Alert response tool

A system comprising:

• a memory comprising instructions;
• and
• one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
• receiving, by a computer server via a computer network, machine data from one or more computer devices, the machine data comprising log data or metric data generated by the one or more computer devices;
• detecting an alert based on the machine data;
• calculating, by the computer server in response to detecting the alert, a plurality of dimensional explanations associated with the alert, the plurality of dimensional explanations comprising at least one dimensional explanation that is based on a combination of dimensions, each dimension referring to a facet associated with the machine data associated with the alert, wherein calculating the dimensional explanations further comprises:
• comparing performance metrics for groups of dimensions;
• and
• selecting the plurality of dimensional explanations based on a relevance metric for each group of dimensions;
• calculating, for each dimensional explanation, a number of corresponding log messages received by the computer server from the one or more computer devices during a period associated with the alert;
• selecting, by the computer server, a subset of dimensional explanations based on the number of log messages associated with each dimensional explanation;
• and
• causing presentation, in a computer user interface (UI), of the selected subset of the dimensional explanations.

A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:

• receiving, by a computer server via a computer network, machine data from one or more computer devices, the machine data comprising log data or metric data generated by the one or more computer devices;
• detecting an alert based on the machine data;
• calculating, by the computer server in response to detecting the alert, a plurality of dimensional explanations associated with the alert, the plurality of dimensional explanations comprising at least one dimensional explanation that is based on a combination of dimensions, each dimension referring to a facet associated with the machine data associated with the alert, wherein calculating the dimensional explanations further comprises:
• comparing performance metrics for groups of dimensions;
• and
• selecting the plurality of dimensional explanations based on a relevance metric for each group of dimensions;
• calculating, for each dimensional explanation, a number of corresponding log messages received by the computer server from the one or more computer devices during a period associated with the alert;
• selecting, by the computer server, a subset of dimensional explanations based on the number of log messages associated with each dimensional explanation;
• and
• causing presentation, in a computer user interface (UI), of the selected subset of the dimensional explanations.