Abstract: Systems and methods ingest machine data including logs, metadata, and cost and usage information from multiple heterogeneous cloud services. The machine data is saved as events. An application retrieves the metadata, events, metrics, and logs and causes an easy to understand visual representation of costs, resource usage, and non-compliance for each of a client's cloud services. Further, the data across the client's multiple heterogeneous cloud services is normalized to provide visual representations that compare the costs, resource usage, and non-compliance across the client's multiple heterogeneous cloud services. Further, machine learning aspects of the application can provide recommendations and trend analysis for cloud service asset usage.

Abstract: One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Abstract: A computer implemented method includes establishing, by a data intake and query system, a network connection between the data intake and query system and an application and infrastructure monitoring platform. The data intake and query system receives a data stream from the application and infrastructure monitoring platform. The computer implemented method further includes transforming the data stream while receiving the data stream to obtain a transformed data stream. Further, the transformed data stream is analyzed while receiving the data stream to generate analysis results, which are presented.

Abstract: In some embodiments, in response to the user selecting a first node in the tree to be pinned, the system displays a first detail panel for the first node, wherein the first detail panel displays state information for the first node, wherein the state information is frozen at the time of pinning. Moreover, in response to the user selecting a second node in the tree to be pinned, the system displays a second detail panel for the second node, wherein the second detail panel displays state information for the second node, wherein the state information is frozen at the time of pinning. Note that the first detail panel is displayed concurrently with the second detail panel to facilitate comparing state information between the first and second nodes.

Abstract: Systems and methods ingest machine data including logs, metadata, and cost and usage information from multiple heterogeneous cloud services. The machine data is saved as events. An application retrieves the metadata, events, metrics, and logs and causes an easy to understand visual representation of costs, resource usage, and non-compliance for each of a client's cloud services. Further, the data across the client's multiple heterogeneous cloud services is normalized to provide visual representations that compare the costs, resource usage, and non-compliance across the client's multiple heterogeneous cloud services. Further, machine learning aspects of the application can provide recommendations and trend analysis for cloud service asset usage.

Abstract: A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data—collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Abstract: A computer implemented method includes establishing, by a data intake and query system, a network connection between the data intake and query system and an application and infrastructure monitoring platform. The data intake and query system receives a data stream from the application and infrastructure monitoring platform. The computer implemented method further includes transforming the data stream while receiving the data stream to obtain a transformed data stream. Further, the transformed data stream is analyzed while receiving the data stream to generate analysis results, which are presented.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

Abstract: Techniques promote monitoring of hypervisor systems by presenting dynamic representations of hypervisor architectures that include performance indicators. A reviewer can interact with the representation to progressively view select lower-level performance indicators. Higher level performance indicators can be determined based on lower level state assessments. A reviewer can also view historical performance metrics and indicators, which can aid in understanding which configuration changes or system usages may have led to sub-optimal performance.

Abstract: One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: The disclosed embodiments relate to a system for monitoring a virtual-machine environment. During operation, the system assigns a task, corresponding with a task request, to a first virtual machine. The performance of the task at the first virtual machine is monitored. Based on the monitoring, it is determined whether the performance of the task at the first virtual machine is unsatisfactory. If so, the task is automatically reassigned to a second virtual machine.

Abstract: Techniques promote monitoring of hypervisor systems by presenting dynamic representations of hypervisor architectures that include performance indicators. A reviewer can interact with the representation to progressively view select lower-level performance indicators. Higher level performance indicators can be determined based on lower level state assessments. A reviewer can also view historical performance metrics and indicators, which can aid in understanding which configuration changes or system usages may have led to sub-optimal performance.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Abstract: The disclosed embodiments relate to a system for monitoring a virtual-machine environment. During operation, the system identifies a parent and a set of two or more child components that are related to the parent component in the virtual-machine environment. Next, the system determines a performance metric for each child component in the set of two or more child components. The system then determines a child-component performance state for each child component in the set of two or more child components based on the performance metric for the child component and a child-component state criterion. Finally, the system determines a parent state for the parent component based on the child-component performance state for each child component in the set of two or more child components and a parent-component state criterion, wherein the parent-component state criterion includes a threshold percentage or number of child components that have a specified state.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.