Skip to content

Commit 2c53276

Browse files
Merge pull request #2497 from splunk/trangl-docguild-27671-cycle-length-clarify
Update cycle length explanation and examples
2 parents 879a6ea + 0132a88 commit 2c53276

File tree

1 file changed

+4
-2
lines changed
  • alerts-detectors-notifications/alerts-and-detectors/alert-condition-reference

1 file changed

+4
-2
lines changed

alerts-detectors-notifications/alerts-and-detectors/alert-condition-reference/hist-anomaly.rst

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ Basic settings
3434

3535
* - :strong:`Cycle length`
3636
- Integer >= 1, followed by time indicator (s, m, h, d, w). For example, 30s, 10m, 2h, 5d, 1w. Set this value to be significantly larger than the native resolution.
37-
- The time range that reflects the cyclicity of your signal. For example, a value of 1w indicates your signal follows a weekly cycle (you want to compare data for a Monday morning with previous Monday mornings). A value of 1d indicates your signal follows a daily cycle (you want to compare today's data with data from the same time yesterday, the day before, and so on.)
37+
- | The time range that reflects the cycle of your signal. For example, a value of ``1w`` indicates your signal follows a weekly cycle, and a value of ``1d`` indicates your signal follows a daily cycle.
38+
| Cycle length works in conjunction with the duration of the time window used for data comparison, represented by the :strong:`Current window` parameter. Data from the current window will be compared against data from one or more previous cycles to detect historical anomaly, depending on the value of the :strong:`Number of previous cycles` parameter.
39+
| For example, if the current window is ``1h`` and the cycle length is ``1w``, data in the past hour ([-1h, now]) is compared against data from the [-1w1h, -1w] hour, [-2w1h, -2w] hour, and so on.
3840
3941
* - :strong:`Alert when`
4042
- ``Too high``, ``Too low``, ``Too high or Too low``
@@ -62,7 +64,7 @@ Advanced settings
6264
- If the short-term variation in a signal is small relative to the scale of the signal, and the scale is somehow natural, using ``Mean plus percentage change`` is recommended; using ``Mean plus standard deviation`` might trigger alerts even for a large number of standard deviations. In addition, ``Mean plus percentage change`` is recommended for metrics which admit a direct business interpretation. For instance, if ``user_sessions`` drops by 20%, revenue drops by 5%.
6365

6466
* - :strong:`Current window`
65-
- Integer >= 1, followed by time indicator (s, m, h, d, w). For example, 30s, 10m, 2h, 5d, 1w. Set this value to be smaller than Cycle length, and significantly larger than the native resolution.
67+
- Integer >= 1, followed by time indicator (s, m, h, d, w). For example, 30s, 10m, 2h, 5d, 1w. Set this value to be shorter than cycle length, and significantly larger than the native resolution.
6668
- The time range against which to compare the data; you can think of this as the moving average window. Higher values compute the mean over more data points, which generally smoothes the value, resulting in lower sensitivity and potentially fewer alerts.
6769

6870
* - :strong:`Number of previous cycles`

0 commit comments

Comments
 (0)