Monitoring service-level performance using a key performance indicator (kpi) correlation search

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• cause display of a graphical user interface (GUI) comprising a correlation search portion, the correlation search portion enabling a user to specify information for a KPI correlation search definition, the KPI correlation search definition comprising:
• information for a search identifying a plurality of KPI values in a data store, each KPI value indicative of one of a plurality of KPI states, and
• information for a trigger determination including trigger criteria, the trigger determination evaluating the identified plurality of KPI values using the trigger criteria to determine whether to cause a defined action;
• receive in response to user interaction with the GUI a contribution threshold corresponding to a particular KPI definition and corresponding to a particular one of the plurality of KPI states;
• store the contribution threshold as trigger criteria information of the KPI correlation search definition in computer storage;
• wherein each of the plurality of KPI values in the data store is derived by an automatically performed search query that defines a KPI associated with a service from machine data pertaining to one or more entities identified in a stored service definition for the service.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

• causing display of a graphical user interface (GUI) comprising a correlation search portion, the correlation search portion enabling a user to specify information for a KPI correlation search definition, the KPI correlation search definition comprising:
• information for a search identifying a plurality of KPI values in a data store, each KPI value indicative of one of a plurality of KPI states, and
• information for a trigger determination including trigger criteria, the trigger determination evaluating the identified plurality of KPI values using the trigger criteria to determine whether to cause a defined action;
• receiving in response to user interaction with the GUI a contribution threshold corresponding to a particular KPI definition and corresponding to a particular one of the plurality of KPI states;
• storing the contribution threshold as trigger criteria information of the KPI correlation search definition in computer storage;
• wherein each of the plurality of KPI values in the data store is derived by an automatically performed search query that defines a KPI associated with a service from machine data pertaining to one or more entities identified in a stored service definition for the service.