11. A system comprising: a memory; and a processing device coupled with the memory to: cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; and store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds.
11. A system comprising: a memory; and a processing device coupled with the memory to: cause display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receive an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; and store the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds. 13. The system of claim 11 wherein the determining of the KPI state includes: determining an overall contribution by applying a determination component of the search query to the machine data; determining a contribution of a particular one of the entities by applying the determination component to an aggregate of machine data corresponding to the particular entity; and selecting a KPI state based at least in part on applying at least one of the thresholds to the determined contribution of the particular entity and on applying an aggregate threshold to the determined overall contribution.