The docs are moving!

The docs are moving to a new site! If you can't find the information you're looking for on this page, check the Splunk Observability Cloud Documentation.

Error rate - sudden change 🔗

Note

This page explains how to use this condition when you are creating a Splunk APM detector. If you are creating an Infrastructure or Custom Metrics detector, see this page instead.

What this alert condition does 🔗

Alerts when percentage of errors during a recent (short) time window (called the current window) are anomalous compared to values received during the preceding (typically longer) time window (called the historical window).

When to use this alert condition 🔗

Use this condition to find a sudden change in percentage of errors when you don’t want to use a static baseline for comparison. For example, a code push might cause a sudden increase in error rate.

Basic settings 🔗

PARAMETER

VALUES

USAGE NOTES

Trigger threshold and Clear threshold

Number between 0 and 100, inclusive

Trigger the alert when the current value is more than this percentage above the historical norm.

Clear the alert when the current value is less than this percentage above the historical norm; must be lower than trigger threshold.

Advanced settings 🔗

PARAMETER	VALUES	USAGE NOTES
Current window	Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w	The time range being monitored for errors. For example, a value of 10m indicates that you are looking for the percentage error rate for the most recent 10 minutes.
Historical window	Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w. Value should be smaller than Cycle length, and should be significantly larger than the signal resolution.	The time window that defines normal values. For example, 1w indicates that values from the preceding week can be considered normal.
Minimum request volume	Number >= 0	Minimum number of requests in current window; prevents alerts for sparse data.