1

I want to raise an alarm when the count of a particular kind of event is less than 5 for the 3 hours leading up to the moment the check is evaluated, but I need to do this check every 15 minutes.

Since I need to check more frequently than the span of time I'm measuring, I can't do this based on my raw data (according to the docs, "[the schedule] interval matches the aggregate function interval for the check query". But I figured I could use a "task" to transform my data into a form that would work.

I was able to aggregate the data in the way that I hoped via a flux query, and I even saved the resultant rolling count to a dashboard.

from(bucket: "myBucket")
    |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
    |> filter(fn: (r) =>
        (r._measurement == "measurementA"))
    |> filter(fn: (r) =>
        (r._field == "booleanAttributeX"))
    |> window(
        every: 15m,
        period: 3h,
        timeColumn: "_time",
        startColumn: "_start",
        stopColumn: "_stop",
        createEmpty: true,
    )
    |> count()
    |> yield(name: "count")
    |> to(bucket: "myBucket", org: "myOrg")

Results in the following scatterplot.

scatterplot of rolling count

My hope was that I could just copy-paste this as a new task and get my nice new aggregated dataset. After resolving a couple of legible syntax errors, I settled on the following task definition:

option v = {timeRangeStart: -12h, timeRangeStop: now()}
option task = {name: "blech", every: 15m}

from(bucket: "myBucket")
    |> range(start: v.timeRangeStart, stop: v.timeRangeStop)
    |> filter(fn: (r) =>
        (r._measurement == "measurementA"))
    |> filter(fn: (r) =>
        (r._field == "booleanAttributeX"))
    |> window(
        every: 15m,
        period: 3h,
        timeColumn: "_time",
        startColumn: "_start",
        stopColumn: "_stop",
        createEmpty: true,
    )
    |> count()
    |> yield(name: "count")
    |> to(bucket: "myBucket", org: "myOrg")

Unfortunately, I'm stuck on an error that I can't find any mention of anywhere: could not execute task run; Err: no time column detected: no time column detected.

If you could help me debug this task run error, or sidestep it by accomplishing this task in some other manner, I'll be very grateful.

billkw
  • 3,350
  • 3
  • 28
  • 32

1 Answers1

3

I know I'm late here, but the to function needs a _time column, but the count aggregate you are adding returns a _start and _stop column to indicate the time frame for the count, not a _time.

You can solve this by either adding |> duplicate(column: "_stop", as: "_time") just before your to function, or leveraging the aggregateWindow function which handles this for you.

|> aggregateWindow(every: 15m, fn: count)

References:

https://v2.docs.influxdata.com/v2.0/reference/flux/stdlib/built-in/transformations/aggregates/count

https://v2.docs.influxdata.com/v2.0/reference/flux/stdlib/built-in/transformations/duplicate/

https://v2.docs.influxdata.com/v2.0/reference/flux/stdlib/built-in/transformations/aggregates/aggregatewindow/

Russ Savage
  • 598
  • 4
  • 20