DQL for alert if at least 2/5 locations fail 3 times consecutively

[sivart_89]

I'm trying to essentially duplicate this type of alerting but with a custom alert in the Davis anomaly detection app. What I'm struggling most with is the '3 times consecutively' part. The synthetic I am working with runs every 5 minutes, any ideas of a DQL that would work for this? I have some simple code below, it just needs to be improved upon.

timeseries synthetics_v = avg(dt.synthetic.browser.availability), by: {dt.entity.synthetic_test, dt.entity.synthetic_location}, interval: 5m
| fieldsAdd syntheticName = entityName(dt.entity.synthetic_test)
| fieldsAdd locationName = entityName(dt.entity.synthetic_location)
| filter contains(syntheticName, "<synthetic name>")

[p_devulapalli]

@sivart_89 - I think you can achieve it by using violating samples and sliding window in advanced properties of anomaly detector app

https://docs.dynatrace.com/docs/shortlink/anomaly-detection-configuration#sliding-window

[sivart_89]

If I set it up this way then an alert will get created when a single location fails 3 times within a 5 minute window. There's 2 things I see wrong with this. First, I need it to alert when there are 3 consecutive failures and second, I only need an alert if 2 locations fail 3 times consecutive, I don't want an alert if just 1 single location is failing.