Documentation
5 §¶§å§ß§Ü§è§Ú?§Ö §ä§â§Ö§ß§Õ§à§Ó§Ñ
§¶§å§ß§Ü§è§Ú?§Ö §ä§â§Ö§ß§Õ§à§Ó§Ñ, §Ù§Ñ §â§Ñ§Ù§Ý§Ú§Ü§å §à§Õ §æ§å§ß§Ü§è§Ú?§Ñ §Ú§ã§ä§à§â§Ú?§Ö, §Ü§à§â§Ú§ã§ä§Ö §ä§â§Ö§ß§Õ §á§à§Õ§Ñ§ä§Ü§Ö §Ù§Ñ §á§â§à§â§Ñ§é§å§ß§Ö.
§´§â§Ö§ß§Õ§à§Ó§Ú §é§å§Ó§Ñ?§å §ã§Ñ§ä§ß§Ö §Ñ§Ô§â§Ö§Ô§Ú§â§Ñ§ß§Ö §Ó§â§Ö§Õ§ß§à§ã§ä§Ú. §¶§å§ß§Ü§è§Ú?§Ö §ä§â§Ö§ß§Õ§Ñ §Ü§à§â§Ú§ã§ä§Ö §à§Ó§Ö §á§â§à§ã§Ö§Ü§Ö §á§à §ã§Ñ§ä§å §Ú §ã§ä§à§Ô§Ñ §ã§å §Ü§à§â§Ú§ã§ß§Ö §Ù§Ñ §Õ§å§Ô§à§â§à§é§ß§Ö §Ñ§ß§Ñ§Ý§Ú§Ù§Ö.
§²§Ö§Ù§å§Ý§ä§Ñ§ä§Ú §æ§å§ß§Ü§è§Ú?§Ö §ä§â§Ö§ß§Õ§Ñ §ã§Ö §Ü§Ö§ê§Ú§â§Ñ?§å §ä§Ñ§Ü§à §Õ§Ñ §Ó§Ú§ê§Ö§ã§ä§â§å§Ü§Ú §á§à§Ù§Ú§Ó§Ú §Ú§ã§ä§Ö §æ§å§ß§Ü§è§Ú?§Ö §ã§Ñ §Ú§ã§ä§Ú§Þ §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú§Þ§Ñ §Õ§à§ç§Ó§Ñ§ä§Ñ?§å §Ú§ß§æ§à§â§Þ§Ñ§è§Ú?§Ö §Ú§Ù §Ò§Ñ§Ù§Ö §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §ã§Ñ§Þ§à ?§Ö§Õ§ß§à§Þ. §¬§Ö§ê §æ§å§ß§Ü§è§Ú?§Ñ §ä§â§Ö§ß§Õ§à§Ó§Ñ §Ü§à§ß§ä§â§à§Ý§Ú§ê§Ö TrendFunctionCacheSize §á§Ñ§â§Ñ§Þ§Ö§ä§Ñ§â §ã§Ö§â§Ó§Ö§â§Ñ.
§°§Ü§Ú§Õ§Ñ§é§Ú §Ü§à?§Ú §â§Ö§æ§Ö§â§Ö§ß§è§Ú§â§Ñ?§å §ã§Ñ§Þ§à §æ§å§ß§Ü§è§Ú?§Ö §ä§â§Ö§ß§Õ§à§Ó§Ñ §ã§Ö §á§â§à§è§Ö?§å?§å ?§Ö§Õ§ß§à§Þ §å §ß§Ñ?§Þ§Ñ?§Ö§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å §å §Ú§Ù§â§Ñ§Ù§å. §¯§Ñ §á§â§Ú§Þ§Ö§â, §à§Ü§Ú§Õ§Ñ§é §á§à§á§å§ä
?§Ö §ã§Ö §á§â§à§è§Ö?§Ú§Ó§Ñ§ä§Ú ?§Ö§Õ§ß§à§Þ §Õ§ß§Ö§Ó§ß§à. §¡§Ü§à §à§Ü§Ú§Õ§Ñ§é §ã§Ñ§Õ§â§Ø§Ú §Ú §æ§å§ß§Ü§è§Ú?§Ö §ä§â§Ö§ß§Õ§Ñ §Ú §Ú§ã§ä§à§â§Ú?§Ö (§Ú§Ý§Ú §Õ§Ñ§ä§å§Þ §Ú §Ó§â§Ö§Þ§Ö and/or nodata()), §Ú§Ù§â§Ñ§é§å§ß§Ñ§Ó§Ñ §ã§Ö §å §ã§Ü§Ý§Ñ§Õ§å §ã§Ñ §å§à§Ò§Ú§é§Ñ?§Ö§ß§Ú§Þ §á§â§Ú§ß§è§Ú§á§Ú§Þ§Ñ.
