Metric Functions

Metric functions include mean, min and max. These values are calculated for each bucket. Field values that cannot be converted to double precision floating point numbers are ignored.

  • min
  • max
  • mean, high_mean, low_mean
  • metric
  • varp

min

High or low sided functions are not applicable.

  • fieldName: required
  • byFieldName: optional
  • overFieldName: optional

Example

Detect where the smallest transaction is lower than previously observed. This could be used to detect items for sale at unintentionally low prices due to data entry mistakes.

{ "function" : "min", "fieldName" : "amt", "byFieldName" : "product" }
  • Model the minumum amount for each product over time
  • Detect when the minumum amount for a product is unusually low compared to its past amounts

High or low sided functions are not applicable.

max

High or low sided functions are not applicable.

  • fieldName: required
  • byFieldName: optional
  • overFieldName: optional

Example

Detect where the longest responsetime is longer than previously observed. This could be used to detect applications which have responsetimes that are unusually lengthy.

{ "function" : "max", "fieldName" : "responsetime", "byFieldName" : "application" }
  • Model the maximum responsetime for each application over time
  • Detect when the longest responsetime is unusually long compared to previous application

Note: This analysis can be performed alongside high_mean by application. By combining detectors and using the same influencer this would detect both unusually long individual responsetimes as well as average responsetimes for each bucket. For example:

{ "function" : "max", "fieldName" : "responsetime", "byFieldName" : "application" },
{ "function" : "high_mean", "fieldName" : "responsetime", "byFieldName" : "application" }
...

mean

High and low sided functions are suppported.

  • fieldName: required
  • byFieldName: optional
  • overFieldName: optional

Example

{ "function" : "mean", "fieldName" : "responsetime", "byFieldName" : "application" }
{ "function" : "high_mean", "fieldName" : "responsetime", "byFieldName" : "application" }
{ "function" : "low_mean", "fieldName" : "responsetime", "byFieldName" : "application" }
  • Model the mean responsetime for each application over time
  • Detect when the mean responsetime is unusual compared to previous responsetimes

Use high_mean if you wish to monitor unusually high average responsetimes. Use low_mean if you are just interested in unusually low average responsetimes.

median

Note: Currently in beta and not supported for use in production.

High or low sided functions are not supported.

  • fieldName: required
  • byFieldName: optional
  • overFieldName: optional

Example

{ "function" : "median", "fieldName" : "responsetime", "byFieldName" : "application" }
  • Model the median responsetime for each application over time
  • Detect when the median responsetime is unusual compared to previous responsetimes

metric

The metric function combines min, max and mean. It can be used as a shorthand for a combined analysis. This is the default function if none is specified.

High or low sided functions are not applicable. This function cannot be used when a summaryCountFieldName is specified.

  • fieldName: required
  • byFieldName: optional
  • overFieldName: optional

Example

{ "function" : "metric", "fieldName" : "responsetime", "byFieldName" : "application" }
  • Model the mean, min and max responsetime for each application over time
  • Detect when the mean, min or max responsetime is unusual compared to previous responsetimes

Note

Prior to Engine API 1.3, the sum function was included as part of metric. If you wish to continue to use the sum function alongside mean, min and max, then please create an additional detector.

varp

This function will detect anomalies in the variance of a value which is a measure of the variability and spread in the data.

  • fieldName: required
  • byFieldName: optional
  • overFieldName: optional

Example

{ "function" : "varp", "fieldName" : "responsetime", "byFieldName" : "application" }
{ "function" : "high_varp", "fieldName" : "responsetime", "byFieldName" : "application" }
{ "function" : "low_varp", "fieldName" : "responsetime", "byFieldName" : "application" }
  • Model the variance in values of responsetime for each application over time
  • Detect when the variance in responsetime is unusual compared to past application behavior

Use high_varp if you wish to monitor unusually high variance. Use low_varp if you are just interested in unusually low variance.