Error rate - sudden change 🔗
Note
This page explains how to use this condition when you are creating a Splunk APM detector. If you are creating an Infrastructure or Custom Metrics detector, see this page instead.
What this alert condition does 🔗
Alerts when percentage of errors during a recent (short) time window (called the current window) are anomalous compared to values received during the preceding (typically longer) time window (called the historical window).
When to use this alert condition 🔗
Use this condition to find a sudden change in percentage of errors when you don’t want to use a static baseline for comparison. For example, a code push might cause a sudden increase in error rate.
Basic settings 🔗
| PARAMETER | VALUES | USAGE NOTES |
|---|---|---|
| Trigger threshold and Clear threshold | Number between 0 and 100, inclusive | Trigger the alert when the current value is more than this percentage above the historical norm. Clear the alert when the current value is less than this percentage above the historical norm; must be lower than trigger threshold. |
Advanced settings 🔗
| PARAMETER | VALUES | USAGE NOTES |
|---|---|---|
| Current window | Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w | The time range being monitored for errors. For example, a value of 10m indicates that you are looking for the percentage error rate for the most recent 10 minutes. |
| Historical window | Integer >= 1, followed by time indicator (s, m, h, d, w), e.g. 30s, 10m, 2h, 5d, 1w. Value should be smaller than Cycle length, and should be significantly larger than the signal resolution. | The time window that defines normal values. For example, 1w indicates that values from the preceding week can be considered normal. |
| Minimum request volume | Number >= 0 | Minimum number of requests in current window; prevents alerts for sparse data. |