Skip to content

Commit

Permalink
Clarify requirements for using alert_on_new_data
Browse files Browse the repository at this point in the history
  • Loading branch information
jertel authored Nov 16, 2023
1 parent 5ec95ba commit 9d79c51
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion docs/source/ruletypes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -1150,7 +1150,8 @@ higher. 'Down' meaning the reference number is ``spike_height`` higher than the
``timeframe``: The rule will average out the rate of events over this time period. For example, ``hours: 1`` means that the 'current'
window will span from present to one hour ago, and the 'reference' window will span from one hour ago to two hours ago. The rule
will not be active until the time elapsed from the first event is at least two timeframes. This is to prevent an alert being triggered
before a baseline rate has been established. This can be overridden using ``alert_on_new_data``.
before a baseline rate has been established. This can be overridden using ``alert_on_new_data``, provided the rule uses the ``query_key``
property (see more information on this below).


Optional:
Expand Down

0 comments on commit 9d79c51

Please sign in to comment.