Information technology networked entity monitoring with automatic reliability scoring

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to perform operations comprising:
• establishing a source node network connection between a server group of a data intake and query system and each of one or more source network nodes, the server group comprising an indexer server and a search head server;
• receiving source data at the server group from at least one of the one or more source network nodes via the respective network connections and transforming said source data at said indexer server to a plurality of timestamped entries of machine data searchable by the data input and query system;
• establishing a search head network connection between an entity monitoring server and the search head server;
• receiving at least one search request message via the search head network connection at the search head server, each search request message including criteria of a search query identifying source data associated with an entity definition representing an entity, wherein the entity is a component of an operating environment;
• executing the search query of each search request message at the search head server to produce corresponding search results;
• and
• receiving at the entity monitoring server search result messages having information of the corresponding search results and therefrom:
• identifying a principal reliability metric for the entity;
• identifying one or more secondary reliability metrics based on a relationship to the principal reliability metric;
• determining a reliability score for each metric of a set of metrics consisting of the principal reliability metric and the one or more secondary metrics;
• determining a reliability index for the entity based at least in part on the reliability scores;
• and
• reflecting the reliability index in computer storage;

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• establishing a source node network connection between a server group of a data intake and query system and each of one or more source network nodes, the server group comprising an indexer server and a search head server;
• receiving source data at the server group from at least one of the one or more source network nodes via the respective network connections and transforming said source data at said indexer server to a plurality of timestamped entries of machine data searchable by the data input and query system;
• establishing a search head network connection between an entity monitoring server and the search head server;
• receiving at least one search request message via the search head network connection at the search head server, each search request message including criteria of a search query identifying source data associated with an entity definition representing an entity, wherein the entity is a component of an operating environment;
• executing the search query of each search request message at the search head server to produce corresponding search results;
• and
• receiving at the entity monitoring server search result messages having information of the corresponding search results and therefrom:
• identifying a principal reliability metric for the entity;
• identifying one or more secondary reliability metrics based on a relationship to the principal reliability metric;
• determining a reliability score for each metric of a set of metrics consisting of the principal reliability metric and the one or more secondary metrics;
• determining a reliability index for the entity based at least in part on the reliability scores;
• and
• reflecting the reliability index in computer storage.