N of M Parameters

N of M parameters control when an analytics algorithm produces an indicator An observed change in a specific metric stream that is recognized as being outside of an expected model. Indicators are correlated into triggers, and one or more triggers are grouped into incidents.. Instead of firing on a single anomalous reading, the algorithm must see anomalous behavior in N out of the last M observations before it generates an indicator. Using N of M reduces noise from one-off spikes and brief glitches, so you get fewer incidents that clear on their own or do not need action.

You configure N and M on the Analytics & Threshold Configuration page, inside the settings for each of the four configurable algorithms. For how those algorithms fit into analytics and when indicators become incidents, see Analytics algorithms overview and Ingest & Analytics: Indicators.

How N of M works

N of M restricts indicator production to only those times when the algorithm has seen anomalous behavior in N out of the last M observations. If you use a single time period (no N of M), one anomalous measurement is enough to produce an indicator. With N of M, the system requires a short run of anomalies, which helps avoid generating indicators from transient blips.

Setting N and M

N of M is available in each of the four configurable analytics algorithms:

1. Threshold.

2. Baseline.

3. Dynamic Threshold.

4. Bounded Dynamic Threshold.

In each algorithm's configuration, look for the time period or measurement-count option (for example, For [N] out of [M] time periods). The exact label and allowed range (e.g. M up to 10, N at least 2 when M > 1) depend on the algorithm.

Example

A static threshold of 80% on inbound utilization with N = 4 and M = 5 means the algorithm produces an indicator only when inbound utilization exceeds 80% in four of the last five observations. A single spike or two is not enough. The high utilization must occur in at least four of those five periods.