Another dilemma with anomaly detection wow

[henk_stobbe]

Good morning everybody,

When running an extension sometimes you get a metric that is more a status.

Example numbers 1 and 2 meaning up and down (it is just an example), so what I really would like to do is translate a number 2 to an event.

In the documentation it states that the preferred way to go I should use the anomaly detection APP.

Is it the correct way to go and say to davis: 3 times above 1 is and event .......

Who has some thoughts about this? 

[sujit_k_singh · Accepted solution]

@henk_stobbe 

For status‑type metrics (like 1 = up, 2 = down), the usual approach is to create a metric event with a static threshold.
For example: alert when the value equals 2 and requires 3 consecutive violating data points. That gives you exactly the “3 times above 1 = event” logic.

The Anomaly Detection app is only needed if you want more advanced logic. For most extension status metrics, a basic metric event is enough and works well with Davis.

So in short:
If 2 always means “down”, just create a metric event → threshold = 2 → alert after 3 samples

[henk_stobbe]

Great, thanks for you quick answer, I assume I got the emphasis wrong.😀

Thanks again and have a nice day.