Alert when data does not change

[entropical]

We have some alerts based on power monitoring, power usage at a site.

The records are every few seconds, showing power currently being used, in kW. And they vary constantly, as you might expect.

We had an instance recently where the values came through identical every record for a few hours, until the device at the other end was rebooted.

Can we make a rule for when the values don't change for a period of time?
A "no-change" type alert?

[entropical]

I think I may be able to by using a frequency alert, with the actual data/kW as the key. I'll give it a go, and report back.

[entropical]

My approach almost works. I tweaked the thresholds quite a bit, and I ended up with two alerts over the past 20 days, but one is an FP.

The data can look 11,11,11,11,11, 10 ,11,11,11 - which is perfectly fine, but still caught by the frequency alert. I really need the the hits to be adjacent records before it is a valid alert. The 10 in the data above should reset my count to zero, such that the frequency of "11" would be 5, 3. Not 8. I hope that makes sense.

type: frequency
query_key: [ "mains.power"]
num_events: 300
timeframe:
  minutes: 30
realert:
  minutes: 60

[entropical]

I tweaked my thresholds a bit more, and I no longer get the FP, but it's still an imperfect solution.

[jertel]

Perhaps a Cardinality rule type could help here:

type: cardinality
cardinality_field: mains.power
min_cardinality: 2
timeframe:
  minutes: 30

After 30 minutes elapses, if all of the mains.power values were identical then the cardinality is 1, which is lower than the min threshold, and an alert is triggered.

[entropical]

Works perfectly. Thanks for your help.