KPI Alert Threshold Windows for Temporary Monitoring Adjustments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing and searching massive quantities of machine data from diverse sources is time-consuming and inefficient due to the challenges of handling different types and formats, especially when pre-processing discards significant portions of raw data.
Innovation Solution
An event-based data intake and query system with a late-binding schema that processes and stores minimally processed machine data, allowing flexible schema definition and extraction rules to be applied at search time, enabling efficient retrieval and analysis of all data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If pre-processing is applied to reduce data volume, then data processing efficiency is improved, but data completeness and flexibility are worsened due to discarding raw data
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing statistical summaries (count, sum, minimum, maximum, percentile values) of raw data during data ingestion, before any analysis queries are executed. This allows the system to answer aggregate queries efficiently without scanning all raw data, while still maintaining access to the complete raw data for flexibility and detailed analysis when needed.
Solution Approach 2:
The patent introduces an intermediary data structure (statistical summary table) that mediates between the raw data storage and query processing. This intermediary contains pre-computed aggregates that can be quickly retrieved to answer common analytical queries, reducing the need to scan massive raw data volumes while preserving the ability to access original data for complex or ad-hoc analysis.
2Adaptability or versatility
If all raw data is stored for later analysis, then data flexibility and analysis completeness are improved, but data retrieval and search performance are worsened
Solution Approach 1:
The patent segments data access into two distinct paths: (1) fast aggregate queries that retrieve pre-computed statistical summaries from optimized tables, and (2) detailed analysis queries that access the complete raw data when needed. This segmentation allows the system to optimize for speed when aggregate metrics are sufficient while preserving full data access capability for comprehensive analysis.
Solution Approach 2:
The patent performs preliminary computation of statistical aggregates during data ingestion and storage, before any analytical queries are executed. This pre-computation creates ready-to-use summary statistics that can be immediately retrieved for common analytical patterns, eliminating the need to scan and process massive raw data volumes for routine aggregate queries.
3Ease of operation
If diverse data formats are processed and standardized, then data usability and consistency are improved, but processing complexity and time are worsened
Solution Approach 1:
The patent applies local quality by processing and standardizing data at the source level during ingestion, converting diverse formats into a unified schema locally as data enters the system. This localized transformation ensures data consistency and usability without requiring complex global processing or format conversion for every query, as the standardization happens once during data intake.
Data Source
AI summary
A computing device monitors a key performance indicator (KPI) relative to a first alert threshold, where a value of the KPI having a specified relationship to the first alert threshold causes the computing device to generate an alert. When the computing device receives an instruction to modify the first alert threshold by an adjustment amount, for a specified time window, the computing device generates a modified alert threshold by applying the adjustment amount to the first alert threshold. During the specified time window, the computing device monitors the KPI relative to the modified alert threshold instead of the first alert threshold. Monitoring is resumed relative to the first alert threshold after the specified time window.