Adaptive key performance indicator thresholds

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• access information that defines one or more time frames associated with a key performance indicator (KPI), each of the time frames having a set of one or more thresholds wherein each threshold represents the end of a range of values corresponding to a particular state of the KPI, and wherein the KPI is defined by a search query that derives a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service;
• assign one or more threshold values to the thresholds, comprising, for each time frame:
• identify training data for the time frame, and
• determine the one or more threshold values for the time frame in consideration of the identified training data;
• and
• wherein the method is performed by a computer system comprising one or more processors.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, causes the processing device to perform operations comprising:

• accessing information that defines one or more time frames associated with a key performance indicator (KPI), each of the time frames having a set of one or more thresholds wherein each threshold represents the end of a range of values corresponding to a particular state of the KPI, and wherein the KPI is defined by a search query that derives a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service;
• assigning one or more threshold values to the thresholds, comprising, for each time frame:
• identifying training data for the time frame, and
• determining the one or more threshold values for the time frame in consideration of the identified training data;
• and
• wherein the method is performed by a computer system comprising one or more processors.