I’m trying to set up an alert on sinusoidish data using holtWintersAberration. I’m getting a lot of false-positives, and I wonder if it’s because
- holtWinters stuff doesn’t work unless you have a lot of data-points, and
- Grafana alerts make it hard to select a big-enough timespan.
Suppose I have these queries
A: summarize( foo.bar.baz, '1h', 'sum', false ) B: holtWintersAberration(#A, 2)
I’ve tried a lot of things that don’t work, including:
- Setting summarize’s alignToInterval to true, so the newest data-point isn’t temporally incomplete.
- Setting “override relative time” on the graph to 4 weeks, to pull more data.
- Querying for “max” of “query(B, 3h, now)”, to look at the 3 most recent data-points, and only alarming if they’re all aberrant.
I think what I want is to query for “last” of “query(B, 3w, now)”, but when I try setting it to 3 weeks, I get an error.
Am I doing this entirely wrong? Has anyone had success setting up a Holt-Winters-based alert?