# US 9,521,047 B2 · Machine data-derived key performance indicators with per-entity states > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,047 B2 - Document ID: US9521047B2 - Status: Granted - Kind: B2 - Application number: 15/012,848 - Filed: 2016-02-01 - Published: 2016-08-04 - Granted: 2016-12-13 - Earliest claimed: 2014-10-09 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Leonid Viktorovich Alekseyev; Brian John Bingham; Tristan Antonio Fletcher; Brian C. Reyes - Web page: https://patentgrep.com/patent/US9521047B2 ## CPC - G06Q 10/06393: {Score-carding, benchmarking or key performance indicator [KPI] analysis} - G06F 3/0481: based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance - G06F 3/04817: using icons (graphical or visual programming using iconic symbols G06F8/34) - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/0484: for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range - G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) - G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 11/321: {Display for diagnostics, e.g. diagnostic result display, self-test user interface} - G06F 11/34: Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation {; Recording or statistical evaluation of user activity, e.g. usability assessment} - G06F 16/24542: {Plan optimisation} - G06F 16/2455: Query execution - G06F 16/248: Presentation of query results - G06F 16/252: {between a Database Management System and a front-end application} - G06F 16/26: Visual data mining; Browsing structured data - G06F 16/334: Query execution (filtering based on additional data G06F16/335) - G06F 16/9024: {Graphs; Linked lists (G06F16/9027 takes precedence)} - G06F 16/903: Querying (for retrieval from the web G06F16/953) - G06F 16/90335: {Query processing} - G06F 16/9038: Presentation of query results - G06F 16/951: Indexing; Web crawling techniques - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/9538: Presentation of query results - G06Q 10/0637: Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals - G06Q 10/0639: Performance analysis of employees; Performance analysis of enterprise or organisation operations - H04L 41/0213: Standardised network management protocols, e.g. simple network management protocol [SNMP] - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/5009: Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF] - H04L 41/5032: {Generating service level reports} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/091: Measuring contribution of individual network components to actual service level - H04L 43/16: Threshold monitoring - H04L 43/55: Testing of service level quality, e.g. simulating service usage - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04L 69/329: in the application layer [OSI layer 7] - G06T 11/26: Drawing of charts or graphs - G06T 2200/24: involving graphical user interfaces [GUIs] - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract Raw machine data are captured and may be organized as events. Entity definitions representing machine entities that perform a service identify the machine data pertaining to respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. The derivation may be performed on a per-entity basis and on the aggregate. The derived values may then be translated into a state value domain using per-entity thresholds, aggregate thresholds, or a combination. ## Claims ### Claim 1 A method comprising: causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; wherein the derived value for the KPI reflects a measure of the performance of the service; and wherein the method is performed by a computer system comprising one or more processors coupled to computer storage. ### Claim 2 (depends on 1) The method of claim 1 wherein the determining of the KPI state includes: determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity. ### Claim 3 (depends on 1) The method of claim 1 wherein the determining of the KPI state includes: determining an overall contribution by applying a determination component of the search query to the machine data; determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution. ### Claim 4 (depends on 1) The method of claim 1 further comprising: causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds. ### Claim 5 (depends on 1) The method of claim 1 further comprising: causing display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity. ### Claim 6 (depends on 1) The method of claim 1 wherein the service corresponds to a service definition in computer storage associating the one or more entities that provide the service. ### Claim 7 (depends on 1) The method of claim 1 wherein the service corresponds to a service definition in computer storage associating an entity definition for each of the one or more entities that provide the service, each of said entity definitions identifying machine data pertaining to the respective entity. ### Claim 8 (depends on 1) The method of claim 1 wherein the machine data associated with at least one of the entities comes from more than one source. ### Claim 9 (depends on 1) The method of claim 1 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source. ### Claim 10 (depends on 1) The method of claim 1 wherein the machine data are represented as stored event instances each having a segment of raw machine data. ### Claim 11 A system comprising: a memory; and a processing device coupled with the memory to: cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; and store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds. ### Claim 12 (depends on 11) The system of claim 11 wherein the determining of the KPI state includes: determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity. ### Claim 13 (depends on 11) The system of claim 11 wherein the determining of the KPI state includes: determining an overall contribution by applying a determination component of the search query to the machine data; determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution. ### Claim 14 (depends on 11) The system of claim 11 further comprising to: cause display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds. ### Claim 15 (depends on 11) The system of claim 11 further comprising to: cause display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity. ### Claim 16 (depends on 11) The system of claim 11 wherein the service corresponds to a service definition in computer storage associating the one or more entities that provide the service. ### Claim 17 (depends on 11) The system of claim 11 wherein the service corresponds to a service definition in computer storage associating an entity definition for each of the one or more entities that provide the service, each of said entity definitions identifying machine data pertaining to the respective entity. ### Claim 18 (depends on 11) The system of claim 11 wherein the machine data associated with at least one of the entities comes from more than one source. ### Claim 19 (depends on 11) The system of claim 11 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source. ### Claim 20 (depends on 11) The system of claim 11 wherein the machine data are represented as stored event instances each having a segment of raw machine data. ### Claim 21 A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising: causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; and wherein the derived value for the KPI reflects a measure of the performance of the service. ### Claim 22 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the determining of the KPI state includes: determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity. ### Claim 23 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the determining of the KPI state includes: determining an overall contribution by applying a determination component of the search query to the machine data; determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution. ### Claim 24 (depends on 21) The non-transitory computer readable storage medium of claim 21, the operations further comprising: causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds. ### Claim 25 (depends on 21) The non-transitory computer readable storage medium of claim 21, the operations further comprising: causing display of a user interface portion showing individual contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds, and wherein each of the contributions is determined by applying a determination component of the search query to an aggregate of machine data corresponding to a particular entity. ### Claim 26 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the service corresponds to a service definition in computer storage associating the one or more entities that provide the service. ### Claim 27 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the service corresponds to a service definition in computer storage associating an entity definition for each of the one or more entities that provide the service, each of said entity definitions identifying machine data pertaining to the respective entity. ### Claim 28 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the machine data associated with at least one of the entities comes from more than one source. ### Claim 29 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source. ### Claim 30 (depends on 21) The non-transitory computer readable storage medium of claim 21 wherein the machine data are represented as stored event instances each having a segment of raw machine data.