Custom threshold windows for key performance indicator alerts
A computing device monitors a key performance indicator (KPI) relative to a first alert threshold, where a value of the KPI having a specified relationship to the first alert threshold causes the computing device to generate an alert. When the computing device receives an instruction to modify the first alert threshold by an adjustment amount, for a specified time window, the computing device generates a modified alert threshold by applying the adjustment amount to the first alert threshold. During the specified time window, the computing device monitors the KPI relative to the modified alert threshold instead of the first alert threshold. Monitoring is resumed relative to the first alert threshold after the specified time window.
1 . A computer-implemented method comprising:
monitoring, by a computing device, a key performance indicator (KPI) relative to a first alert threshold, wherein a value of the KPI having a specified relationship to the first alert threshold causes the computing device to generate an alert;
receiving, by the computing device, an instruction to set an adaptive threshold value associated with the first alert threshold and reducing false positive alerts or false negative alerts by at least modifying the first alert threshold by an adjustment amount, for a specified time window, to generate a modified alert threshold in which the value of the KPI is expected to be significantly different than a normal value of the KPI; and
in response to receiving the instruction to modify the first alert threshold by the adjustment amount,
generating, by the computing device, the modified alert threshold by applying the adjustment amount to the first alert threshold;
monitoring, by the computing device, the KPI relative to the modified alert threshold instead of the first alert threshold during the specified time window; and
resuming, by the computing device, monitoring of the KPI relative to the first alert threshold, after the specified time window has elapsed.
2 . The method of claim 1 , further comprising:
recalculating an adaptive threshold value for the first alert threshold at each of a plurality of times, each recalculation of the adaptive threshold value being based on a specified set of values of the KPI obtained before a time the corresponding adaptive threshold value is calculated;
wherein generating the modified alert threshold comprises applying the adjustment amount to the adaptive threshold value that is to be applied to the first alert threshold during the specified time window.
3 . The method of claim 1 , further comprising:
recalculating an adaptive threshold value for the first alert threshold at each of a plurality of times, each recalculation of the adaptive threshold value being based on a corresponding set of values of the KPI obtained before a time the corresponding adaptive threshold value is calculated;
wherein performing a first recalculation of the adaptive threshold value after the specified time window comprises:
responsive to determining one or more of the values of the KPI in the set of values for the first recalculation were obtained during the specified time window, performing the first recalculation of the adaptive threshold value without the one or more values of the KPI that were obtained during the specified time window.
4 . The method of claim 1 , wherein the first alert threshold is a static threshold.
5 . The method of claim 1 , wherein the first alert threshold is a static threshold having at least a first value at a first time and a second value at a second time, and wherein applying the adjustment amount to the first alert threshold comprises:
determining a value of the first alert threshold that is to be applied during the specified time window; and
applying the adjustment amount to the determined value.
6 . The method of claim 1 , wherein applying the adjustment amount to the first alert threshold comprises increasing the alert threshold.
7 . The method of claim 1 , wherein applying the adjustment amount to the first alert threshold comprises decreasing the alert threshold.
8 . The method of claim 1 , wherein the instruction to modify the alert threshold specifies the adjustment amount as a percentage, and wherein applying the adjustment amount to the first alert threshold comprises calculating an amount by which to adjust the first alert threshold by applying the specified percentage to the first alert threshold.
9 . The method of claim 1 , wherein the specified relationship between the value of the KPI and the first alert threshold that causes the computing device to generate the alert comprises the value of the KPI being above the first alert threshold.
10 . The method of claim 1 , wherein the specified relationship between the value of the KPI and the first alert threshold that causes the computing device to generate the alert comprises the value of the KPI being below the first alert threshold.
11 . The method of claim 1 , wherein the specified relationship between the value of the KPI and the first alert threshold that causes the computing device to generate the alert comprises the value of the KPI being above the first alert threshold and below a second threshold, and wherein generating the modified alert threshold comprises applying the adjustment amount to both the first alert threshold and the second alert threshold.
12 . The method of claim 1 , further comprising:
causing display, to a user, of one or more types of KPIs for which the user has modification permission;
receiving, from the user, a selection of a KPI from the displayed one or more types of KPIs; and
generating the instruction to modify the first alert threshold by identifying an alert threshold associated with the selected KPI and linking the selected KPI to the adjustment amount and the specified time window.
13 . The method of claim 1 , further comprising:
deriving the KPI from machine data.
14 . The method of claim 1 , further comprising:
deriving the KPI from human-generated data.
15 . A computing device comprising:
a communications interface;
a memory; and
a processor coupled to the communications interface and the memory, the processor configured to perform operations including:
monitoring a key performance indicator (KPI) relative to a first alert threshold, wherein a value of the KPI having a specified relationship to the first alert threshold causes the computing device to output an alert via the communications interface;
receiving an instruction to modify the first alert threshold by an adjustment amount, for a specified time window;
reducing false positive alerts or false negative alerts by at least modifying the first alert threshold by the adjustment amount to generate a modified alert threshold in which the value of the KPI is expected to be significantly different than a normal value of the KPI; and
in response to receiving the instruction to modify the first alert threshold by the adjustment amount,
generating a modified alert threshold by applying the adjustment amount to the first alert threshold;
monitoring the KPI relative to the modified alert threshold instead of the first alert threshold during the specified time window; and
resuming monitoring of the KPI relative to the first alert threshold, after the specified time window.
16 . The computing device of claim 15 , wherein the processor is further configured to
perform operations comprising:
recalculating an adaptive threshold value for the first alert threshold at each of a plurality of times, each recalculation of the adaptive threshold value being based on a specified set of values of the KPI obtained before a time the corresponding adaptive threshold value is calculated;
wherein generating the modified alert threshold comprises applying the adjustment amount to the adaptive threshold value that is to be applied to the first alert threshold during the specified time window; and
wherein performing a first recalculation of the adaptive threshold value after the specified time window comprises:
responsive to determining one or more of the values of the KPI in the set of values for the first recalculation were obtained during the specified time window, performing the first recalculation of the adaptive threshold value without the one or more values of the KPI that were obtained during the specified time window.
17 . The computing device of claim 15 , wherein the processor is further configured to perform operations comprising:
causing display, to a user, of one or more types of KPIs for which the user has modification permission;
receiving, from the user, a selection of a KPI from the displayed one or more types of KPIs; and
generating the instruction to modify the first alert threshold by identifying an alert threshold associated with the selected KPI and linking the selected KPI to the adjustment amount and the specified time window.
18 . A non-transitory computer-readable medium having stored thereon instructions, execution of which by one or more processors, causes the one or more processors to perform operations including:
monitoring a key performance indicator (KPI) relative to a first alert threshold, wherein a value of the KPI having a specified relationship to the first alert threshold causes a computing device to output an alert via the communications interface;
receiving an instruction to set an adaptive threshold value associated with the first alert threshold and reducing false positive alerts or false negative alerts by at least modifying the first alert threshold by an adjustment amount, for a specified time window, to generate a modified alert threshold in which the value of the KPI is expected to be significantly different than a normal value of the KPI; and
in response to receiving the instruction to modify the first alert threshold by the adjustment amount,
generating a modified alert threshold by applying the adjustment amount to the first alert threshold;
monitoring the KPI relative to the modified alert threshold instead of the first alert threshold during the specified time window; and
resuming monitoring of the KPI relative to the first alert threshold, after the specified time window.
19 . The non-transitory computer-readable storage medium of claim 18 , wherein the one or more processors are further caused to perform operations comprising:
recalculating an adaptive threshold value for the first alert threshold at each of a plurality of times, each recalculation of the adaptive threshold value being based on a specified set of values of the KPI obtained before a time the corresponding adaptive threshold value is calculated;
wherein generating the modified alert threshold comprises applying the adjustment amount to the adaptive threshold value that is to be applied to the first alert threshold during the specified time window; and
wherein performing a first recalculation of the adaptive threshold value after the specified time window comprises:
responsive to determining one or more of the values of the KPI in the set of values for the first recalculation were obtained during the specified time window, performing the first recalculation of the adaptive threshold value without the one or more values of the KPI that were obtained during the specified time window.
20 . The non-transitory computer-readable storage medium of claim 18 , wherein the one or more processors are further caused to perform operations comprising:
causing display, to a user, of one or more types of KPIs for which the user has modification permission;
receiving, from the user, a selection of a KPI from the displayed one or more types of KPIs; and
generating the instruction to modify the first alert threshold by identifying an alert threshold associated with the selected KPI and linking the selected KPI to the adjustment amount and the specified time window.