Abstract: Systems and methods are described for using a streaming data processor to group notable events reflecting operation of a computing system into episodes of related events reflecting an incident on the computing system, such as to enable root cause analysis of the incident. Each notable event can be generated based on one or more events detected within raw machine data. The streaming data processor can ingest a data stream of notable events, and apply a clustering algorithm to the events to cluster those events into episodes. When the episodes satisfy an action rule, the streaming data processor can take an action appropriate to that rule, such as transmitting an alert or programmatically altering operation of the computing system. The streaming data processor can utilize feedback as to the grouping of events into episodes to modify the clustering algorithm and improve accuracy of clustering.

Abstract: Various embodiments include methods and systems to support IT business decision making, including a data correlator and business, configuration, risk, and application management databases. The business management database contains information pertaining to services offered by IT and other IT business information. The configuration management database contains operational data including the resources required by IT's offered services. The risk management database contains operational constraints on the organization by external sources, such as industry practices or government regulations. The application management database contains information about projects and applications that are in development but not currently operational including resources required by IT's services now or in the future.

Abstract: Various embodiments include methods and systems to support IT business decision making, including a data correlator and business, configuration, risk, and application management databases. The business management database contains information pertaining to services offered by IT and other IT business information. The configuration management database contains operational data including the resources required by IT's offered services. The risk management database contains operational constraints on the organization by external sources, such as industry practices or government regulations. The application management database contains information about projects and applications that are in development but not currently operational including resources required by IT's services now or in the future.