stateDuration and sigma

InfluxDB 1 Kapacitor
1

Hi I have the following tick:
dbrp “statsd”.“shortterm”

stream
    |from()
        .measurement('memory_percent_free')
        .groupBy('host')
    |window()
        .period(10m)
        .every(1m)
    |mean('value')
    |alert()
        .message('{{ .Level}}: {{ .Name }}/{{ index .Tags "host" }} has high cpu load: {{ index .Fields "mean" }}')
        .warn(lambda: sigma("mean") > 2.0)
        .crit(lambda: sigma("mean") > 3.0)
        .log('/tmp/kap.log')
        .slack()

How would i go about using state duration with this tick i.e. i want alert when sigma("mean) > 2.0 for 5 minutes.

thanks !
rr

2

I think you need to evaluate sigma independently, then track its duration duration over the limit and then alert when that duration is over 5 minutes:

|mean(‘value’)
|eval(lambda: sigma(“mean”))
.as(‘sig’)
|stateDuration(lambda: “sig” > 2.0)
.as(‘sig_gt_2_min’)
.unit(1m)
|stateDuration(lambda: “sig” > 3.0)
.as(‘sig_gt_3_min’)
.unit(1m)
|alert()
.warn(lambda: “sig_gt_2_min” > 5)
.crit(lambda: “sig_gt_3_min” > 5)

3

awesome thanks, I will give it a try.
rr