1. A method comprising: causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; wherein the derived value for the KPI reflects a measure of the performance of the service; and wherein the method is performed by a computer system comprising one or more processors coupled to computer storage.
1. A method comprising: causing display of a user interface having a threshold portion associated with a key performance indicator (KPI), the KPI defined by a search query that derives a value from machine data associated with one or more entities that provide a service, the threshold portion enabling a user to indicate one or more thresholds for the KPI and to indicate a per-entity application of the thresholds, each threshold corresponding to a different one of a plurality of KPI states; receiving an indication of the thresholds and of the per-entity application of the thresholds in response to user interaction with the user interface; storing the thresholds in association with a definition of the KPI in accordance with the received indication such that a determining of a KPI state from among a plurality of KPI states is made, for an execution of the search query, on a per-entity basis for at least one of the entities in accordance with the thresholds; wherein the derived value for the KPI reflects a measure of the performance of the service; and wherein the method is performed by a computer system comprising one or more processors coupled to computer storage. 4. The method of claim 1 further comprising: causing display of a user interface portion showing contributions of one or more of the entities and a visual representation of one or more of the plurality of KPI states, wherein the visual representation is determined at least in part by the thresholds.