Machine data-derived key performance indicators with per-entity states

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states;
• receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface;
• and
• store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states;
• receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface;
• storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds;
• and
• wherein the derived value for the KPI reflects a measure of the performance of the service.