1. A method comprising: determining one or more entities that provide one or more services, including locating first information indicative of an identification for each of the entities in machine data of a field-searchable event data store, the machine data related to the provision of the one or more services; correlating second information in the machine data to determine a service association for each of the entities; updating configuration data of a service monitoring system to reflect the service association for at least one of the entities based at least in part on the identification and the service association of the entity; thereby transforming machine data to control information directing the operation of the service monitoring system; wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and wherein the method is performed in a computer system comprising one or more processors.