Hi @bakerld
Count the zeros over the 30-minute window in the query, then alert when the count is above 2.
Query A (Prometheus data source, query type Instant) →
promql
count_over_time((StartXfer{job="ADC-App", instance="Azure-Direct"} == 0)[30m:15s])
== 0 keeps only the failure samples, and count_over_time(...) counts them over the last 30 minutes. Replace 15s with your actual scrape interval so each failure is counted once. If you leave the step out, Prometheus uses the evaluation interval, which can miss failures or count a single one more than once.
If the values are strictly 0 or 1, this also works and counts raw samples exactly:
promql
count_over_time(StartXfer{job="ADC-App", instance="Azure-Direct"}[30m])
- sum_over_time(StartXfer{job="ADC-App", instance="Azure-Direct"}[30m])
Alert rule setup:
Go to Alerting → Alert rules → New alert rule and add the query above as A.
Add a Reduce expression (Function: Last, Input: A).
Add a Threshold expression (Input: the Reduce, IS ABOVE 2) and set it as the alert condition.
Set the evaluation interval (e.g. 1m).
Set No data handling to Normal. When there are no failures, == 0 returns an empty result, so without this the rule shows a no-data state instead of OK.
To check, paste the query into Explore, set the query type to Instant, and confirm the count matches the zeros on your graph.
If this metric is actually a counter of failures rather than a 0/1 value, use increase(<metric>[30m]) in the same setup (the Threshold step handles the > 2).
