Configure Baseline Algorithm Settings

This topic describes the Edit Baselining Parameters dialog: what it is for, why the baseline algorithm matters, and how to use each setting. The dialog opens when you click Edit (or the configuration link) for a metric that uses Baselining on the Analytics & Threshold Configuration page. Baseline policies appear in the Network interfaces and Applications sections. For an overview of algorithms and where they apply, see Analytics Algorithms Overview and Analytics Configuration Sections.

Why the baseline algorithm matters

The baseline algorithm learns seasonal variation (time of day, day of week) for the metricClosed A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents. on each entityClosed Things deployed in the customer environment that are needed to run the business, such as applications, devices, interfaces, and locations.. Instead of a fixed threshold, it computes an expected value for every 15-minute period from that learned history. When the observed value deviates from the expected value by enough, the Analytics service creates an indicatorClosed An observed change in a specific metric stream that is recognized as being outside of an expected model. Indicators are correlated into triggers, and one or more triggers are grouped into incidents., and IQ Ops can create an incidentClosed A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. That makes baseline a good fit for metrics that vary by time (e.g. utilization or response time). Configuring the parameters in this dialog controls how large a deviation is required before the algorithm produces an indicator, so you can tune sensitivity and reduce false positives or catch more anomalies.

How to open the dialog

To open the Edit Baselining Parameters dialog:

  1. Navigate to the Analytics & Threshold Configuration Page:

    1. Click the Launchpad button ⁝⁝⁝.

    2. Click AI Ops > Analytics & Incidents.

    3. In the Management page, click the Hamburger Icon, then click Analytics & Threshold Configuration.

  2. In the Network interfaces or Applications section, find a row where the Analytics column shows Baselining and the Configuration column shows the current baseline settings.

  3. Click Edit for that row to open the Edit Baselining Parameters dialog.

Dialog settings

The dialog title includes the metric name (e.g. Edit Baselining Parameters: In Utilization). The following settings control when the algorithm produces an indicator.

Generate indicator when the metric is anomalous

The dialog states that the system generates an indicator when the metric is anomalous. The next sections define what counts as anomalous: a time period choice (single or N of M) and deviation thresholds.

Time period (N of M)

You choose whether the algorithm produces an indicator after a single anomalous measurement or only when it has seen anomalous behavior in N out of the last M observations. Options:

  • Over a single time period: One anomalous measurement can produce an indicator.

  • For [N] consecutive time periods: The algorithm produces an indicator only when the last N measurements in a row are anomalous.

  • For [N] out of [M] time periods: The algorithm produces an indicator when N of the last M measurements are anomalous. N must be less than or equal to M.

The time period length is the granularity for the metric (e.g. 15 minutes). For a full explanation and examples, see N of M parameters.

Deviation thresholds

The algorithm considers the metric anomalous in a time period when its observed value is above or below the expected value by at least the amount you configure. At least one of the two deviation options must be enabled.

  • % above expected value: Turn the switch on and enter a positive number (e.g. 80). The observed value must be greater than the expected value by that percentage for the period to count as anomalous (e.g. for expected 10.0 and 80% above, observed must be greater than 18.0). Larger values make it harder to produce an indicator. If the switch is off, the algorithm does not create indicators when the observed value is above the expected value.

  • % below expected value: Turn the switch on and enter a positive number (e.g. 20). The observed value must be less than the expected value by that percentage (e.g. for expected 10.0 and 20% below, observed must be less than 8.0). Smaller percentages below make it harder to produce an indicator. If the switch is off, the algorithm does not create indicators when the observed value is below the expected value.

  • Required minimum tolerance from expected value: Optional. Enter a positive number or zero in the metric’s unit (e.g. seconds, percent). This setting is an absolute tolerance: the observed value must differ from the expected value by at least this amount (above or below) for the period to count as anomalous. For example, with expected 10.0 and tolerance 5.0, observed must be greater than 15 or less than 5. If you leave this empty or null, it is not used. Larger values make it harder to produce an indicator.

Other behavior

  • Metric name and unit: The dialog shows the metric name and uses the metric’s unit for the minimum tolerance field. These are read-only and match the metric you are editing.

  • Granularity: The granularity (e.g. 15 mins) is the time interval used for baselining. The policy sets it and it should match the interval that Analytics uses for this metric. If you need to change it, use the same interval as other policies for that metric.

  • Validation: All numeric values must be positive (or zero for tolerance). At least one of the two deviation switches (% above or % below) must be on.

Disabling a baseline policy

If you disable a baseline policy (turn the metric off on the Analytics & Threshold Configuration page), the system deletes baseline data for that metric. The system will not generate new indicators until it has retrained, which can take up to two days. The change affects all entities of that type. Enable or disable from the Analytics & Threshold Configuration page.