§³§Ó§Ö §æ§å§ß§Ü§è§Ú?§Ö §ß§Ñ§Ó§Ö§Õ§Ö§ß§Ö §à§Ó§Õ§Ö §ã§å §á§à§Õ§â§Ø§Ñ§ß§Ö §å:
§¶§å§ß§Ü§è§Ú?§Ö §ã§å §ß§Ñ§Ó§Ö§Õ§Ö§ß§Ö §Ò§Ö§Ù §Õ§à§Õ§Ñ§ä§ß§Ú§ç §Ú§ß§æ§à§â§Þ§Ñ§è§Ú?§Ñ. §¬§Ý§Ú§Ü§ß§Ú§ä§Ö §ß§Ñ §æ§å§ß§Ü§è§Ú?§å §Õ§Ñ §Ò§Ú§ã§ä§Ö §Ó§Ú§Õ§Ö§Ý§Ú §ã§Ó§Ö §Õ§Ö§ä§Ñ?§Ö.
| Function | Description |
|---|---|
| baselinedev | §£§â§Ñ?§Ñ §Ò§â§à? §à§Õ§ã§ä§å§á§Ñ?§Ñ (§á§à stddevpop §Ñ§Ý§Ô§à§â§Ú§ä§Þ§å) §Ú§Ù§Þ§Ö?§å §á§à§ã§Ý§Ö§Õ?§Ö§Ô §á§Ö§â§Ú§à§Õ§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ú §Ú§ã§ä§Ú§ç §á§Ö§â§Ú§à§Õ§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §å §á§â§Ö§ä§ç§à§Õ§ß§Ú§Þ §ã§Ö§Ù§à§ß§Ñ§Þ§Ñ. |
| baselinewma | §ª§Ù§â§Ñ§é§å§ß§Ñ§Ó§Ñ §Ò§Ñ§Ù§ß§å §Ý§Ú§ß§Ú?§å §á§â§à§ã§Ö§é§ß§à§ê?§å §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ú§Ù §Ú§ã§ä§à§Ô §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §à§Ü§Ó§Ú§â§Ñ §å §Ó§Ú§ê§Ö ?§Ö§Õ§ß§Ñ§Ü§Ú§ç §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç §á§Ö§â§Ú§à§Õ§Ñ ('seasons') §Ü§à§â§Ú§ã§ä§Ö?§Ú §Ñ§Ý§Ô§à§â§Ú§ä§Ñ§Þ §á§à§ß§Õ§Ö§â§Ú§ã§Ñ§ß§à§Ô §á§à§Ü§â§Ö§ä§ß§à§Ô §á§â§à§ã§Ö§Ü§Ñ. |
| trendavg | §±§â§à§ã§Ö§Ü §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å. |
| trendcount | §¢§â§à? §å§ã§á§Ö§ê§ß§à §á§â§Ö§å§Ù§Ö§ä§Ú§ç §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §Ú§ã§ä§à§â§Ú?§Ö §Ü§à§â§Ú§ê?§Ö§ß§Ú§ç §Ù§Ñ §Ú§Ù§â§Ñ§é§å§ß§Ñ§Ó§Ñ?§Ö §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å. |
| trendmax | §®§Ñ§Ü§ã§Ú§Þ§Ñ§Ý§ß§Ö §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å. |
| trendmin | §®§Ú§ß§Ú§Þ§å§Þ §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å. |
| trendstl | §£§â§Ñ?§Ñ §ã§ä§à§á§å §Ñ§ß§à§Þ§Ñ§Ý§Ú?§Ñ §ä§à§Ü§à§Þ §á§Ö§â§Ú§à§Õ§Ñ §à§ä§Ü§â§Ú§Ó§Ñ?§Ñ ¨C §Õ§Ö§è§Ú§Þ§Ñ§Ý§ß§å §Ó§â§Ö§Õ§ß§à§ã§ä §Ú§Ù§Þ§Ö?§å 0 §Ú 1 §Ü§à?§Ñ ?§Ö ((§Ò§â§à? §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §Ñ§ß§à§Þ§Ñ§Ý§Ú?§Ñ)/(§å§Ü§å§á§Ñ§ß §Ò§â§à? §Ó§â§Ö§Õ§ß§à§ã§ä§Ú)). |
| trendsum | §©§Ò§Ú§â §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å. |
§©§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú
/host/key?§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ú §à§Ò§Ñ§Ó§Ö§Ù§ß§Ú §á§â§Ó§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§Ñ§âtime period:time shift?§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ú §Õ§â§å§Ô§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§Ñ§â, §Ô§Õ§Ö ?§Ö:- time period - §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú §á§Ö§â§Ú§à§Õ (§Þ§Ú§ß§Ú§Þ§å§Þ '1h'), §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö ?§Ö
