Time series alerting

Time series alerting is a way to generate alerts, or "events", when time series data meets user-specified criteria. You can identify periods of interest within the time series data using Quiver's time series search card. The logic behind this time series search is saved and replicated across objects of the same type using Automate. When the automation runs, any newly identified time intervals are output as objects in an alerting object type.

The alerting object type can store alert data from one or many configured automations, though it relates to exactly one evaluation job. Therefore, one job can relate to many automations. A job is a batch Spark job and can be viewed in the Builds application. Specifically, the job outputs a dataset that backs the alerting object type, where each row is an alert update.

Requirements

The sections below explain the requirements you must follow while creating time series alerts:

1. Time series alerting logic is templated against the root object type and, therefore, must operate on a single root object. If the logic requires time series inputs on another object type, that object type must be set up as a sensor object type.

For example, the Object time series property card in Quiver allows the selection of time series properties on the current object type as well as time series data on its sensor object types:

2. When creating alerts on linked sensors, the sensors should be accessed from the root object type in Quiver rather than performing a manual search around.

3. Aside from time series properties, property references are only templated if they are directly referenced in a Time series formula card using the @ symbol.

Considerations

Time series alerting automations are intended to be used when data is healthy. Time series alerting automations are not designed to check whether data meets expectations (in terms of volume, quality, and so on). For these cases, we recommend using Data Health or stream monitoring.

Time series automations should never be used as a critical alerting system for safety. They should be viewed as a way to track conditions of interest rather than used as a critical alerting system.