# Question about Kapacitor Deadman switch with Batch data

**URL:** <https://community.influxdata.com/t/question-about-kapacitor-deadman-switch-with-batch-data/2269>\
**Category:** Systems\
**Tags:** telegraf, influxql\
**Created:** [September 6, 2017, 11:46pm UTC](https://community.influxdata.com/t/question-about-kapacitor-deadman-switch-with-batch-data/2269 "2017-09-06T23:46:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pankaj\_Vohra](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@Pankaj\_Vohra](https://community.influxdata.com/u/Pankaj_Vohra)\
**Post date:** [September 6, 2017, 11:46pm UTC](https://community.influxdata.com/t/question-about-kapacitor-deadman-switch-with-batch-data/2269/1 "2017-09-06T23:46:45Z")

</div>

I am using telegraf to collect some custom application metrics and send them to influxdb once every **2 mins**. I am now trying to setup a deadman alert which should trigger an alert when influxdb does not receive any metrics for last 10 mins. I wrote below tick script which uses **batch data** , and have following questions around it:

**Question 1:** I am confused about the values to be used for **period** , **interval** , **groupBy** etc. (marked as **??** in below tick script)  
**Question 2** : I need to raise alerts only during a specific time frame. I read that we can use expressions like hour(time) \> 7 AND hour(time) \< 21. Can I use tags instead of built in time? I am sending application specific time ( **HH** and **MM** as tags based on application local time zone) and would like to use that in the expression.

var data = batch  
|query(’’’ select count(“Count”) from “dbname”.“autogen”.“mesurement” ‘’’)  
.period( **??** ) **// I think it should be 10 mins**  
.every( **??** ) **// I think it should run every 2 mins**  
.groupBy(time( **??** )) **// Not sure if this is needed at all. if Yes what should I use.**

data  
// What values should we alert on, where should the alert go, what should the alert say? (slack)  
|deadman(1.0, **??** ) **// Not sure what value should be used here**  
.message(’{{.Time}} - {{.Level}}: {{if eq .Level “OK”}}Receiving events normally{{else}}No events received in last 10 minutes{{end}}.’)  
.stateChangesOnly()  
.slack()  
.channel(’#channel\_name’)  
.username(‘Exports Deadman Alert’)

---

<div class="post-metadata">

**Author:** ![Matt](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@Matt](https://community.influxdata.com/u/Matt)\
**Post date:** [February 25, 2019, 8:57am UTC](https://community.influxdata.com/t/question-about-kapacitor-deadman-switch-with-batch-data/2269/2 "2019-02-25T08:57:11Z")

</div>

Hi!  
I’m sorry, I don’t have an answer for you, I just comment here because I actually have the same question (for a similar case). The only thing I can tell you for sure is that you don’t need `.groupBy(time(??))`.  
I don’t understand the difference between .period(…) and the interval parameter for deadman(…) on a batch.  
About the parameters for deadman, the documentation says:

```auto
Threshold: trigger alert if throughput drops below threshold in points/interval.
Interval: how often to check the throughput.

```

So if we want to trigger an alert if we get no metric over the past 10 minutes, I believe we should do `.period(10m)` and then `.deadman(1.0, 10m)`, but in my own case it didn’t work as expected.

Did you find out by yourself or are you still stuck on this?

---

<div class="post-metadata">

**Author:** ![MarcV](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/marcv/32/7676_2.png) [@MarcV](https://community.influxdata.com/u/MarcV)\
**Post date:** [February 26, 2019, 12:34pm UTC](https://community.influxdata.com/t/question-about-kapacitor-deadman-switch-with-batch-data/2269/3 "2019-02-26T12:34:30Z")

</div>

Hi , hope this clarifies a bit :  
[https://docs.influxdata.com/kapacitor/v1.5/nodes/stream\_node/](https://docs.influxdata.com/kapacitor/v1.5/nodes/stream_node/)

it says for example :

```auto
var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
    //Do normal processing of data
    data...

```

---

<div class="post-metadata">

**Author:** ![Matt](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@Matt](https://community.influxdata.com/u/Matt)\
**Post date:** [February 28, 2019, 9:11am UTC](https://community.influxdata.com/t/question-about-kapacitor-deadman-switch-with-batch-data/2269/4 "2019-02-28T09:11:04Z")

</div>

Hi, and thanks for the reply!  
It’s all ok for streams, but what about batch processing? Batch data is already retrieved at a given interval, so how does it affect the deadman switch? I guess it can only operate on the data of the batch, so if I query data in batch at a period of let’s say 10 minutes, and I use a `deadman(100.0, 5m)` then does it mean the deadman will check the data twice for each batch? (because 10m / 5m = 2, so one first time it’ll check the data of the first half of the batch, then it’ll check the second, most recent part?).

Thank you