N- §Ò§â§à? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç ?§Ö§Õ§Ú§ß§Ú§è§Ñ,time unit- h (§ã§Ñ§ä), d (§Õ§Ñ§ß), w (§ã§Ö§Õ§Þ§Ú§è§Ñ), M (§Þ§Ö§ã§Ö§è) §Ú§Ý§Ú y (§Ô§à§Õ§Ú§ß§Ñ). - time shift - §á§à§Þ§Ñ§Ü §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §á§Ö§â§Ú§à§Õ§Ñ (§á§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §á§â§Ú§Þ§Ö§â§Ö §æ§å§ß§Ü§è§Ú?§Ñ)
- time period - §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú §á§Ö§â§Ú§à§Õ (§Þ§Ú§ß§Ú§Þ§å§Þ '1h'), §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö ?§Ö
§¥§Ö§ä§Ñ?§Ú §æ§å§ß§Ü§è§Ú?§Ö
§¯§Ö§Ü§Ö §à§á§ê§ä§Ö §ß§Ñ§á§à§Þ§Ö§ß§Ö §à §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú§Þ§Ñ §æ§å§ß§Ü§è§Ú?§Ö:
- §±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú §æ§å§ß§Ü§è§Ú?§Ö §ã§å §à§Õ§Ó§à?§Ö§ß§Ú §Ù§Ñ§â§Ö§Ù§à§Þ
- §°§á§è§Ú§à§ß§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú §æ§å§ß§Ü§è§Ú?§Ö (§Ú§Ý§Ú §Õ§Ö§Ý§à§Ó§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§Ñ§â§Ñ) §ã§å §à§Ù§ß§Ñ§é§Ö§ß§Ú §ã§Ñ
<> - §±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú §ã§á§Ö§è§Ú§æ§Ú§é§ß§Ú §Ù§Ñ §æ§å§ß§Ü§è§Ú?§å §à§á§Ú§ã§Ñ§ß§Ú §ã§å §å§Ù §ã§Ó§Ñ§Ü§å §æ§å§ß§Ü§è§Ú?§å
/host/key§Útime period:time shift§á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú §ß§Ú§Ü§Ñ§Õ§Ñ §ß§Ö §ã§Þ§Ö?§å §Ò§Ú§ä§Ú §á§à§Õ §ß§Ñ§Ó§à§Õ§ß§Ú§è§Ú§Þ§Ñ
baselinedev(/host/key,data period:time shift,season unit,num seasons)
§£§â§Ñ?§Ñ §Ò§â§à? §à§Õ§ã§ä§å§á§Ñ?§Ñ (§á§à stddevpop §Ñ§Ý§Ô§à§â§Ú§ä§Þ§å) §Ú§Ù§Þ§Ö?§å §á§à§ã§Ý§Ö§Õ?§Ö§Ô §á§Ö§â§Ú§à§Õ§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ú §Ú§ã§ä§Ú§ç §á§Ö§â§Ú§à§Õ§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §å §á§â§Ö§ä§ç§à§Õ§ß§Ú§Þ §ã§Ö§Ù§à§ß§Ñ§Þ§Ñ.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
**data period** - §á§Ö§â§Ú§à§Õ §á§â§Ú§Ü§å§á?§Ñ?§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §å §ã§Ö§Ù§à§ß§Ú, §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö ?§Ö:<br>`N` - §Ò§â§à? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç ?§Ö§Õ§Ú§ß§Ú§è§Ñ<br>`time unit` - h (§ã§Ñ§ä ), d (§Õ§Ñ§ß), w (§ã§Ö§Õ§Þ§Ú§è§Ñ), M (§Þ§Ö§ã§Ö§è) §Ú§Ý§Ú y (§Ô§à§Õ§Ú§ß§Ñ), §Þ§à§â§Ñ?§å §Ò§Ú§ä§Ú ?§Ö§Õ§ß§Ñ§Ü§Ú §Ú§Ý§Ú §Þ§Ñ?§Ú §à§Õ §ã§Ö§Ù§à§ß§Ö<br>
§±§â§Ú§Þ§Ö§â§Ú:
