# US 10,503,746 B2 · Incident review interface > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,746 B2 - Document ID: US10503746B2 - Status: Granted - Kind: B2 - Application number: 15/663,700 - Filed: 2017-07-28 - Published: 2017-11-23 - Granted: 2019-12-10 - Earliest claimed: 2014-10-09 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Hemendra Singh Choudhary; Cary Glen Noel - Web page: https://patentgrep.com/patent/US10503746B2 ## CPC - G06F 16/248: Presentation of query results - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 16/2428: {Query predicate definition using graphical user interfaces, including menus and forms (G06F16/2423 takes precedence)} - G06F 16/24565: {Triggers; Constraints} - G06F 16/26: Visual data mining; Browsing structured data - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 41/5032: {Generating service level reports} - H04L 69/329: in the application layer [OSI layer 7] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computing machine performs a correlation search against KPI data for one or more services using a selection criteria and a triggering condition. When the triggering condition is satisfied a notable event or incident is created and information about the notable event is presented using a user interface that may have interactive elements. ## Claims ### Claim 1 A method comprising: performing a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that derives a value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, thereby transforming machine data to the value indicating the measure, wherein the correlation search comprises a search criteria pertaining to stored values of the one or more KPIs, and a triggering condition specifying a determination including at least one value derived from stored values identified by the search criteria; automatically recording a notable event in computer storage in response to a satisfaction of the triggering condition; and causing display of a user interface presenting information pertaining to the notable event; wherein the method is performed by one or more processing devices coupled to the computer storage. ### Claim 2 (depends on 1) The method of claim 1 wherein the presented information includes information identifying the service. ### Claim 3 (depends on 1) The method of claim 1 wherein the presented information includes at least one from among an identification of the service, a time associated with the correlation search, an identification of the correlation search, and a severity associated with the triggering condition. ### Claim 4 (depends on 1) The method of claim 1 wherein the presented information includes information identifying one or more services associated with the correlation search. ### Claim 5 (depends on 1) The method of claim 1 wherein the correlation search is associated with a respective service by having search criteria pertaining to at least one KPI of the respective service. ### Claim 6 (depends on 1) The method of claim 1 wherein the search criteria pertains to an aggregate KPI characterizing the service as a whole and the triggering condition is based at least in part on a KPI state indicated by aggregate KPI data that satisfies the search criteria. ### Claim 7 (depends on 1) The method of claim 1 wherein the search criteria pertains to an aspect KPI characterizing an aspect of the service, and the triggering condition is based at least in part on a KPI state indicated by aspect KPI data that satisfies the search criteria. ### Claim 8 (depends on 1) The method of claim 1 wherein causing display of the user interface is preconditioned on the notable event satisfying a filter criteria. ### Claim 9 (depends on 1) The method of claim 1 wherein causing display of the user interface is preconditioned on the notable event satisfying a filter criteria pertaining to a severity level. ### Claim 10 (depends on 1) The method of claim 1 wherein causing display of the user interface is preconditioned on the notable event satisfying a filter criteria pertaining to a severity level wherein the filter criteria is based at least in part on an indication of a user selection of the severity level from a severity chart of a graphical user interface component. ### Claim 11 (depends on 1) The method of claim 1 further comprising causing display of the user interface with information pertaining to two or more stored notable events, the notable events determined according to event filtering criteria indicated by user input. ### Claim 12 (depends on 1) The method of claim 1 further comprising causing display of the user interface with a list of selectable action options with respect to the notable event. ### Claim 13 (depends on 1) The method of claim 1 further comprising causing display of the user interface with a list of selectable action options for the notable event. ### Claim 14 (depends on 1) The method of claim 1 further comprising causing display of the user interface with selectable action options for the notable event, the selectable action options including at least one from among an option for a visualization of correlation search results over time and an option for a time-based visualization of one or more KPIs contributing to the correlation search. ### Claim 15 (depends on 1) The method of claim 1 further comprising: causing the display of a visualization of correlation search results over time in response to user interaction with the user interface. ### Claim 16 (depends on 1) The method of claim 1 further comprising: causing the display of a time-based visualization of one or more KPIs contributing to the correlation search in response to user interaction with the user interface. ### Claim 17 (depends on 1) The method of claim 1 wherein the corresponding machine data for a particular one of the entities includes machine data from the entity and from a different source. ### Claim 18 (depends on 1) The method of claim 1 wherein the corresponding machine data for a particular one of the entities includes machine data from two or more sources. ### Claim 19 (depends on 1) The method of claim 1 wherein the machine data is represented as events. ### Claim 20 (depends on 1) The method of claim 1 wherein the machine data is represented as events each comprising a segment of raw data. ### Claim 21 (depends on 1) The method of claim 1 wherein the machine data is represented as timestamped events each comprising a segment of raw data. ### Claim 22 (depends on 1) The method of claim 1 wherein the correlation search is associated with no service other than the service. ### Claim 23 (depends on 1) The method of claim 1 wherein the service definition includes an indication of a dependency between the service and one or more other services. ### Claim 24 (depends on 1) The method of claim 1 wherein the service definition includes information about one or more dependencies between the service and one or more related services. ### Claim 25 (depends on 1) The method of claim 1 wherein the service definition includes information indicating one or more dependencies between the service and one or more related services, and further comprising causing display of the user interface with information about the related services based at least in part on the dependencies. ### Claim 26 (depends on 1) The method of claim 1 wherein automatically recording a notable event comprises creating an incident ticket. ### Claim 27 (depends on 1) The method of claim 1 further comprising automatically creating an incident ticket in response to a satisfaction of the triggering condition. ### Claim 28 (depends on 1) The method of claim 1 further comprising automatically creating, in response to a satisfaction of the triggering condition, an incident ticket in accordance with configuration information of the correlation search. ### Claim 29 A system comprising: a memory; and a processing device coupled with the memory to: perform a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that derives a value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, thereby transforming machine data to the value indicating the measure, wherein the correlation search comprises a search criteria pertaining to stored values of the one or more KPIs, and a triggering condition specifying a determination including at least one value derived from stored values identified by the search criteria; automatically record a notable event in computer storage in response to a satisfaction of the triggering condition; and cause display of a user interface presenting information pertaining to the notable event. ### Claim 30 A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising: performing a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that derives a value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, thereby transforming machine data to the value indicating the measure, wherein the correlation search comprises a search criteria pertaining to stored values of the one or more KPIs, and a triggering condition specifying a determination including at least one value derived from stored values identified by the search criteria; automatically recording a notable event in computer storage in response to a satisfaction of the triggering condition; and causing display of a user interface presenting information pertaining to the notable event.