Alert Creation

[Gib80]

Good Afternoon,

I have been trying to create an alert for when a rate = 0.00 for ALL service names I have, but I'm unclear how to complete it.  Any advise would be appreciated.  Below is what I have already (created using a log metric)

These are the servicenames for example PT01 and PT02

DQL IS:

timeseries zero = sum(log.risk, default:0.00), interval:1m, by: { servicename, rate }

| fieldsAdd tpsrate = toDoublesrate)
| filter rate == 0.00 

[t_pawlak]

Hi,
I think, that the issue is that you are grouping by rate (by:{ servicename, rate }). That makes rate a dimension, so you can’t reliably evaluate “rate = 0” per service. Group only by servicename, calculate the series value, and filter the latest point.
Try this, if you want 0 un last 5 min, set interval 5min

timeseries rate = sum(log.risk, default:0), interval:1m, by:{servicename}
| fieldsAdd last = arrayLast(rate)
| filter last == 0

Or in the metric event, configure split by dimension: servicename, like this:

timeseries rate = sum(log.risk, default:0), interval:5m, by:{servicename}
| fieldsAdd last = arrayLast(rate)
| filter last == 0