Configure Dynamic Threshold Algorithm Settings

This topic describes the Edit Dynamic Threshold Parameters dialog: what it is for, why the dynamic threshold algorithm matters, and how to use each setting. The dialog opens when you click Edit (or the configuration link) for a metric that uses Dynamic Threshold on the Analytics & Threshold Configuration page. Dynamic threshold policies appear in the Applications and Application activities sections (for example, Activity Network Time, Activity Response Time, Page Load Network Time). For an overview of algorithms and where they apply, see Analytics algorithms overview and Analytics configuration sections. For the similar algorithm that applies to bounded-range metrics (e.g. 0–100%), see Configure bounded dynamic threshold settings.

Why the dynamic threshold algorithm matters

The dynamic threshold algorithm uses statistical analysis of the metricClosed A measurement or data point that is monitored and analyzed to detect anomalies and generate incidents. history on each entityClosed Things deployed in the customer environment that are needed to run the business, such as applications, devices, interfaces, and locations. to produce an expected value every 15 minutes. It applies to metrics that are not necessarily bounded (for example, response time in milliseconds). The algorithm also uses the number of measurements in each 15-minute window to filter out noisy or sparse periods. When the observed value is sufficiently unlikely given the expected distribution, and the other conditions you configure are met, the Analytics service creates an indicatorClosed An observed change in a specific metric stream that is recognized as being outside of an expected model. Indicators are correlated into triggers, and one or more triggers are grouped into incidents., and IQ Ops can create an incidentClosed A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. Configuring the dialog lets you tune sensitivity and how much to require in terms of observation count and tolerance.

How to open the dialog

To open the Edit Dynamic Threshold Parameters dialog:

  1. Navigate to the Analytics & Threshold Configuration Page:

    1. Click the Launchpad button ⁝⁝⁝.

    2. Click AI Ops > Analytics & Incidents.

    3. In the Management page, click the Hamburger Icon, then click Analytics & Threshold Configuration.

  2. In the Applications or Application activities section, find a row where the Analytics column shows Dynamic Threshold and the Configuration column shows the current parameters.

  3. Click Edit for that row to open the Edit Dynamic Threshold Parameters dialog (the title includes the metric name, e.g. Edit Dynamic Threshold Parameters: Activity Response Time).

Dialog settings

The dialog states that the system generates an indicator when the metric is anomalous. The following settings define what counts as anomalous and over what time period.

Time period (N of M)

You choose whether the algorithm produces an indicator after a single anomalous measurement or only when it has seen anomalous behavior in N out of the last M observations. Options: Over a single time period, For [N] consecutive time periods, or For [N] out of [M] time periods. The period length is the metric's granularity (e.g. 15 minutes). For a full explanation and examples, see N of M parameters.

Probability of an observed value is above

A percentage between 0 and 100. It represents how likely the observed value is to be normal given the learned distribution. Values closer to 100% make the algorithm less sensitive (fewer indicators). Values closer to 0% make it more sensitive (more indicators). The value must be strictly greater than 0 and strictly less than 100. You can enter the value or use the slider.

Probability of this number of observations is above

A percentage between 0 and 100. It represents how likely the number of observations in the 15-minute window is normal. This parameter helps filter out periods with very few measurements (noisy or sparse data). Values closer to 100% result in fewer indicators. Set this value below 20% in most cases. The value must be strictly greater than 0 and strictly less than 100.

Required minimum tolerance from expected value

Optional. Enter a positive number or zero in the metric's unit (e.g. seconds for response time, % for percentage metrics). The observed value must differ from the expected value by at least this amount for the period to count as anomalous. The dialog shows the metric name and unit. If you leave this empty, it is not used. Larger values make it harder to produce an indicator.

Required minimum number of observations

A threshold on the number of observations in the 15-minute window. If the number of observations is not above this value, the algorithm cannot create an indicator for that period, no matter how unlikely the observed value is. Larger values make it harder to produce an indicator. The configuration summary on the Analytics & Threshold Configuration page displays this as Min observations.

Validation

The two probability values must be strictly greater than 0 and strictly less than 100. The required minimum tolerance, if provided, must be zero or positive. N and M (for the time period) must be positive, with N less than or equal to M when using N out of M time periods.

Difference from bounded dynamic threshold

The bounded dynamic threshold algorithm applies only to metrics with a bounded range (e.g. 0–100%). The dialog has the same four parameters (two probabilities, tolerance, and required minimum number of observations). The main difference is which metrics each algorithm applies to: use dynamic threshold for unbounded metrics (e.g. response time, network time); use bounded dynamic threshold for bounded metrics (e.g. % Hang Time). On the Analytics & Threshold Configuration page, the bounded algorithm's summary text does not show the minimum observations value; the dynamic threshold summary does show Min observations.