IT service monitoring by ingested machine data with KPI prediction and impactor determination

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to perform operations comprising:
• identifying, for a plurality of key performance indicators (KPIs), a prediction time window comprising a plurality of prediction times, wherein the plurality of KPIs are associated with a service implemented in an information technology (IT) environment, wherein each KPI of the plurality of KPIs is defined by a corresponding search query that derives, from machine data identified by entity definitions associated with the service, one or more values associated with a point in time or a period of time;
• determining, for each KPI of the plurality of KPIs, a baseline value associated with a time preceding the prediction time window;
• for each of the plurality of prediction times within the prediction time window, determining a respective predicted value of the KPI to produce a plurality of predicted values of the KPI;
• identifying, by iterating over the plurality of predicted values of the KPI, a maximum difference between the baseline value of the KPI and a predicted value of the KPI selected from the plurality of predicted values of the KPI;
• determining an impact score of the KPI, wherein the impact score reflects influence of the KPI on a reference service health score of the service, wherein the impact score is based on historical data related to the KPI and the reference service health score, and wherein the impact score depends upon the identified maximum difference;
• designating, as impactor KPIs, a predefined number of KPIs having largest impact scores among the plurality of KPIs;
• outputting the impact scores and identifiers of the impactor KPIs to a service monitoring system associated with the IT environment for performing a corrective action;
• and
• causing presentation of a user interface including an indication of one or more of the plurality of key performance indicators (KPIs) based on respective impact scores.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• identifying, for a plurality of key performance indicators (KPIs), a prediction time window comprising a plurality of prediction times, wherein the plurality of KPIs are associated with a service implemented in an information technology (IT) environment, wherein each KPI of the plurality of KPTs is defined by a corresponding search query that derives, from machine data identified by entity definitions associated with the service, one or more values associated with a point in time or a period of time;
• determining, for each KPI of the plurality of KPIs, a baseline value associated with a time preceding the prediction time window;
• for each of the plurality of prediction times within the prediction time window, determining a respective predicted value of the KPI to produce a plurality of predicted values of the KPI;
• identifying, by iterating over the plurality of predicted values of the KPI, a maximum difference between the baseline value of the KPI and a predicted value of the KPI selected from the plurality of predicted values of the KPI;
• determining an impact score of the KPI, wherein the impact score reflects influence of the KPI on a reference service health score of the service, wherein the impact score is based on historical data related to the KPI and the reference service health score, and wherein the impact score depends upon the identified maximum difference;
• designating, as impactor KPIs, a predefined number of KPIs having largest impact scores among the plurality of KPIs;
• outputting the impact scores and identifiers of the impactor KPIs to a service monitoring system associated with the IT environment for performing a corrective action;
• and
• causing presentation of a user interface including an indication of one or more of the plurality of key performance indicators (KPIs) based on respective impact scores.