baselinedev(/host/key,1d:now/d,"M",6) #calculating the number of standard deviations (population) between the previous day and the same day in the previous 6 months. If the date doesn't exist in a previous month, the last day of the month will be used (Jul,31 will be analysed against Jan,31, Feb, 28,... June, 30)
baselinedev(/host/key,1h:now/h,"d",10)#calculating the number of standard deviations (population) between the previous hour and the same hours over the period of ten days before yesterdaybaselinewma(/host/key,data period:time shift,season unit,num seasons)
§ª§Ù§â§Ñ§é§å§ß§Ñ§Ó§Ñ §à§ã§ß§à§Ó§ß§å §Ó§â§Ö§Õ§ß§à§ã§ä §á§â§à§ã§Ö§Ü§à§Þ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §Ú§Ù §Ú§ã§ä§à§Ô §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §á§Ö§â§Ú§à§Õ§Ñ §å §Ó§Ú§ê§Ö ?§Ö§Õ§ß§Ñ§Ü§Ú§ç §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç §á§Ö§â§Ú§à§Õ§Ñ ('seasons') §Ü§à§â§Ú§ã§ä§Ö?§Ú §á§à§ß§Õ§Ö§â§Ú§ã§Ñ§ß§Ú §Ñ§Ý§Ô§à§â§Ú§ä§Ñ§Þ §á§à§Ü§â§Ö§ä§ß§à§Ô §á§â§à§ã§Ö§Ü§Ñ.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ö;
- §á§Ö§â§Ú§à§Õ §á§â§Ú§Ü§å§á?§Ö§ß§Ú§ç §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ - §á§Ö§â§Ú§à§Õ §á§â§Ú§Ü§å§á?§Ñ?§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §å §ã§Ö§Ù§à§ß§Ú, §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö ?§Ö:
N- §Ò§â§à? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç ?§Ö§Õ§Ú§ß§Ú§è§Ñtime unit- h (§ã§Ñ§ä ), d (§Õ§Ñ§ß), w (§ã§Ö§Õ§Þ§Ú§è§Ñ), M (§Þ§Ö§ã§Ö§è) §Ú§Ý§Ú y (§Ô§à§Õ§Ú§ß§Ñ), §Þ§à§â§Ñ?§å §Ò§Ú§ä§Ú ?§Ö§Õ§ß§Ñ§Ü§Ú §Ú§Ý§Ú §Þ§Ñ?§Ú §à§Õ §ã§Ö§Ù§à§ß§Ö
§£§â§Ö§Þ§Ö§ß§ã§Ü§Ú §á§à§Þ§Ñ§Ü ¨C §á§à§Þ§Ñ§Ü §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §á§Ö§â§Ú§à§Õ§Ñ, §Õ§Ö§æ§Ú§ß§Ú§ê§Ö §Ü§â§Ñ? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §à§Ü§Ó§Ú§â§Ñ §á§â§Ú§Ü§å§á?§Ñ?§Ñ §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ §å §ã§Ö§Ù§à§ß§Ñ§Þ§Ñ (§Ó§Ú§Õ§Ú §á§â§Ú§Þ§Ö§â§Ö); - ?§Ö§Õ§Ú§ß§Ú§è§Ñ §ã§Ö§Ù§à§ß§Ö - §ä§â§Ñ?§Ñ?§Ö ?§Ö§Õ§ß§Ö §ã§Ö§Ù§à§ß§Ö (h, d, w, M, y), §ß§Ö §Þ§à§Ø§Ö §Ò§Ú§ä§Ú §Þ§Ñ?§Ö §à§Õ §á§Ö§â§Ú§à§Õ§Ñ §á§â§Ú§Ü§å§á?§Ö§ß§Ú§ç §á§à§Õ§Ñ§ä§Ñ§Ü§Ñ;
- §Ò§â§à? §ã§Ö§Ù§à§ß§Ñ - §Ò§â§à? §ã§Ö§Ù§à§ß§Ñ §Ù§Ñ §á§â§à§è§Ö§ß§å.
§±§â§Ú§Þ§Ö§â§Ú:
baselinewma(/host/key,1h:now/h,"d",3) #calculating the baseline based on the last full hour within a 3-day period that ended yesterday. If "now" is Monday 13:30, the data for 12:00-12:59 on Friday, Saturday, and Sunday will be analyzed
baselinewma(/host/key,2h:now/h,"d",3) #calculating the baseline based on the last two hours within a 3-day period that ended yesterday. If "now" is Monday 13:30, the data for 11:00-12:59 on Friday, Saturday, and Sunday will be analyzed
baselinewma(/host/key,1d:now/d,"M",4) #calculating the baseline based on the same day of month as 'yesterday' in the 4 months preceding the last full month. If the required date doesn't exist, the last day of month is taken. If today is September 1st, the data for July 31st, June 30th, May 31st, April 30th will be analyzed.trendavg(/host/key,time period:time shift)
§±§â§à§ã§Ö§Ü §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ö.
§±§â§Ú§Þ§Ö§â§Ú:
trendavg(/host/key,1h:now/h) #the average for the previous hour (e.g. 12:00-13:00)
trendavg(/host/key,1h:now/h-1h) #the average for two hours ago (11:00-12:00)
trendavg(/host/key,1h:now/h-2h) #the average for three hours ago (10:00-11:00)
trendavg(/host/key,1M:now/M-1y) #the average for the previous month a year agotrendcount(/host/key,time period:time shift)
§¢§â§à? §å§ã§á§Ö§ê§ß§à §á§â§Ö§å§Ù§Ö§ä§Ú§ç §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §Ú§ã§ä§à§â§Ú?§Ö §Ü§à?§Ú §ã§Ö §Ü§à§â§Ú§ã§ä§Ú §Ù§Ñ §Ú§Ù§â§Ñ§é§å§ß§Ñ§Ó§Ñ?§Ö §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ú §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú.
§±§â§Ú§Þ§Ö§â§Ú:
trendcount(/host/key,1h:now/h) #the value count for the previous hour (e.g. 12:00-13:00)
trendcount(/host/key,1h:now/h-1h) #the value count for two hours ago (11:00-12:00)
trendcount(/host/key,1h:now/h-2h) #the value count for three hours ago (10:00-11:00)
trendcount(/host/key,1M:now/M-1y) #the value count for the previous month a year agotrendmax(/host/key,time period:time shift)
§®§Ñ§Ü§ã§Ú§Þ§Ñ§Ý§ß§Ö §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §ä§â§Ö§ß§Õ§Ñ §å §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Þ §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Þ §á§Ö§â§Ú§à§Õ§å.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ö.
