Abstract: A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Abstract: In some embodiments, in response to the user selecting a first node in the tree to be pinned, the system displays a first detail panel for the first node, wherein the first detail panel displays state information for the first node, wherein the state information is frozen at the time of pinning. Moreover, in response to the user selecting a second node in the tree to be pinned, the system displays a second detail panel for the second node, wherein the second detail panel displays state information for the second node, wherein the state information is frozen at the time of pinning. Note that the first detail panel is displayed concurrently with the second detail panel to facilitate comparing state information between the first and second nodes.

Abstract: One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

Abstract: A system that displays performance data for a computing environment. During operation, the system determines performance states for a plurality of entities that comprise the computing environment based on values of a performance metric for the entities. Next, the system displays the computing environment as a tree comprising nodes representing the plurality of entities and edges representing parent-child relationships between the plurality of entities. Then, for each parent node in the tree, the system determines counts of one or more performance states for descendants of the parent node in the tree. Finally, the system displays a graphical representation of the determined counts while displaying the parent node.

Abstract: The disclosed embodiments relate to a system for monitoring a virtual-machine environment. During operation, the system identifies a parent and a set of two or more child components that are related to the parent component in the virtual-machine environment. Next, the system determines a performance metric for each child component in the set of two or more child components. The system then determines a child-component performance state for each child component in the set of two or more child components based on the performance metric for the child component and a child-component state criterion. Finally, the system determines a parent state for the parent component based on the child-component performance state for each child component in the set of two or more child components and a parent-component state criterion, wherein the parent-component state criterion includes a threshold percentage or number of child components that have a specified state.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: The disclosed embodiments relate to a system that displays performance data for a computing environment. During operation, the system first determines values for a performance metric for entities that comprise the computing environment. Next, the system displays the computing environment as a tree comprising nodes representing the entities and edges representing parent-child relationships between the entities. While displaying the tree, the system displays the child nodes for each parent in sorted order based on values of the performance metric associated with the child nodes.

Abstract: The disclosed embodiments relate to a system for monitoring a virtual-machine environment. During operation, the system identifies a parent and a set of two or more child components that are related to the parent component in the virtual-machine environment. Next, the system determines a performance metric for each child component in the set of two or more child components. The system then determines a child-component performance state for each child component in the set of two or more child components based on the performance metric for the child component and a child-component state criterion. Finally, the system determines a parent state for the parent component based on the child-component performance state for each child component in the set of two or more child components and a parent-component state criterion, wherein the parent-component state criterion includes a threshold percentage or number of child components that have a specified state.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: In some embodiments, in response to the user selecting a first node in the tree to be pinned, the system displays a first detail panel for the first node, wherein the first detail panel displays state information for the first node, wherein the state information is frozen at the time of pinning. Moreover, in response to the user selecting a second node in the tree to be pinned, the system displays a second detail panel for the second node, wherein the second detail panel displays state information for the second node, wherein the state information is frozen at the time of pinning. Note that the first detail panel is displayed concurrently with the second detail panel to facilitate comparing state information between the first and second nodes.

Abstract: The disclosed embodiments relate to a system that displays performance data for a computing environment. During operation, the system first determines values for a performance metric for a plurality of entities that comprise the computing environment. Next, the system displays the computing environment as a set of nodes representing the plurality of entities. While displaying the nodes, the system displays a chart with a line illustrating how a value of the performance metric for the selected node varies over time, wherein the line is displayed against a background illustrating how a distribution of the performance metric for a reference subset of the set of nodes varies over time.

Abstract: Techniques promote monitoring of hypervisor systems by presenting dynamic representations of hypervisor architectures that include performance indicators. A reviewer can interact with the representation to progressively view select lower-level performance indicators. Higher level performance indicators can be determined based on lower level state assessments. A reviewer can also view historical performance metrics and indicators, which can aid in understanding which configuration changes or system usages may have led to sub-optimal performance.

Abstract: A scheduler manages execution of a plurality of data-collection jobs, assigns individual jobs to specific forwarders in a set of forwarders, and generates and transmits tokens (e.g., pairs of data-collection tasks and target sources) to assigned forwarders. The forwarder uses the tokens, along with stored information applicable across jobs, to collect data from the target source and forward it onto an indexer for processing. For example, the indexer can then break a data stream into discrete events, extract a timestamp from each event and index (e.g., store) the event based on the timestamp. The scheduler can monitor forwarders' job performance, such that it can use the performance to influence subsequent job assignments. Thus, data-collection jobs can be efficiently assigned to and executed by a group of forwarders, where the group can potentially be diverse and dynamic in size.

Abstract: The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.

Abstract: A system that displays performance data for a computing environment. During operation, the system determines performance states for a plurality of entities that comprise the computing environment based on values of a performance metric for the entities. Next, the system displays the computing environment as a tree comprising nodes representing the plurality of entities and edges representing parent-child relationships between the plurality of entities. Then, for each parent node in the tree, the system determines counts of one or more performance states for descendants of the parent node in the tree. Finally, the system displays a graphical representation of the determined counts while displaying the parent node.

Abstract: Techniques promote monitoring of hypervisor systems by presenting dynamic representations of hypervisor architectures that include performance indicators. A reviewer can interact with the representation to progressively view select lower-level performance indicators. Higher level performance indicators can be determined based on lower level state assessments. A reviewer can also view historical performance metrics and indicators, which can aid in understanding which configuration changes or system usages may have led to sub-optimal performance.

Abstract: In some embodiments, in response to the user selecting a first node in the tree to be pinned, the system displays a first detail panel for the first node, wherein the first detail panel displays state information for the first node, wherein the state information is frozen at the time of pinning. Moreover, in response to the user selecting a second node in the tree to be pinned, the system displays a second detail panel for the second node, wherein the second detail panel displays state information for the second node, wherein the state information is frozen at the time of pinning. Note that the first detail panel is displayed concurrently with the second detail panel to facilitate comparing state information between the first and second nodes.

Abstract: The disclosed embodiments relate to a system that displays performance data for a computing environment. During operation, the system first determines values for a performance metric for entities that comprise the computing environment. Next, the system displays the computing environment as a tree comprising nodes representing the entities and edges representing parent-child relationships between the entities. While displaying the tree, the system displays the child nodes for each parent in sorted order based on values of the performance metric associated with the child nodes.