Custom KPI Threshold Windows for Time-Limited Alert Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing and searching massive quantities of machine data from diverse sources is time-consuming and inefficient due to the varying formats and types of data generated by components in IT environments, leading to challenges in deriving insights and managing data effectively.
Innovation Solution
An event-based data intake and query system with a late-binding schema that processes and stores machine data as events, enabling flexible schema application at search time, and uses extraction rules to derive insights from heterogeneous data sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is pre-processed and only specified data items are extracted and stored, then data retrieval and analysis efficiency is improved, but data flexibility and the ability to analyze all generated data is reduced
Solution Approach 1:
The system performs preliminary actions by ingesting and storing all raw machine data without pre-processing or filtering. This preliminary storage of complete data enables both efficient retrieval through indexing and flexible analysis of all data types later, resolving the contradiction between retrieval efficiency and analysis flexibility
Solution Approach 2:
The patent segments data processing into distinct phases: data ingestion phase where all data is captured and stored in raw form, and data analysis phase where specific data items are extracted and analyzed based on needs. This segmentation allows the system to maintain both retrieval efficiency through structured storage and analysis flexibility by deferring processing decisions
2Adaptability or versatility
If massive quantities of raw data are stored for later retrieval, then data analysis flexibility is improved, but data search and analysis performance deteriorates
Solution Approach 1:
The system segments stored data into organized collections and indexes based on metadata, data type, and other characteristics. This segmentation allows the system to maintain flexibility in analyzing all raw data while improving search performance by enabling targeted queries to specific data segments rather than searching entire raw data sets
Solution Approach 2:
The patent introduces indexing structures and metadata as intermediaries between raw data storage and data retrieval operations. These intermediaries enable fast search performance by providing structured access paths to raw data without requiring the system to process or filter data at ingestion time, thus maintaining both flexibility and performance
3Loss of information
If diverse data from multiple sources is analyzed, then insight derivation opportunities are improved, but data management complexity increases
Solution Approach 1:
The system implements a universal data ingestion framework that can handle diverse data types from multiple sources through a single standardized interface. This multi-functional approach allows the system to derive insights from diverse data sources while managing complexity through unified data handling mechanisms rather than separate processing paths for each data type
Data Source
AI summary
A computing device monitors a key performance indicator (KPI) relative to a first alert threshold, where a value of the KPI having a specified relationship to the first alert threshold causes the computing device to generate an alert. When the computing device receives an instruction to modify the first alert threshold by an adjustment amount, for a specified time window, the computing device generates a modified alert threshold by applying the adjustment amount to the first alert threshold. During the specified time window, the computing device monitors the KPI relative to the modified alert threshold instead of the first alert threshold. Monitoring is resumed relative to the first alert threshold after the specified time window.