Page Comparison

...

The deviation method triggers an alert every time an aggregated value of a single grouped element is significantly higher or lower than the median value of all the elements within the same grouping period. This alert type is similar in concept and execution to the gradient type; they both use deviations from values to trigger alerts, however, they differ in the value they use to calculate the deviation. In the case of the deviation type, it is from the median of the values in the same period while in the gradient type, it is from the analogous value of the previous period with data. See the following picture for a more visual explanation.

Image Modified

This type of alert could be useful when monitoring periodic tasks and their data patterns to be informed whenever the aggregated values inside a period differ too much from the frequency distribution midpoint.

What data do I need to create this alert?

To create an alert using this triggering method, your query must group events by at least one grouping key using a time-based option and add an aggregation. However, to have meaningful data for the alert, it is necessary to group by at least two keys.

• If you did not group, this alert type will not appear for you to select in the alert definition window.
• If you grouped without the necessary key or used a no time-based option, the alert variables will not appear for you to define and a message will inform you about the requirements you still need to meet.
  
• If you did not aggregate, you will not have the column you need for the Add a numeric column field (see the following section) and therefore you will not be able to create the alert.

...

First of all, you need to filter your query data using the Equal (eq, =) operation, group your query data by two keys using a time-based option and then aggregate it. Then, you need to open the alert definition window, select the deviation type alert and fill in all the details (pay special attention to the specific settings of this alert type).

To save time, you can copy the following query to reproduce the aforementioned example from the demo.ecommerce.data sample table and create a deviation type alert.

from demo.ecommerce.data
where statusCode = 404
group every 30m by clientIpAddress, statusCode
every 30m
select count() as count

...