Generating structured metrics from log data

A data intake and query system comprising:

• a processor;
• and
• a memory having instructions executable by the processor to cause the data intake and query system to:
• ingest data including log data obtained over a network from a plurality of systems;
• receive user input indicating a scope for retrieving data, and a criterion expressed in a structured language;
• retrieve data based on the scope indicated by the user input;
• extract a first field value and a second field value from the retrieved data based on the criterion and the scope indicated by the user input, the first field value including a first numerical value indicative of a measured characteristic of a computing device and the second field value including a first dimension;
• store a first structured metric and the first dimension in a time-series metrics store, the first structured metric including the first numerical value, and the first dimension being associated with the first numerical value;
• and
• after storing the first structured metric in the time-series metrics store:
• generating, by the data intake and query system, a first plurality of events, each of which includes a segment of the log data and an associated timestamp;
• receiving, by the data intake and query system, user input including a query having a second criterion;
• obtaining, by the data intake and query system, results by applying the second criterion to a plurality of structured metrics including the first structured metric;
• correlating, by the data intake and query system, the results with a second plurality of events to obtain correlation results;
• and
• causing, on a display device, display of the correlation results or data indicative of the correlation results.

A non-transitory storage medium storing program instructions, execution of which in a data intake and query system causes actions comprising:

• ingesting data including log data obtained over a network from a plurality of systems;
• receiving user input indicating a scope for retrieving data, and a criterion expressed in a structured language;
• retrieving data based on the scope indicated by the user input;
• extracting a first field value and a second field value from the retrieved data based on the criterion and the scope indicated by the user input, the first field value including a first numerical value indicative of a measured characteristic of a computing device and the second field value including a first dimension;
• storing a first structured metric and the first dimension in a time-series metrics store, the first structured metric including the first numerical value, and the first dimension being associated with the first numerical value;
• and
• after storing the first structured metric in the time-series metrics store:
• generating, by the data intake and query system, a first plurality of events, each of which includes a segment of the log data and an associated timestamp;
• receiving, by the data intake and query system, user input including a query having a second criterion;
• obtaining, by the data intake and query system, results by applying the second criterion to a plurality of structured metrics including the first structured metric;
• correlating, by the data intake and query system, the results with a second plurality of events to obtain correlation results;
• and
• causing, on a display device, display of the correlation results or data indicative of the correlation results.