Alerts offers NRQL conditions in three threshold types: static, baseline, and outlier. This document explains how the outlier threshold type works, gives some example use cases and NRQL queries, and explains how to create an outlier condition.
In software development and operations, it is common to have a group consisting of members you expect to behave approximately the same. For example: for servers using a load balancer, the traffic to the servers may go up or down, but the traffic for all the servers should remain in a fairly tight grouping. See outlier detection in action in this NerdBytes video (2:51 minutes).
The NRQL alert outlier detection feature parses the data returned by your faceted NRQL query and:
- Looks for the number of expected groups that you specify
- Looks for outliers (values deviating from a group) based on the sensitivity and time range you set
Additionally, for queries that have more than one group, you can choose to be notified when groups start behaving the same.
This visual aid will help you understand the types of situations that will trigger a violation and those that won't.
For more on the rules and logic behind this calculation, see Outlier detection rules.
Note: this feature does not take into account the past behavior of the monitored values; it looks for outliers only in the currently reported data. For an alert type that takes into account past behavior, see Baseline alerting.
These use cases will help you understand when to use the outlier threshold type. Note that the outlier feature requires a NRQL query with a
For more details on how this feature works, see Outlier rules and logic.
To create a NRQL alert that uses outlier detection:
- When creating a condition, under Select a product, select NRQL.
- For Threshold type, select Outlier.
- Create a NRQL query with a
FACETclause that returns the values you want to alert on.
- Depending on how the returned values group together, set the Number of expected groups.
- Adjust the deviation from the center of the group(s) and the duration that will trigger a violation.
- Optional: Add a warning threshold and set its deviation.
- Set any remaining available options and save.
Here are the rules and logic behind how outlier detection works: