1. A method comprising: causing display of a graphical user interface (GUI) comprising a correlation search portion, the correlation search portion enabling a user to specify information for a KPI correlation search definition, the KPI correlation search definition comprising: information for a search identifying a plurality of KPI values in a data store, each KPI value indicative of one of a plurality of KPI states, and information for a trigger determination including trigger criteria, the trigger determination evaluating the identified plurality of KPI values using the trigger criteria to determine whether to cause a defined action; receiving in response to user interaction with the GUI a contribution threshold corresponding to a particular KPI definition and corresponding to a particular one of the plurality of KPI states; storing the contribution threshold as trigger criteria information of the KPI correlation search definition in computer storage; wherein each of the plurality of KPI values in the data store is derived by an automatically performed search query that defines a KPI associated with a service from machine data pertaining to one or more entities identified in a stored service definition for the service; and wherein the method is performed by a computer system comprising one or more processing devices coupled to the computer storage.