Systems and Methods For Displaying Metrics On Real-Time Data In An Environment

Abstract

A system and computer-implemented is provided for displaying a configurable metric relating to an environment in a graphical display along with a value of the metric calculated over a configurable time period. The metric is used to identify events of interest in the environment based on processing real time machine data from one or more sources. The configurable metric is selected and a corresponding value is calculated based on the events of interest over the configurable time period. The value of the metric may be continuously updated in real time based on, receiving additional real-time machine data and displayed in a graphical interface as time progresses. Statistical trends in the value of the metric may also be determined over the configurable time period and displayed in the graphical interface as well as an indication if the value of the metric exceeds a configurable threshold value. Further, a selection of one or more thresholds for the value of the metric may be applied and an indication displayed indicating if the threshold(s) have been exceeded.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 receiving, by a computer system, real time machine data from one or more sources, wherein the machine data is received at a computer system interface;   receiving, by the computer system, a signal representing a selection of a configurable metric;   calculating a value corresponding to the metric over a configurable time period; and   displaying the metric and corresponding value in a graphical interface along with real time information relating to the metric and its value.   
     
     
         2 . The computer-implemented method of  claim 1  further comprising:
 updating the value of the metric continuously in real time based on receiving additional real-time data at the computer interface; and 
 displaying updated values of the metric in response thereto as time progresses. 
 
     
     
         3 . The computer-implemented method of  claim 1  further comprising displaying a trend in the value of the metric over the configurable time period. 
     
     
         4 . The computer-implemented method of  claim 1  further comprising:
 receiving at the computer interface a signal representing a selection of a configurable threshold to be applied to the value of the metric; and 
 displaying an indicator in the graphical interface indicating if the value of the metric exceeds the threshold. 
 
     
     
         5 . The computer-implemented method of  claim 4  wherein the real time information includes information indicating if the threshold is being exceeded in real time. 
     
     
         6 . The computer-implemented method of  claim 1  further comprising:
 receiving at the computer interface a signal representing a selection of a configurable threshold to be applied to a change in the value of the metric; and 
 displaying an indicator in the graphical interface indicating if the change in the value of the metric exceeds the threshold. 
 
     
     
         7 . The computer-implemented method of  claim 1  wherein the metric is selected from a list of predetermined metrics displayed in the graphical interface. 
     
     
         8 . The computer-implemented method of  claim 1  wherein the metric is customizable. 
     
     
         9 . The computer-implemented method of  claim 1  wherein the metric is related to security events in an environment. 
     
     
         10 . The computer-implemented method of  claim 1  further comprising displaying a drill down view of the machine data underlying the value of the selected metric upon selection using an input device of the computer system. 
     
     
         11 . The computer-implemented method of  claim 1  wherein the received machine data is processed into events of unstructured data and stored as time stamped events in a time series data store accessible via search queries generated based on the metric. 
     
     
         12 . A system comprising:
 a processor; and   a memory coupled with the processor;   a communications interface adapted to receive machine data in real time from one or more sources;   an execution unit configured to receive a selection of a configurable metric and to calculate a value corresponding to the metric over a configurable time period; and   a graphical interface for displaying the metric and corresponding value along with real time information relating to the metric and its value.   
     
     
         13 . The system of  claim 12  further comprising a time series data store in communication with the processor, the time series data store configured to receive machine data processed into time stamped events of unstructured data that are accessible via search queries based on the selected metric. 
     
     
         14 . The system of  claim 12  wherein the value of the metric is updated continuously in real time based on receiving additional real-time data at the computer interface and displayed in response thereto as time progresses. 
     
     
         15 . The system of  claim 12  wherein the graphical interface is further adapted to display statistical trends in the value of the metric over the configurable time period. 
     
     
         16 . The system of  claim 12  further comprising:
 a threshold module configured to: 
 receive a selection of a configurable threshold to be applied to the value of the metric; 
 determine if the value of the metric exceeds the threshold; and 
 display an indicator in the graphical interface indicating if the value of the metric exceeds the threshold. 
 
     
     
         17 . The system of  claim 12  further comprising:
 a threshold module configured to:
 receive a selection of a configurable threshold to be applied to a change in the value of the metric; 
 determine if the change in the value of the metric exceeds the threshold; and 
 displaying an indicator in the graphical interface indicating if the change in the value of the metric exceeds the threshold. 
 
 
     
     
         18 . The system of  claim 12  wherein the metric is selected from a list of predetermined metrics displayed in the graphical interface. 
     
     
         19 . The system of  claim 12  wherein the metric is customizable. 
     
     
         20 . The system of  claim 12  wherein the metric is related to security events in an environment. 
     
     
         21 . The system of  claim 12  wherein the graphical display is further adapted to display a drill down view of the machine data underlying the value of the selected metric upon selection using an input device of the computer system.