Hi,
if I correctly understand your description,
Your settings mean:
- Violating: 15 of 20 → Davis opens a problem when, in the last 20 samples, at least 15 are violating.
- Dealerting: 20 → Davis will close the problem only after there are ≥ 20 non-violating samples and, at the same time, the current 20-sample window has < 15 violating samples.
This is based on samples, not minutes.
If your metric is sampled every 1 minute, then after recovery you typically need about 20 minutes of normal data (plus processing time) — but:
- If your sampling interval is shorter (e.g., every 10s), you’ll reach 20 samples much faster.
- If violations dropped earlier than you think, the rolling 20-sample window may already satisfy “< 15 violating” before your “11:22” point, so closure can happen sooner.
- Davis adds a bit of processing time (seconds to a minute or two) when it evaluates and closes.
So “11:22 + 20 minutes = 11:42” is only correct if you truly have 1-minute sampling and you started counting exactly at the first non-violating sample. Your observed 11:25 closure suggests either a shorter sampling interval or that the rolling 20-sample window had already accumulated enough normal samples sooner than assumed.
Here is documentation Anomaly detection configuration
2) There isn’t a dedicated placeholder for the metric event rule’s name itself. In titles/descriptions you can reference the metric’s display name and other context (current value, threshold, unit, dimensions, entity), but not the rule name.
