NonNegativeDelta – Anodot

Description	Transforms each sample in the time-series to the difference between the sample and the previous one. Samples with a negative value difference are either set to null or set to (maxValue + Difference + 1) if maxValue is specified.
Input	Time Series: Multiple (Single or multiple time-series)
Parameters	Max Value	Optional, numeric, default=null
	Keep Last Value Limit	Optional, numeric, default=null (Limit of null values to skip)
Output	Transformed Time Series: Multiple
Available in	Alerts, Composites, Dashboards

Usage example

The NonNegativeDelta function is useful when you have a counter metric whose value increases monotonically, and occasionally resets to zero (on restart). By applying this function, you can monitor the difference between two successive samples. When the counter resets, or if the result is a negative value, the function returns a null value.

For example, Anodot tracks the number of triggered alerts for each account using a counter metric. By using the NonNegativeDelta function, Anodot can monitor anomalies in the rate of triggered alerts, which could imply possible issues in detection algorithms.

Here is how the counter metric (which counts triggered alerts) appears:

After applying the NonNegativeDelta function, Anodot can uncover the rate pattern of triggered alerts, and an adequate baseline can be fitted to monitor anomalies:

{[{category.name}]}