policy type or an adaptive time policy type, the static time policy type having a threshold with a user-indicated static threshold value, and the adaptive time policy type having a threshold with an adaptive threshold value provided automatically by the system based at least in part on historical values of the KPI, each threshold defining an end of a range of values corresponding to a KPI state; wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and wherein the method is performed by a computer system comprising one or more processors coupled to computer storage. ### Claim 2 (depends on 1) The method of claim 1, wherein the unifying appearance of the time slots in the presentation schedule indicates that the one or more time slots correspond to an in-focus time policy, wherein the in-focus time policy is identified based on user input. ### Claim 3 (depends on 1) The method of claim 1, wherein the unifying appearance of the one or more time slots in the presentation schedule comprises a visual attribute to distinguish the one or more time slots from a time slot that corresponds to another time policy in the presentation schedule. ### Claim 4 (depends on 1) The method of claim 1, wherein each of the time slots in the presentation schedule represents a continuous duration of time. ### Claim 5 (depends on 1) The method of claim 1, wherein each of the time policies identifies a time frame and associates the threshold of the time policy with the time frame, the time frame occurring one or more times within a time cycle. ### Claim 6 (depends on 1) The method of claim 1, wherein the unifying appearance of the time slots in the presentation schedule indicates that the one or more time slots correspond to an in-focus time policy identified based on user input, and wherein each of the time slots in the presentation schedule represents a continuous duration of time. ### Claim 7 (depends on 1) The method of claim 1, wherein the time policies comprise a static time policy and an adaptive time policy. ### Claim 8 (depends on 1) The method of claim 1, further comprising: analyzing a plurality of historical values of the KPI within a defined window of time to determine a statistical metric indicating changes of the historical values within the defined window of time; and updating the adaptive threshold value of at least one adaptive time policy based on the statistical metric. ### Claim 9 (depends on 1) The method of claim 1, wherein the presentation schedule comprises a depiction of a plurality of values of the KPI over a time cycle spanning the one or more time slots. ### Claim 10 (depends on 1) The method of claim 1, wherein the user interface further includes a graphical visualization associated with a particular time policy of the one or more time policies, the graphical visualization comprising a graph having a horizontal axis indicating a duration of time and a vertical axis with one or more threshold markers illustrating one or more thresholds associated with the particular time policy. ### Claim 11 (depends on 1) The method of claim 1, wherein the user interface further includes a graphical visualization comprising multiple user adjustable threshold markers and a graphical control element enabling a user to add an additional threshold to one of the time policies. ### Claim 12 (depends on 1) The method of claim 1, wherein each of the time slots in the presentation schedule includes a visual attribute to distinguish the range of values corresponding to the KPI state from a range of values corresponding to a different KPI state. ### Claim 13 (depends on 1) The method of claim 1, further comprising: receiving user input adjusting a threshold marker of the threshold of one of the time policies; and updating a value of the threshold. ### Claim 14 (depends on 1) The method of claim 1, further comprising: receiving a first user input identifying one of the time policies; and receiving a second user input to change the identified time policy from an adaptive time policy type to a static time policy type. ### Claim 15 (depends on 1) The method of claim 1, wherein the presentation schedule comprises a time grid illustrating one or more time frames of one or more in-focus time policies. ### Claim 16 (depends on 1) The method of claim 1, the user interface further including a second presentation schedule and a listing of the time policies, wherein an identification of one of the time policies causes the presentation schedule and the second presentation schedule to be updated to display threshold information associated with the identified time policy. ### Claim 17 (depends on 1) The method of claim 1, wherein the user interface further comprises a hover display that provides threshold information when user input identifies one or more of the time slots. ### Claim 18 (depends on 1) The method of claim 1, wherein the presentation schedule comprises a graph having a first depiction and a second depiction, the first depiction illustrating a contribution of a first entity to the KPI and the second depiction illustrating a contribution of a second entity to the KPI. ### Claim 19 (depends on 1) The method of claim 1, wherein the presentation schedule comprises a first depiction corresponding to values of the KPI derived from a portion of training data associated with a first time cycle and a second depiction corresponding to values of the KPI derived from a portion of training data associated with a second time cycle. ### Claim 20 (depends on 1) The method of claim 1, further comprising running the search query defining the KPI to derive the value of the KPI and determining the KPI state corresponding to the range of values that includes the derived value of the KPI. ### Claim 21 (depends on 1) The method of claim 1, wherein the machine data is stored as time-stamped events. ### Claim 22 (depends on 1) The method of claim 1, wherein the machine data is stored as time-stamped events, where each time-stamped event includes a portion of raw machine data. ### Claim 23 (depends on 1) The method of claim 1, wherein the machine data is stored as time-stamped events including portions of raw machine data and is accessed using a late-binding schema. ### Claim 24 (depends on 1) The method of claim 1, wherein the search query uses a late-binding schema to extract values indicative of the performance of the service from time-stamped events after the search query is initiated. ### Claim 25 (depends on 1) The method of claim 1, wherein the machine data pertaining to an entity of the one or more entities comprises heterogeneous machine data from multiple sources. ### Claim 26 (depends on 1) The method of claim 1, wherein the machine data pertaining to an entity of the one or more enties comprises machine data from the entity and another entity. ### Claim 27 A system comprising: a memory; and a processing device coupled with the memory to: access stored threshold information for one or more time policies associated with a Key Performance Indicator (KPI), the KPI defined by a search query that derives a value from machine data, the value indicative of the performance of a service at a point in time or over a period of time, the service represented by a stored service definition associating one or more entities that provide the service, and each of the entities represented by a stored entity definition comprising an identification of the machine data pertaining to the entity; determine a correspondence between one of the time policies and one or more time slots; cause display of a user interface including a presentation schedule comprising the one or more time slots, wherein the one or more time slots have a unifying appearance; wherein each of the one or more time policies is of a static time policy type or an adaptive time policy type, the static time policy type having a threshold with a user-indicated static threshold value, and the adaptive time policy type having a threshold with an adaptive threshold value provided automatically by the system based at least in part on historical values of the KPI, each threshold defining an end of a range of values corresponding to a KPI state; and wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment. ### Claim 28 (depends on 27) The system of claim 27, wherein the unifying appearance of the time slots in the presentation schedule indicates that the time slots correspond to an in-focus time policy, wherein the in-focus time policy is identified based on user input. ### Claim 29 A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, causes the processing device to perform operations comprising: accessing stored threshold information for one or more time policies associated with a Key Performance Indicator (KPI), the KPI defined by a search query that derives a value from machine data, the value indicative of the performance of a service at a point in time or over a period of time, the service represented by a stored service definition associating one or more entities that provide the service, and each of the entities represented by a stored entity definition comprising an identification of the machine data pertaining to the entity; determining a correspondence between one of the time policies and one or more time slots; causing display of a user interface including a presentation schedule comprising the one or more time slots, wherein the one or more time slots have a unifying appearance; wherein each of the one or more time policies is of a static time policy type or an adaptive time policy type, the static time policy type having a threshold with a user-indicated static threshold value, and the adaptive time policy type having a threshold with an adaptive threshold value provided automatically by the system based at least in part on historical values of the KPI, each threshold defining an end of a range of values corresponding to a KPI state; and wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment. ### Claim 30 (depends on 29) The non-transitory computer readable storage medium of claim 29, wherein the unifying appearance of the time slots in the presentation schedule indicates that the time slots correspond to an in-focus time policy, wherein the in-focus time policy is identified based on user input.