Zscore on health alarm calc

Help
5

Hi @mjtice i’ve had a play around and asked internally and below is an example of how to make a zscore based alarm.

 alarm: cpu_user_mean
    on: system.cpu
lookup: mean -60s of user
 every: 10s

 alarm: cpu_user_stddev
    on: system.cpu
lookup: stddev -60s of user
 every: 10s

 alarm: cpu_user_zscore
    on: system.cpu
lookup: mean -10s of user
  calc: ($this - $cpu_user_mean) / $cpu_user_stddev
 every: 10s
  warn: $this < -2 or $this > 2
  crit: $this < -3 or $this > 3

Here you can see i make an alarm for mean and sttdev and then reference them in my zscore alarm. I then make a warning if abs(zscore) > 2 or critical if abs(zscore) > 3.

I think you could play around with this approach to get it working for your use case.

I think would be best if we had just a zscore function you could use so i’ll make a feature request for this.