How do I configure the Minimum Value and Maximum Value parameters for data features?
Configure the Minimum Value and Maximum Value parameters to define the acceptable range for a metric in intelligent inspection.
The minimum and maximum values of a data feature define the acceptable range for a metric. If a metric value falls outside this range, the model treats it as an anomaly, generates an anomalous event with the highest anomaly score (1.0), and triggers an alert. If the value is within the range, the model automatically learns the data distribution and trends, and generates an anomalous event only when it detects abnormal fluctuations.
If you are unsure of the typical range for your metric, leave the minimum and maximum values unset. The model automatically learns the range from the data it processes. Setting explicit values helps the model determine the data distribution more accurately.
For example, a cpu_usage metric has a value range of 0 to 100. To run an intelligent inspection on this metric, set Feature to cpu_usage, Minimum Value to 0, Maximum Value to 100, and Time Series Segments to 10. The model then divides the 0-100 range into 10 buckets and places each data point into the corresponding bucket.
-
If a data point has a value of 101, it falls outside the 0-100 range. The model generates an anomalous event with an anomaly score of 1.0 and triggers an alert.
-
If the first data point is 3 and the second is 9, both fall into the first bucket (0-10). Because the data points are in the same bucket, the model considers this a normal fluctuation and does not generate an anomalous event.
-
Incorrectly setting the minimum and maximum values for a data feature can trigger an alert storm. If you are unsure what values to use, submit a ticket for assistance.
-
If a metric value is outside the range specified by the minimum and maximum values, the model generates an anomalous event with an anomaly score of 1.0, which triggers an alert.
-
If a metric value is within the specified range, the model can still capture abnormal time-series changes. The anomaly score for these events is in the range (0, 1).
-
Alerts from the intelligent inspection feature follow an inhibition policy that limits alerts to one per job per minute. The alerting system aggregates all anomalous events within a minute and sends only the alert with the highest anomaly score. You can view anomalous event details on the dashboard in the Project that hosts the intelligent inspection job.