# US 12,120,005 B1 · Managing event group definitions in service monitoring systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,005 B1 - Document ID: US12120005B1 - Status: Granted - Kind: B1 - Application number: 17/339,228 - Filed: 2021-06-04 - Granted: 2024-10-15 - Earliest claimed: 2014-10-09 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Vineetha Bettaiah; Alok Anant Bhide; Ross Andrew Lazerowitz - Web page: https://patentgrep.com/patent/US12120005B1 ## CPC - G06F 16/24565: {Triggers; Constraints} - G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00) - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/301: {where the computing system is a virtual computing platform, e.g. logically partitioned systems (virtual machines G06F9/45533; logical partitioning of resources G06F9/5077)} - G06F 11/328: {Computer systems status display (G06F11/327 takes precedence)} - G06F 11/3409: {for performance assessment} - G06F 11/3419: {by assessing time} - G06F 11/3447: {Performance evaluation by modeling} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 16/2477: {Temporal data queries} - G06F 16/951: Indexing; Web crawling techniques - G06F 16/972: {Access to data in other repository systems, e.g. legacy data or dynamic Web page generation} - H04L 41/147: for predicting network behaviour - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 41/5032: {Generating service level reports} - H04L 43/045: for graphical visualisation of monitoring data - H04L 69/329: in the application layer [OSI layer 7] - G06F 2201/81: Threshold - G06F 2201/86: Event-based monitoring - H04L 43/0817: by checking functioning - H04L 43/16: Threshold monitoring - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Network connected devices are controlled via the transmission of action messages to prevent or correct conditions that impair the operation of the networked information technology (IT) assets. The service monitoring system (SMS) monitoring the IT environment groups together related notable events that are received during system operation. Automatic processes dynamically determine grouping operations that automatically correlate the events without requiring, for example, a set of declarative grouping rules. Event grouping may be performed on a by-service basis to facilitate the complex processing of predicting undesirable system conditions that may be prevented or reduced by transmission of the action messages to the appropriate assets. Event grouping operations may be directed with control information maintained via user interface. ## Claims ### Claim 1 A method performed by one or more processing devices, the method comprising: identifying a plurality of group definitions including a plurality of seed group definitions each associated with a seed group derived from historical event data associated with a service and a plurality of active group definitions each associated with an active group, wherein each active group definition of the plurality of active group definitions is automatically generated by processing incoming notable events; repeatedly evaluating a current state of the plurality of group definitions to determine whether a predefined condition defined by each respective group definition is satisfied and, in response to determining that the predefined condition in one or more group definitions of the plurality of group definitions is satisfied, performing an event group action to modify the one or more group definitions to indicate that an associated group is one of: expired, suspended, or retired; receiving a notable event derived from machine data associated with a performance alert of the service; comparing characteristics of the notable event with each of the plurality of seed group definitions; responsive to failing to match the notable event to at least one seed group definition of the plurality of seed group definitions, comparing the characteristics of the notable event to characteristics of each of the plurality of active group definitions to determine a matching score for each active group associated with the plurality of active group definitions, wherein a match is determined based on the matching score between the notable event and one of the plurality of active group definitions meeting a threshold; responsive to failing to match the notable event to at least one active group definition of the plurality of active group definitions: creating a new active group based on at least one of the characteristics of the notable event; associating the notable event with the new active group; evaluating a group promotion condition associated with a new active group definition of the new active group; and responsive to determining that a significance factor associated with the new active group definition satisfies the group promotion condition, promoting the new active group to a seed group status with a seed group definition to be included in the plurality of seed group definitions. ### Claim 2 (depends on 1) The method of claim 1, further comprising: responsive to failing to match the notable event to at least one active group definition of the plurality of active group definitions, generating, based on information related to the notable event, the new active group definition. ### Claim 3 (depends on 1) The method of claim 1, wherein the notable event is generated by applying a correlation search to the machine data associated with the performance alert of the service, wherein the correlation search is defined by a search query, a triggering criterion to be applied to a key performance indicator (KPI) value produced by executing the search query, and a user-defined point in time or period of time. ### Claim 4 (depends on 1) The method of claim 1, wherein comparing the characteristics of the notable event to characteristics of each of the plurality of active group definitions determines an active group definition of the plurality of active group definitions with a highest score characterizing a degree of the notable event matching an event group policy associated with the active group definition. ### Claim 5 (depends on 1) The method of claim 1, wherein each seed group definition of the plurality of seed group definitions is associated with a list of name-value pairs specifying group membership criteria. ### Claim 6 (depends on 1) The method of claim 1, wherein the significance factor associated with the new active group definition is provided by a membership count of the new active group. ### Claim 7 (depends on 1) The method of claim 1, wherein the significance factor associated with the new active group definition is provided by a membership growth rate of the new active group. ### Claim 8 (depends on 1) The method of claim 1, further comprising: identifying a response event type associated with the service; identifying, among notable events associated with one or more seed groups, a predictor event type for the service; and determining a predictor-response relationship model for the response event type based on the predictor event type. ### Claim 9 (depends on 1) The method of claim 1, further comprising: identifying, among notable events associated with one or more seed groups, a predictor event type for the service; determining a predictor-response relationship model for a specified response event type based on the predictor event type; and predicting occurrence of a new event of the specified response event type by applying the predictor-response relationship model to event data associated with the service. ### Claim 10 (depends on 1) The method of claim 1, further comprising: determining a predictor-response relationship