Threshold establishment for key performance indicators derived from machine data

A system comprising:

• a memory;
• and
• one or more processing devices coupled to the memory, the processing devices configured to:
• receive one or more entity definitions, wherein each entity definition associates an entity with machine data pertaining to the entity;
• receive a service definition for a service provided by one or more entities, the service definition including referencing a corresponding one of said entity definitions for each of the one or more entities;
• receive definitions of one or more key performance indicators (KPIs), each KPI defined by a respective search query that produces a value derived from the machine data identified in one or more of the entity definitions referenced in the service definition, each value indicative of performance of the service is performing at a point in time or during a period of time;
• receive a definition of at least one threshold for a KPI of the one or more KPIs;
• derive, by performing on the machine data a search query associated with the KPI, one or more KPI values for the KPI;
• and
• determine, based on the at least one threshold applied to the one or more KPI values, a state of a plurality of states for the KPI.

A non-transitory computer-readable storage medium comprising executable instructions that, in response to being executed by one or more processing devices, cause the processing devices to:

• receive one or more entity definitions, wherein each entity definition associates an entity with machine data pertaining to the entity;
• receive a service definition for a service provided by one or more entities, the service definition including referencing a corresponding one of said entity definitions for each of the one or more entities;
• receive definitions of one or more key performance indicators (KPIs), each KPI defined by a respective search query that produces a value derived from the machine data identified in one or more of the entity definitions referenced in the service definition, each value indicative of performance of the service is performing at a point in time or during a period of time;
• receive a definition of at least one threshold for a KPI of the one or more KPIs;
• derive, by performing on the machine data a search query associated with the KPI, one or more KPI values for the KPI;
• and
• determine, based on the at least one threshold applied to the one or more KPI values, a state of a plurality of states for the KPI.