1. A method comprising: causing display of a graphical interface enabling user interaction to indicate control information that determines operation of a service monitoring system, the control information belonging to a definition for a correlation search, the definition having: search information to identify relevant KPI values from a data store; trigger determination information to tailor an evaluation of the relevant KPI values to produce a trigger determination; and action information to specify a potential action conditioned on the trigger determination; receiving user input in response to user interaction with the graphical interface, the user input indicating one or more definition items; storing the definition items among one or more of the search information, the trigger determination information, and the action information of the definition; wherein each of the KPI values is indicative of one of a plurality of KPI states and is derived, by a search query that defines the KPI, from machine data associated with one or more entities that perform a service; and wherein the method is performed by one or more processors.