State determination using per-entity thresholds

A method comprising:

• causing display of a graphical user interface (GUI) that presents information specifying:
• a service definition for a service provided by a plurality of entities each having corresponding machine data, and
• a specification for determining a key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to one or more KPI entities selected from among the plurality of entities, the value indicative of a performance assessment for the service at a point in time or during a period of time, the search query including a determination component to derive a representative value for an aggregate of machine data;
• receiving via the GUI user input specifying one or more entity thresholds each representing an end of a range of values corresponding to a particular KPI state from among a set of KPI states;
• storing the one or more entity thresholds in association with the specification for determining the KPI for the service;
• and
• making the stored entity thresholds available for determining a KPI state, wherein the determining the KPI state includes:
• identifying, based at least in part on identifying information stored in an entity definition corresponding to an individual KPI entity, a first aggregate of machine data from an event data store, the entity definition having an association with the service definition, and the event data store having a plurality of events each comprising a segment of unformatted machine data, wherein the first aggregate of machine data includes data produced by or about the individual KPI entity by one or more sources;
• determining a contribution of the individual KPI entity by applying the determination component to the first aggregate of machine data;
• and
• selecting and recording in memory a KPI state based at least in part on applying at least one entity threshold to the determined contribution of the individual KPI entity;
• wherein the method is performed by a computer system comprising one or more processing devices coupled to the memory.

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• cause display of a graphical user interface (GUI) that presents information specifying:
• a service definition for a service provided by a plurality of entities each having corresponding machine data, and
• a specification for determining a key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to one or more KPI entities selected from among the plurality of entities, the value indicative of a performance assessment for the service at a point in time or during a period of time, the search query including a determination component to derive a representative value for an aggregate of machine data;
• receive, via the GUI, user input specifying one or more entity thresholds each representing an end of a range of values corresponding to a particular KPI state from among a set of KPI states;
• store the one or more entity thresholds in association with the specification for determining the KPI for the service;
• and
• make the stored entity thresholds available for determining a KPI state, wherein to determine the KPI state the processing device is caused to:
• identify, based at least in part on identifying information stored in an entity definition corresponding to an individual KPI entity, a first aggregate of machine data from an event data store, the entity definition having an association with the service definition, and the event data store having a plurality of events each comprising a segment of unformatted machine data, wherein the first aggregate of machine data includes data produced by or about the individual KPI entity by one or more sources;
• determine a contribution of an individual KPI entity by applying the determination component to the first aggregate of machine data;
• and
• select and record in memory a KPI state based at least in part on applying at least one entity threshold to the determined contribution of the individual KPI entity.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• causing display of a graphical user interface (GUI) that presents information specifying:
• a service definition for a service provided by a plurality of entities each having corresponding machine data, and
• a specification for determining a key performance indicator (KPI) for the service, the KPI defined by a search query that produces a value derived from the machine data pertaining to one or more KPI entities selected from among the plurality of entities, the value indicative of a performance assessment for the service at a point in time or during a period of time, the search query including a determination component to derive a representative value for an aggregate of machine data;
• receiving via the GUI user input specifying one or more entity thresholds each representing an end of a range of values corresponding to a particular KPI state from among a set of KPI states;
• storing the one or more entity thresholds in association with the specification for determining the KPI for the service;
• and
• making the stored entity thresholds available for determining a KPI state, wherein the determining the KPI state includes:
• identifying, based at least in part on identifying information stored in an entity definition corresponding to an individual KPI entity, a first aggregate of machine data from an event data store, the entity definition having an association with the service definition, and the event data store having a plurality of events each comprising a segment of unformatted machine data, wherein the first aggregate of machine data includes data produced by or about the individual KPI entity by one or more sources;
• determining a contribution of an individual KPI entity by applying the determination component to the first aggregate of machine data;
• and
• selecting and recording in memory a KPI state based at least in part on applying at least one entity threshold to the determined contribution of the individual KPI entity.