Configure Bounded Dynamic Threshold Algorithm Settings

This topic describes the Edit Bounded Dynamic Threshold Parameters dialog: what it is for, why the bounded dynamic threshold algorithm matters, and how to use each setting. The dialog opens when you click Edit (or the configuration link) for a metric that uses Bounded Dynamic Threshold on the Analytics & Threshold Configuration page. Bounded dynamic threshold policies appear only in the Applications section (for example, % Hang Time). For an overview of algorithms and where they apply, see Analytics algorithms overview and Analytics configuration sections. For the similar but unbounded algorithm, see Configure dynamic threshold settings.

Why the bounded dynamic threshold algorithm matters

The bounded dynamic threshold algorithm uses statistical analysis of the metric A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents. history on each entity Things deployed in the customer environment that are needed to run the business, such as applications, devices, interfaces, and locations. to produce an expected value every 15 minutes. It applies only to metrics with a bounded range (for example, 0–100% for percentages). That constraint allows a different treatment than the standard dynamic threshold: the algorithm can use a minimum observation count to filter out noisy or sparse windows. When the observed value is sufficiently unlikely given the expected distribution, and the number of observations in the window is high enough, the Analytics service creates an indicator An observed change in a specific metric stream that is recognized as being outside of an expected model. Indicators are correlated into triggers, and one or more triggers are grouped into incidents., and IQ Ops can create an incident A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. Configuring the dialog lets you tune sensitivity (how easily indicators are produced) and how much to require in terms of observation count and tolerance.

How to open the dialog

To open the Edit Bounded Dynamic Threshold Parameters dialog:

1. Navigate to the Analytics & Threshold Configuration Page:

   1. Click the Launchpad button ⁝⁝⁝.

   2. Click AI Ops > Analytics & Incidents.

   3. In the Management page, click the Hamburger Icon, then click Analytics & Threshold Configuration.

2. In the Applications section, find a row where the Analytics column shows Bounded Dynamic Threshold and the Configuration column shows the current parameters.

3. Click Edit for that row to open the Edit Bounded Dynamic Threshold Parameters dialog (the title includes the metric name, e.g. Edit Bounded Dynamic Threshold Parameters: % Hang Time).

Dialog settings

The dialog states that the system generates an indicator when the metric is anomalous. The following settings define what counts as anomalous and over what time period.

Time period (N of M)

You choose whether the algorithm produces an indicator after a single anomalous measurement or only when it has seen anomalous behavior in N out of the last M observations. Options: Over a single time period, For [N] consecutive time periods, or For [N] out of [M] time periods. The period length is the metric's granularity (e.g. 15 minutes). For a full explanation and examples, see N of M parameters.

Probability of an observed value is above

A percentage between 0 and 100. It represents how likely the observed value is to be normal given the learned distribution. Values closer to 100% make the algorithm less sensitive (fewer indicators). Values closer to 0% make it more sensitive (more indicators). The value must be strictly greater than 0 and strictly less than 100. You can enter the value or use the slider.

Probability of this number of observations is above

A percentage between 0 and 100. It represents how likely the number of observations in the 15-minute window is normal. This parameter helps filter out periods with very few measurements (noisy or sparse data). Values closer to 100% result in fewer indicators. Set this value below 20% in most cases. The value must be strictly greater than 0 and strictly less than 100.

Required minimum tolerance from expected value

Optional. Enter a positive number or zero in the metric's unit (e.g. seconds for response time, % for percentage metrics). The observed value must differ from the expected value by at least this amount for the period to count as anomalous. The dialog shows the metric name and unit. If you leave this empty, it is not used. Larger values make it harder to produce an indicator.

Required minimum number of observations

A threshold on the number of observations in the 15-minute window. If the number of observations is not above this value, the algorithm cannot create an indicator for that period, no matter how unlikely the observed value is. The dynamic threshold dialog has the same parameter; on the configuration page, the bounded algorithm’s summary does not display it. Larger values make it harder to produce an indicator.

Validation

The two probability values must be strictly greater than 0 and strictly less than 100. The required minimum tolerance, if provided, must be zero or positive. N and M (for the time period) must be positive, with N less than or equal to M when using N out of M time periods.

Difference from dynamic threshold

The dynamic threshold algorithm does not assume a bounded metric range. Both dialogs have the same four parameters: two probabilities, required minimum tolerance, and required minimum number of observations. The main difference is which metrics each algorithm applies to: use bounded dynamic threshold for metrics with a bounded range (e.g. 0–100%); use dynamic threshold for unbounded metrics (e.g. response time in milliseconds). On the Analytics & Threshold Configuration page, the configuration summary for bounded dynamic threshold does not display the minimum observations value; the dynamic threshold summary does show Min observations.