model for a specified response event type based on a predictor event type associated with the service; predicting an occurrence of a new event of the specified response event type by applying the predictor-response relationship model to event data associated with the service; and causing an action message to be transmitted in response to the occurrence of the new event of the specified response event type. ### Claim 11 A system comprising: a memory; and a processing device coupled with the memory to perform operations comprising: identifying a plurality of group definitions including a plurality of seed group definitions each associated with a seed group derived from historical event data associated with a service and a plurality of active group definitions each associated with an active group, wherein each active group definition of the plurality of active group definitions specifies a corresponding active group of events associated with the service; repeatedly evaluating a current state of the plurality of group definitions to determine whether a predefined condition defined by each respective group definition is satisfied and, in response to determining that the predefined condition in one or more group definitions of the plurality of group definitions is satisfied, performing an event group action to modify the one or more group definitions to indicate that an associated group is one of: expired, suspended, or retired; receiving a notable event derived from machine data associated with a performance alert of the service; comparing characteristics of the notable event with each of the plurality of seed group definitions; responsive to failing to match the notable event to at least one seed group definition of the plurality of seed group definitions, comparing the characteristics of the notable event to characteristics of each of the plurality of active group definitions to determine a matching score for each active group associated with the plurality of active group definitions, wherein a match is determined based on the matching score between the notable event and one of the plurality of active group definitions meeting a threshold; responsive to failing to match the notable event to at least one active group definition of the plurality of active group definitions: creating a new active group based on at least one of the characteristics of the notable event; associating the notable event with the new active group; evaluating a group promotion condition associated with a new active group definition of the new active group; and responsive to determining that a significance factor associated with the new active group definition satisfies the group promotion condition, promoting the new active group to a seed group status with a seed group definition to be included in the plurality of seed group definitions. ### Claim 12 (depends on 11) The system of claim 11, wherein the notable event is generated by applying a correlation search to the machine data associated with the performance alert of the service, wherein the correlation search is defined by a search query, a triggering criterion to be applied to a key performance indicator (KPI) value produced by executing the search query, and a user-defined point in time or period of time. ### Claim 13 (depends on 11) The system of claim 11, wherein comparing the characteristics of the notable event to characteristics of each of the plurality of active group definitions determines an active group definition of the plurality of active group definitions with a highest score characterizing a degree of the notable event matching an event group policy associated with the active group definition. ### Claim 14 (depends on 11) The system of claim 11, wherein each seed group definition of the plurality of seed group definitions is associated with a list of name-value pairs specifying group membership criteria. ### Claim 15 A non-transitory computer-readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising: identifying a plurality of group definitions including a plurality of seed group definitions each associated with a seed group derived from historical event data associated with a service and a plurality of active group definitions each associated with an active group, wherein each active group definition of the plurality of active group definitions specifies a corresponding active group of events associated with the service; repeatedly evaluating a current state of the plurality of group definitions to determine whether a predefined condition defined by each respective group definition is satisfied and, in response to determining that the predefined condition in one or more group definitions of the plurality of group definitions is satisfied, performing an event group action to modify the one or more group definitions to indicate that an associated group is one of: expired, suspended, or retired; receiving a notable event derived from machine data associated with a performance alert of the service; comparing characteristics of the notable event with each of the plurality of seed group definitions; responsive to failing to match the notable event to at least one seed group definition of the plurality of seed group definitions, comparing the characteristics of the notable event to characteristics of each of the plurality of active group definitions to determine a matching score for each active group associated with the plurality of active group definitions, wherein a match is determined based on the matching score between the notable event and one of the plurality of active group definitions meeting a threshold; responsive to failing to match the notable event to at least one active group definition of the plurality of active group definitions: creating a new active group based on at least one of the characteristics of the notable event, associating the notable event with the new active group, evaluating a group promotion condition associated with a new active group definition of the new active group, and responsive to determining that a significance factor associated with the new active group definition satisfies the group promotion condition, promoting the new active group to a seed group status with a seed group definition to be included in the plurality of seed group definitions. ### Claim 16 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the notable event is generated by applying a correlation search to the machine data associated with the performance alert of the service, wherein the correlation search is defined by a search query, a triggering criterion to be applied to a key performance indicator (KPI) value produced by executing the search query, and a user-defined point in time or period of time. ### Claim 17 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein the service is associated with a stored service definition comprising a set of stored entity definitions of one or more entities that provide the service. ### Claim 18 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein comparing the characteristics of the notable event to characteristics of each of the plurality of active group definitions determines an active group definition of the plurality of active group definitions with a highest score characterizing a degree of the notable event matching an event group policy associated with the active group definition. ### Claim 19 (depends on 15) The non-transitory computer-readable storage medium of claim 15, wherein each seed group definition of the plurality of seed group definitions is associated with a list of name-value pairs specifying group membership criteria.