Incident review interface for a service monitoring system

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• perform a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that is executed to produce a KPI value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, wherein the correlation search comprises a search criterion pertaining to stored KPI values of the one or more KPIs, and a plurality of triggering conditions each specifying a threshold for a number of occurrences when at least a subset of the stored KPI values meets the search criterion during a time interval, wherein the plurality of triggering conditions are different triggering conditions associated with different severity levels;
• automatically record a notable event in association with an identifier of the correlation search and a respective severity level of the different severity levels in computer storage in response to a satisfaction of a respective triggering condition of the correlation search, wherein the respective triggering condition is satisfied when a number of occurrences of at least a subset of the stored KPI values meeting the search criterion of the correlation search exceeds a threshold number of occurrences during a time interval, wherein the threshold number is specific to the respective triggering condition associated with a respective severity level of the different severity levels;
• cause display of a user interface presenting the different severity levels, a plurality of notable events including the notable event, an identifier of the correlation search that triggered the recording of the notable event, and the respective severity level of the notable event;
• and
• in response to a user selection of the respective severity level from the different severity levels in the user interface:
• select a subset of the plurality of notable events that resulted from the satisfaction of the respective triggering condition of the correlation search, wherein the respective triggering condition is satisfied when a number of occurrences of at least a subset of the stored KPI values meeting the search criterion of the correlation search exceeds a threshold number of occurrences during a time interval, wherein the threshold number is specific to the respective triggering condition associated with the respective severity level, and
• cause display, in the user interface, of the subset of the plurality of notable events in the user interface, the identifier of the correlation search and the respective severity level.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• performing a correlation search associated with a service provided by one or more entities that each have corresponding machine data, the service having one or more key performance indicators (KPIs), each KPI defined by a KPI search query that is executed to produce a KPI value from the corresponding machine data to indicate a measure of the service at a point in time or during a period of time, wherein the correlation search comprises a search criterion pertaining to stored KPI values of the one or more KPIs, and a plurality of triggering conditions each specifying a threshold for a number of occurrences when at least a subset of the stored KPI values meets the search criterion during a time interval, wherein the plurality of triggering conditions are different triggering conditions associated with different severity levels;
• automatically recording a notable event in association with an identifier of the correlation search and a respective severity level of the different severity levels in computer storage in response to a satisfaction of a respective triggering condition of the correlation search, wherein the respective triggering condition is satisfied when a number of occurrences of at least a subset of the stored KPI values meeting the search criterion of the correlation search exceeds a threshold number of occurrences during a time interval, wherein the threshold number is specific to the respective triggering condition associated with a respective severity level of the different severity levels;
• causing display of a user interface presenting the different severity levels a plurality of notable events including the notable event, an identifier of the correlation search that triggered the recording of the notable event, and the respective severity level of the notable event;
• and
• in response to a user selection of the respective severity level from the different severity levels in the user interface:
• selecting a subset of the plurality of notable events that resulted from the satisfaction of the respective triggering condition of the correlation search, wherein the respective triggering condition is satisfied when a number of occurrences of at least a subset of the stored KPI values meeting the search criterion of the correlation search exceeds a threshold number of occurrences during a time interval, wherein the threshold number is specific to the respective triggering condition associated with the respective severity level, and
• causing display, in the user interface, of the subset of the plurality of notable events in the user interface, the identifier of the correlation search and the respective severity level.