Docs » Configure detectors and alerts in Splunk APM » Use default alert conditions in Splunk APM » Error rate - sudden change

Error rate - sudden change 🔗

Note

This page explains how to use this condition when you are creating a Splunk APM detector. If you are creating an Infrastructure or Custom Metrics detector, see this page instead.

What this alert condition does 🔗

Alerts when percentage of errors during a recent (short) time window (called the current window) are anomalous compared to values received during the preceding (typically longer) time window (called the historical window).

When to use this alert condition 🔗

Use this condition to find a sudden change in percentage of errors when you don’t want to use a static baseline for comparison. For example, a code push might cause a sudden increase in error rate.

Basic settings 🔗

PARAMETER VALUES USAGE NOTES
Trigger threshold and Clear threshold Number between 0 and 100, inclusive

Trigger the alert when the current value is more than this percentage above the historical norm.

Clear the alert when the current value is less than this percentage above the historical norm; must be lower than trigger threshold.

Advanced settings 🔗

PARAMETER VALUES USAGE NOTES
Current window Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w The time range being monitored for errors. For example, a value of 10m indicates that you are looking for the percentage error rate for the most recent 10 minutes.
Historical window Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w. Value should be smaller than Cycle length, and should be significantly larger than the signal resolution. The time window that defines normal values. For example, 1w indicates that values from the preceding week can be considered normal.
Minimum request volume Number >= 0 Minimum number of requests in current window; prevents alerts for sparse data.