1. A method comprising: causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; wherein the derived value for the KPI reflects a measure of the performance of the service; and wherein the method is performed by a computer system comprising one or more processors coupled to computer storage.