Thresholds for key performance indicators derived from machine data

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• access information of a service definition from computer storage, the service definition identifying a key performance indicator (KPI) and one or more entities that provide a service, wherein:
• each entity has entity definition information identifying machine data produced by or about the entity, and
• the KPI is defined by a search query that produces a value derived from machine data identified in the entity definitions, the value indicative of a measure of the service at a point in time or during a period of time, and the value indicating one of a plurality of states of the KPI, thereby transforming machine data to the value indicative of the measure;
• cause display of a graphical user interface (GUI) enabling a user to indicate a setting for one or more thresholds for the KPI, each threshold defining an end of a range of values corresponding to a particular state of the plurality of states of the KPI;
• receive an indication via the GUI of at least one of the thresholds for the KPI;
• record threshold information in computer storage in association with the KPI in accordance with the received indication.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:

• accessing information of a service definition from computer storage, the service definition identifying a key performance indicator (KPI) and one or more entities that provide a service, wherein:
• each entity has entity definition information identifying machine data produced by or about the entity, and
• the KPI is defined by a search query that produces a value derived from machine data identified in the entity definitions, the value indicative of a measure of the service at a point in time or during a period of time, and the value indicating one of a plurality of states of the KPI, thereby transforming machine data to the value indicative of the measure;
• causing display of a graphical user interface (GUI) enabling a user to indicate a setting for one or more thresholds for the KPI, each threshold defining an end of a range of values corresponding to a particular state of the plurality of states of the KPI;
• receiving an indication via the GUI of at least one of the thresholds for the KPI;
• recording threshold information in computer storage in association with the KPI in accordance with the received indication.