Flexibility to adjust the adaptive threshold to take a longer time-frame into account to avoid sharp changes to the adaptive threshold.

The customer requests more flexibility in the method of determining the adaptive threshold and allow the adaptive threshold to take a longer time-frame into account when modifying the threshold. In the cases experiences by the customer, when a trend has been in place for an extended period of time (for days) and the real-time metric changes dramatically, the adaptive threshold is too quick to be modified. The threshold should take into account a longer historical time-frame to determine the expected value before changing the threshold. These dramatic adaptive threshold changes also cause the events to be closed too quickly when the modified thresholds cause the real-time values to no longer violate the new, adaptive threshold, even though the threshold is not what the historical average has been over the last days. This causes the alerts to be closed too quickly when the issue is still occurring. The alert closure should not occur until the real-time metrics meet the overall historical average over a longer time-period.

The customer did some internal analysis and they noticed if the adaptive alert is taking 14 days data average as statistics for creating thresholds, in such case when there is a sudden drop in the value, the threshold should not adjust so quickly. The customer observed that adaptive alert is creating the adaptive threshold based on only the last few mins or hours data which the customer believes is wrong.

The customer is expecting that it should take average of last 7 days of data for the same time and according should adjust the threshold more slowly based on standard deviation.