§±§â§Ú§Þ§Ö§â§Ú:
trendmax(/host/key,1h:now/h) #the maximum for the previous hour (e.g. 12:00-13:00)
trendmax(/host/key,1h:now/h) - trendmin(/host/key,1h:now/h) ¡ú calculate the difference between the maximum and minimum values (trend delta) for the previous hour (12:00-13:00)
trendmax(/host/key,1h:now/h-1h) #the maximum for two hours ago (11:00-12:00)
trendmax(/host/key,1h:now/h-2h) #the maximum for three hours ago (10:00-11:00)
trendmax(/host/key,1M:now/M-1y) #the maximum for the previous month a year agotrendmin(/host/key,time period:time shift)
§®§Ú§ß§Ú§Þ§å§Þ §å §ä§â§Ö§ß§Õ§à§Ó§ã§Ü§Ú§Þ §Ó§â§Ö§Õ§ß§à§ã§ä§Ú§Þ§Ñ §å§ß§å§ä§Ñ§â §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Ô §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §á§Ö§â§Ú§à§Õ§Ñ.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ö.
§±§â§Ú§Þ§Ö§â§Ú:
trendmin(/host/key,1h:now/h) #the minimum for the previous hour (e.g. 12:00-13:00)
trendmax(/host/key,1h:now/h) - trendmin(/host/key,1h:now/h) ¡ú calculate the difference between the maximum and minimum values (trend delta) for the previous hour (12:00-13:00)
trendmin(/host/key,1h:now/h-1h) #the minimum for two hours ago (11:00-12:00)
trendmin(/host/key,1h:now/h-2h) #the minimum for three hours ago (10:00-11:00)
trendmin(/host/key,1M:now/M-1y) #the minimum for the previous month a year agotrendstl(/host/key,eval period:time shift,detection period,season,<deviations>,<devalg>,<s window>)
§±§â§Ú§Ü§Ñ§Ù§å?§Ö §ã§ä§à§á§å §Ñ§ß§à§Þ§Ñ§Ý§Ú?§Ñ §ä§à§Ü§à§Þ §á§Ö§â§Ú§à§Õ§Ñ §à§ä§Ü§â§Ú§Ó§Ñ?§Ñ ¨C §Õ§Ö§è§Ú§Þ§Ñ§Ý§ß§å §Ó§â§Ö§Õ§ß§à§ã§ä §Ú§Ù§Þ§Ö?§å 0 §Ú 1 §Ü§à?§Ñ ?§Ö ((the number of anomaly values)/(total number of values)).
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ö;
- §á§Ö§â§Ú§à§Õ §Ö§Ó§Ñ§Ý§å§Ñ§è§Ú?§Ö - §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú §á§Ö§â§Ú§à§Õ §Ü§à?§Ú §ã§Ö §Þ§à§â§Ñ §â§Ñ§Ù§Ý§à§Ø§Ú§ä§Ú (§Þ§Ú§ß§Ú§Þ§å§Þ '1h'), §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö
N- §Ò§â§à? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç ?§Ö§Õ§Ú§ß§Ú§è§Ñtime unit- h (§ã§Ñ§ä), d (§Õ§Ñ§ß), w (§ã§Ö§Õ§Þ§Ú§è§Ñ), M (§Þ§Ö§ã§Ö§è) §Ú§Ý§Ú y (§Ô§à§Õ§Ú§ß§Ñ) - §á§Ö§â§Ú§à§Õ §Õ§Ö§ä§Ö§Ü§è§Ú?§Ö - §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú §á§Ö§â§Ú§à§Õ §á§â§Ö §Ü§â§Ñ?§Ñ §á§Ö§â§Ú§à§Õ§Ñ §á§â§à§è§Ö§ß§Ö §Ù§Ñ §Ü§à?§Ú §ã§Ö §Ú§Ù§â§Ñ§é§å§ß§Ñ§Ó§Ñ?§å §Ñ§ß§à§Þ§Ñ§Ý§Ú?§Ö (§Þ§Ú§ß§Ú§Þ§å§Þ '1h', §ß§Ö §Þ§à§Ø§Ö §Ò§Ú§ä§Ú §Õ§å§Ø§Ú §à§Õ §á§Ö§â§Ú§à§Õ§Ñ §á§â§à§è§Ö§ß§Ö), §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö ?§Ö
N- §Ò§â§à? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç ?§Ö§Õ§Ú§ß§Ú§è§Ñtime unit- h (§ã§Ñ§ä), d (§Õ§Ñ§ß), w (§ã§Ö§Õ§Þ§Ú§è§Ñ) - §ã§Ö§Ù§à§ß§Ñ - §ß§Ñ?§Ü§â§Ñ?§Ú §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú §á§Ö§â§Ú§à§Õ §å §Ü§à?§Ö§Þ §ã§Ö §à§é§Ö§Ü§å?§Ö §á§à§ß§Ñ§Ó?§Ñ?§Ö §ê§Ñ§Ò§Ý§à§ß§Ñ ("§ã§Ö§Ù§à§ß§Ñ") (§Þ§Ú§ß§Ú§Þ§Ñ§Ý§ß§à '2h', §ß§Ö §Þ§à§Ø§Ö §Ò§Ú§ä§Ú §Õ§å§Ø§Ö §à§Õ §á§Ö§â§Ú§à§Õ§Ñ §á§â§à§è§Ö§ß§Ö, §Ò§â§à? §å§ß§à§ã§Ñ §å §á§Ö§â§Ú§à§Õ§å §á§â§à§è§Ö§ß§Ö §Þ§à§â§Ñ §Ò§Ú§ä§Ú §Ó§Ö?§Ú §Õ§Ó§Ñ §á§å§ä§Ñ §à§Õ §â§Ö§Ù§å§Ý§ä§å?§å?§Ö §æ§â§Ö§Ü§Ó§Ö§ß§è§Ú?§Ö (§ã§Ö§Ù§à§ß§Ñ/h)), §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß §Ü§Ñ§à <N><time unit> §Ô§Õ§Ö ?§Ö
N- §Ò§â§à? §Ó§â§Ö§Þ§Ö§ß§ã§Ü§Ú§ç ?§Ö§Õ§Ú§ß§Ú§è§Ñtime unit- h (§ã§Ñ§ä), d (§Õ§Ñ§ß), w (§ã§Ö§Õ§Þ§Ú§è§Ñ) - §à§Õ§ã§ä§å§á§Ñ?§Ñ - §Ò§â§à? §à§Õ§ã§ä§å§á§Ñ?§Ñ (§Ú§Ù§â§Ñ§é§å§ß§Ñ§ä§Ú§ç §á§à§Þ§à?§å devalg-§Ñ) §Ü§à?§Ú §ã§Ö §â§Ñ§é§å§ß§Ñ?§å §Ü§Ñ§à §Ñ§ß§à§Þ§Ñ§Ý§Ú?§Ñ (§Þ§à§Ø§Ö §Ò§Ú§ä§Ú §Õ§Ö§è§Ú§Þ§Ñ§Ý§ß§Ú), (§Þ§à§â§Ñ §Ò§Ú§ä§Ú §Ó§Ö?§Ú §Ú§Ý§Ú ?§Ö§Õ§ß§Ñ§Ü 1, §á§à§Õ§â§Ñ§Ù§å§Þ§Ö§Ó§Ñ§ß§à ?§Ö 3);
- devalg (§Þ§à§â§Ñ §Ò§Ú§ä§Ú §á§à§Õ §Õ§Ó§à§ã§ä§â§å§Ü§Ú§Þ §ß§Ñ§Ó§à§Õ§ß§Ú§è§Ú§Þ§Ñ) - §Ñ§Ý§Ô§à§â§Ú§ä§Ñ§Þ §à§Õ§ã§ä§å§á§Ñ?§Ñ, §Þ§à§Ø§Ö §Ò§Ú§ä§Ú stddevpop, stddevsamp §Ú§Ý§Ú mad (§á§à§Õ§â§Ñ§Ù§å§Þ§Ö§Ó§Ñ§ß§à);
- s §á§â§à§Ù§à§â - §â§Ñ§ã§á§à§ß (§å §Ù§Ñ§Ü§Ñ§ê?§Ö?§Ú§Þ§Ñ) loess §á§â§à§Ù§à§â§Ñ §Ù§Ñ §ã§Ö§Ù§à§ß§ã§Ü§à §Ú§Ù§Õ§Ó§Ñ?§Ñ?§Ö (§á§à§Õ§â§Ñ§Ù§å§Þ§Ö§Ó§Ñ§ß§à ?§Ö 10 * §Ò§â§à? §å§ß§à§ã§Ñ §å §á§Ö§â§Ú§à§Õ§å §Ö§Ó§Ñ§Ý§å§Ñ§è§Ú?§Ö + 1)
§±§â§Ú§Þ§Ö§â§Ú:
