Mapping Key Performance Indicators Derived from Machine Data to Dashboard Templates

Abstract

Raw machine data are captured and organized as events. Entity definitions representing machine entities that perform a service identify the machine data associated with respective entities. KPI search queries each define a KPI. Each KPI search query derives one or more values for the KPI from machine data identified in the entity definitions. A dashboard template having an identifier for the KPI is presented by a graphical interface. The identifier presents at a user-designated location and may be a widget that provides a numerical or graphical representation of one or more values for the KPI. Embodiments may allow modification of the template.

What is claimed is: 
     
         1 . A method comprising:
 causing display of a modifiable dashboard template in a graphical interface having an identifier for a KPI at a designated location, the KPI and the designated location based at least in part on prior user input reflected in dashboard specification information in computer storage;   wherein the KPI is defined by a search query that derives one or more values for the KPI from machine data identified in stored entity definitions for one or more entities that perform a service, the one or more values reflecting a measure of the service;   wherein each stored entity definition identifies machine data pertaining to a corresponding one of the entities, and is associated with a stored service definition for the service;   wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and   wherein the method is performed by a computer system comprising one or more processors coupled to the computer storage.   
     
     
         2 . The method of  claim 1  wherein the machine data associated with one of the entities comes from more than one source. 
     
     
         3 . The method of  claim 1  wherein the machine data comprise events each having a segment of raw machine data. 
     
     
         4 . The method of  claim 1  wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source. 
     
     
         5 . The method of  claim 1  wherein the machine data comprises ingested machine data, the ingested machine data having been ingested without reference to the stored service definition. 
     
     
         6 . The method of  claim 1  wherein the machine data is accessed, at least in part, in accordance with a late-binding schema. 
     
     
         7 . The method of  claim 1  wherein the search query is in a format for execution by an event processing system. 
     
     
         8 . The method of  claim 1  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI. 
     
     
         9 . The method of  claim 1  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI and having a style indicated in the dashboard specification information. 
     
     
         10 . The method of  claim 1  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI, and wherein the identifier for the KPI includes the widget. 
     
     
         11 . The method of  claim 1  wherein causing the display further includes enabling user interaction to modify the dashboard specification information. 
     
     
         12 . The method of  claim 1  wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to a background of the dashboard template. 
     
     
         13 . The method of  claim 1  wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to a background of the dashboard template, the background comprising an image. 
     
     
         14 . The method of  claim 1  wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to a second KPI. 
     
     
         15 . The method of  claim 1  wherein causing the display further includes enabling user interaction to modify the dashboard specification information related to at least one of the designated location and the KPI. 
     
     
         16 . A system comprising:
 a memory; and   a processing device coupled with the memory to:
 cause display of a modifiable dashboard template in a graphical interface having an identifier for a KPI at a designated location, the KPI and the designated location based at least in part on prior user input reflected in dashboard specification information in computer storage; 
 wherein the KPI is defined by a search query that derives one or more values for the KPI from machine data identified in stored entity definitions for one or more entities that perform a service, the one or more values reflecting a measure of the service; 
 wherein each stored entity definition identifies machine data pertaining to a corresponding one of the entities, and is associated with a stored service definition for the service; and 
 wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment. 
   
     
     
         17 . The system of  claim 16  wherein the machine data associated with one of the entities comes from more than one source. 
     
     
         18 . The system of  claim 16  wherein the machine data comprise events each having a segment of raw machine data. 
     
     
         19 . The system of  claim 16  wherein the machine data associated with a particular one of the entities comes from the particular entity and at least one other source. 
     
     
         20 . The system of  claim 16  wherein the machine data comprises ingested machine data, the ingested machine data having been ingested without reference to the stored service definition. 
     
     
         21 . The system of  claim 16  wherein the machine data is accessed, at least in part, in accordance with a late-binding schema. 
     
     
         22 . The system of  claim 16  wherein the search query is in a format for execution by an event processing system. 
     
     
         23 . The system of  claim 16  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI. 
     
     
         24 . The system of  claim 16  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI and having a style indicated in the dashboard specification information. 
     
     
         25 . The system of  claim 16  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI, and wherein the identifier for the KPI includes the widget. 
     
     
         26 . The system of  claim 16  wherein to cause the display further includes enabling user interaction to modify the dashboard specification information. 
     
     
         27 . The system of  claim 16  wherein to cause the display further includes enabling user interaction to modify the dashboard specification information related to at least one of the designated location and the KPI. 
     
     
         28 . A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:
 causing display of a modifiable dashboard template in a graphical interface having an identifier for a KPI at a designated location, the KPI and the designated location based at least in part on prior user input reflected in dashboard specification information in computer storage;   wherein the KPI is defined by a search query that derives one or more values for the KPI from machine data identified in stored entity definitions for one or more entities that perform a service, the one or more values reflecting a measure of the service;   wherein each stored entity definition identifies machine data pertaining to a corresponding one of the entities, and is associated with a stored service definition for the service; and   wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.   
     
     
         29 . The non-transitory computer readable storage medium of  claim 28  wherein the designated location corresponds to dashboard specification information about a graphical interface widget for the KPI, the widget providing a numerical or graphical representation of one or more values for the KPI and having a style indicated in the dashboard specification information. 
     
     
         30 . The non-transitory computer readable storage medium of  claim 28  wherein causing the display further includes enabling user interaction to modify the dashboard specification information.