Alert of Customized Davis Anormaly Detector Can not create a problem

[zhengma]

I have created a customized Davis Anormaly Detector , the status of the detector looks good, and from notebook metrics chart visualization, I believe there are a few potential alerts based on the threshold I set for this detector, however, there is no problem created. I have included the dt.source_entity as {dims:dt.entity.service} in the details of my detector.

Can someone help me understand what might be missing so the problems can not be created?

[p_devulapalli]

@zhengma Couple of things to check, first would be alert conditions, check the set threshold ,click on advance and see if the below are correctly set. 

In the same section, click on Preview and check the status, do you see any potential alerts?

[zhengma]

Thank you for the quick response! Yes I see the potential alerts of the detector I set up.

[p_devulapalli]

@zhengma  if you run a fetch events for the service, do you see any events for the source entity showing up for the duration detector was active ?

fetch events
| filter matchesValue(dt.source_entity, "Service-ID")

Also, are there any other open problems for this service, may be the event was merged to exiting problem. Can you look for any open problems ?

[zhengma]

Thank you for the guidance! Yes, there are some other events for this service e.g event.type as SERVICE_ERROR_RATE_INCREASED, and their entity_tags are set as Escalate:false, Page:false

I also did not see the problems created for those evetn. Will the setting of Escalate:false be the issue?

ANd my alert's event type is set as CUSTOM_ALERT, how to check if the event was merged ?

[g_kat]

Hi @zhengma,

Just to add to the others, have you set up the event type to something that would create a problem? I have mine as CUSTOM_ALERT and it generates problems normally.

George

[zhengma]

Yes i have set the event type as CUSTOM_ALERT, and has the alerting profile which including the CUSTOM events.

[AntonPineiro]

Hi,

Is your logic being matched? It means, maybe your trigger is not being matched.

Best regards 

[zhengma]

hey can you please clarify a little more? is the trigger the threshold I set for the detector? I think from preview perspective, I did see the potential alerts with current setting.