We have an "incident" defined in Dynatrace with two measures: User Experience Index (Visits) lower severe threshold = 0.7 (avg aggregation) and visit count upper severe threshold is 5. The Evalutation Timeframe is 15 minutes. I believe that should trigger when UE index is less than 0.7 for more than 5 users online over a 15 minute period. However, we're having trouble correlating these alerts with what we actually see in the Dynatrace console.
For example, we got an alert that came in at 2018-09-05 8:02AM saying the average UE was 0.25 for 6 users. My understanding is that means we should see an average UE index of 0.25 over all visits between 7:47AM and 8:02AM (at least approximately). However, when I look at the visits from that time, I see 5 users with UE = 1.0 and a single user at 0.5. Shouldn't ((5*1.0)+(1*0.50)) / 6 = 0.92 which is well above 0.70 let alone 0.25. How can we get an alert for average UE = 0.25 when not a single user has a UE that low? I'm thinking either our alert is set up incorrectly or we aren't searching correctly, but I've talked with a few other people in our company and we can't figure out what's wrong.