Presenting a graphical visualization along a time-based graph lane using key performance indicators derived from machine data

Abstract

A services monitoring system causes display of time-based graphical visualizations that each correspond to a different key performance indicator (KPI) reflecting how a service provided by one or more entities is performing. The graphical visualizations are all calibrated to a same time scale. Each KPI is defined by a search query that derives one or more values reflected in the graphical visualization for that KPI from machine data pertaining to the one or more entities that provide the service corresponding to the KPI.

What is claimed is: 
     
         1 . A method, comprising:
 causing display of time-based graphical visualizations each in a respective parallel graph lane and each corresponding to a different key performance indicator (KPI) reflecting how a service provided by one or more entities is performing, the graphical visualizations all calibrated to a same time scale, wherein each KPI is defined by a search query that derives one or more values reflected in the graphical visualization for that KPI from machine data associated with the one or more entities that provide the service corresponding to the KPI, a stored entity definition recording the association between each entity and its associated machine data, and a stored service definition associating the entities that provide the service; and   wherein the method is performed by one or more processing devices.   
     
     
         2 . The method of  claim 1 , wherein the machine data associated with at least one entity includes data produced by that entity. 
     
     
         3 . The method of  claim 1 , wherein the machine associated with at least one entity includes data that is not produced by that entity but that reflects operation of that entity. 
     
     
         4 . The method of  claim 1 , wherein the associated machine data for at least one entity comes from at least two different sources. 
     
     
         5 . The method of  claim 1 , wherein at least two of the graphical visualizations correspond to KPIs reflecting different services. 
     
     
         6 . The method of  claim 1 , wherein at least two of the graphical visualizations have different graph styles. 
     
     
         7 . The method of  claim 1 , wherein the graphical visualizations include at least one of a plot graph, bubble chart, line graph, area graph, or heat map. 
     
     
         8 . The method of  claim 1 , wherein the search query is sent to an event processing system for execution. 
     
     
         9 . The method of  claim 1 , wherein the length of each graph lane runs parallel to a time axis for the graphical visualization, and further comprising:
 automatically selecting a scale for an axis of the graphical visualization such that the graphical visualization spans most or all of a width of the graph lane.   
     
     
         10 . The method of  claim 1 , further comprising:
 causing display of a grab handle in association with one or more of the graph lanes; and   detecting an interaction of a user with the grab handle indicative of an instruction to re-order the graph lanes.   
     
     
         11 . The method of  claim 1 , further comprising:
 determining a state associated with at least one of the values for at least one particular KPI, based at least in part on the at least one value and a threshold associated with the particular KPI.   
     
     
         12 . The method of  claim 1 , further comprising:
 causing display of a maximum and a minimum values reflected in one of the graphical visualizations for a KPI during a time range that the graphical visualization covers.   
     
     
         13 . The method of  claim 1 , further comprising:
 causing display of a threshold indicator when the values reflected in one of the graphical visualizations for a KPI reach a defined KPI threshold during a time range that the graphical visualization covers.   
     
     
         14 . The method of  claim 1 , further comprising:
 receiving a selection of a subset of the time scale to which the graphical visualizations are calibrated;   recalculating a time range that the graphical visualizations in the graph lanes should all cover according to the selected subset; and   causing display of the time-based graphical visualizations for the different KPIs during the recalculated time range.   
     
     
         15 . The method of  claim 1 , further comprising:
 causing display of a second graphical visualization in parallel with at least one of the graphical visualizations for a KPI, wherein the values reflected in the second graphical visualization correspond to the same KPI for a different period of time than the values reflected in the at least one graphical visualization.   
     
     
         16 . The method of  claim 1 , further comprising:
 causing display of a lane parallel to at least one of the graphical visualizations, the lane to display inventory information for the service or the one or more entities providing the service reflected by the KPI corresponding to the at least one graphical visualization.   
     
     
         17 . The method of  claim 1 , further comprising:
 causing display of a lane parallel to at least one of the graphical visualizations, the lane to display an indicator for each of one or more notable events that occurred during a time period covered by the graphical visualizations.   
     
     
         18 . The method of  claim 1 , further comprising:
 causing display of a lane parallel to at least one of the graphical visualizations, the lane to display an indicator for each of one or more notable events that occurred during a time period covered by the graphical visualizations, and   wherein at least one of the notable events is produced by a search query executed automatically in accordance with a frequency or schedule.   
     
     
         19 . The method of  claim 1 , further comprising:
 causing display of a particular search query or an identifier of the particular search query that defines at least one of the selected KPIs;   receiving input indicating that a user wants to execute the particular search query; and   causing execution of the search query based on receiving the input.   
     
     
         20 . The method of  claim 1 , wherein the one or more values for a KPI are derived from the machine data at least in part using a late-binding schema. 
     
     
         21 . The method of  claim 1 , wherein the search queries that define the KPIs are in a search language processed by an event processing system having a late-binding schema. 
     
     
         22 . The method of  claim 1 , wherein the one or more values for a KPI are derived from time-stamped events, the time-stamped events each including at least a portion of raw machine data. 
     
     
         23 . The method of  claim 1 , wherein each search query is recorded in a stored KPI definition for the KPI it defines, the KPI definition associated with the service definition for the service corresponding to that KPI. 
     
     
         24 . The method of  claim 1 , wherein the search query defining at least one KPI relies upon a data model. 
     
     
         25 . A system comprising:
 a memory; and   a processing device coupled with the memory to:
 cause display of time-based graphical visualizations each in a respective parallel graph lane and each corresponding to a different key performance indicator (KPI) reflecting how a service provided by one or more entities is performing, the graphical visualizations all calibrated to a same time scale, wherein each KPI is defined by a search query that derives one or more values reflected in the graphical visualization for that KPI from machine data associated with the one or more entities that provide the service corresponding to the KPI, a stored entity definition recording the association between each entity and its associated machine data, and a stored service definition associating the entities that provide the service. 
   
     
     
         26 . The system of  claim 25 , wherein the associated machine data for at least one entity comes from at least two different sources. 
     
     
         27 . The system of  claim 25 , the processing device coupled with the memory further to:
 determine a state associated with at least one of the values for at least one particular KPI, based at least in part on the at least one value and a threshold associated with the particular KPI.   
     
     
         28 . A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:
 causing display of time-based graphical visualizations each in a respective parallel graph lane and each corresponding to a different key performance indicator (KPI) reflecting how a service provided by one or more entities is performing, the graphical visualizations all calibrated to a same time scale, wherein each KPI is defined by a search query that derives one or more values reflected in the graphical visualization for that KPI from machine data associated with the one or more entities that provide the service corresponding to the KPI, a stored entity definition recording the association between each entity and its associated machine data, and a stored service definition associating the entities that provide the service.   
     
     
         29 . The non-transitory computer readable storage medium of  claim 28 , wherein the associated machine data for at least one entity comes from at least two different sources. 
     
     
         30 . The non-transitory computer readable storage medium of  claim 28 , the operations further comprising:
 determining a state associated with at least one of the values for at least one particular KPI, based at least in part on the at least one value and a threshold associated with the particular KPI.