Anomaly Detection using User.events

[tarun_kumar_aga]

Hi,

we have many event properties and instead of converting into metric using openpipeline, we want to directly use fetch user.events & these event.properties in the anomaly detection. Please let us know if this is supported.

Thanks,

Tarun

[dylan_taelemans]

Hey, this is somewhat possible. You can trigger an alert as soon as one of those records is returned by using Advanced anomaly detection and selecting "The record analyzer".

This approach has some limitations and drawbacks, so I wouldn't recommend it. Fetching user events incurs a licensing cost, whereas metrics query is still free.

I would recommend using OpenPipeline to create a metric and then using that metric for anomaly detection or using openpipeline to create the event directly without the need to use anomaly detection.

While creating the metric will incur a cost, this approach is easier to manage/predict cost and should be more cost-effective in the long run.

One advantage of converting it into a metric is that you can configure Dynatrace to trigger an alert only when the event occurs for example at least 5 times within a specified time window, rather than alerting as soon as it happens once.