11. A system comprising: a memory; and a processing device coupled with the memory to: cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; and store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds.
11. A system comprising: a memory; and a processing device coupled with the memory to: cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; and store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds. 12. The system of claim 11 wherein the determining of the KPI state includes: determining a contribution of a particular one of the entities by applying a determination component of the search query to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity.