So I have a spike at around 12:58PM for example. When I replay the data against the tickscript below, the timestamp I get seems to be the beginning of the first window that includes the spike/anomaly, so around 12:48PM. I am guessing this is working as intended, but I am not clear if it would work the same when not doing a replay.
The way I imagine it working when streaming data live, is at 12:48PM it looks back to 12:38PM and checks for anomalies in that 10m window. Then at 12:49PM it looks back to 12:39PM. And so on. In the replay though it seems to be looking forward instead of back. Is that just a difference between replays and live streaming? Or am I looking at this fundamentally incorrectly? If so, how can I do what I want, which is to compare each current minute with the previous 10 to detect anomalies?
var data = stream |from() .measurement(measurement) .groupBy('shard') |window() .period(period) .every(every) .align() // Send each window to Morgoth @morgoth() .field(field) .scoreField(scoreField) .minSupport(minSupport) .errorTolerance(errorTolerance) .consensus(consensus) .sigma(sigmas) var alert = data |alert() .details('') .crit(lambda: TRUE) .critReset(lambda: FALSE) .stateChangesOnly() .log('/tmp/' + field + '.log')