trendstl(/host/key,100h:now/h,10h,2h) #analyse the last 100 hours of trend data, find the anomaly rate for the last 10 hours of that period, expecting the periodicity to be 2h, the remainder series values of the evaluation period are considered anomalies if they reach the value of 3 deviations of the MAD of that remainder series
trendstl(/host/key,100h:now/h-10h,100h,2h,2.1,"mad") #analyse the period of 100 hours of trend data, up to 10 hours ago, find the anomaly rate for that entire period expecting the periodicity to be 2h, the remainder series values of the evaluation period are considered anomalies if they reach the value of 2,1 deviations of the MAD of that remainder series
trendstl(/host/key,100d:now/d-1d,10d,1d,4,,10) #analyse 100 days of trend data up to a day ago, find the anomaly rate for the period of last 10d of that period, expecting the periodicity to be 1d, the remainder series values of the evaluation period are considered anomalies if they reach the value of 4 deviations of the MAD of that remainder series, overriding the default span of the loess window for seasonal extraction of "10 * number of entries in eval period + 1" with the span of 10 lags
endstl(/host/key,1M:now/M-1y,1d,2h,,"stddevsamp") #analyse the previous month a year ago, find the anomaly rate of the last day of that period expecting the periodicity to be 2h, the remainder series values of the evaluation period are considered anomalies if they reach the value of 3 deviation of the sample standard deviation of that remainder seriestrendsum(/host/key,time period:time shift)
§©§Ò§Ú§â §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§Ú§ç §ä§â§Ö§ß§Õ§à§Ó§ã§Ü§Ú§ç §Ó§â§Ö§Õ§ß§à§ã§ä§Ú §å§ß§å§ä§Ñ§â §Õ§Ö§æ§Ú§ß§Ú§ã§Ñ§ß§à§Ô §Ó§â§Ö§Þ§Ö§ß§ã§Ü§à§Ô §á§Ö§â§Ú§à§Õ§Ñ.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú:
- §±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §Ù§Ñ?§Ö§Õ§ß§Ú§é§Ü§Ö §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú.
§±§â§Ú§Þ§Ö§â§Ú:
trendsum(/host/key,1h:now/h) #the sum for the previous hour (e.g. 12:00-13:00)
trendsum(/host/key,1h:now/h-1h) #the sum for two hours ago (11:00-12:00)
trendsum(/host/key,1h:now/h-2h) #the sum for three hours ago (10:00-11:00)
trendsum(/host/key,1M:now/M-1y) #the sum for the previous month a year ago§±§à§Ô§Ý§Ö§Õ§Ñ?§ä§Ö §ã§Ó§Ö §á§à§Õ§â§Ø§Ñ§ß§Ö §æ§å§ß§Ü§è§Ú?§Ö.