dt-alerting

Create a detector via the builtin:davis.anomaly-detectors Settings v2 schema using an analyzer-based JSON structure. Choose an analyzer class for static threshold, adaptive baseline, or seasonal baseline, supply a DQL timeseries query, and define the event template properties.

Use static thresholds for hard SLO limits like error rate above 5%, adaptive baseline for metrics with clear normal behavior but no fixed limit, and seasonal baseline for metrics with time-of-day or day-of-week patterns such as traffic volume.

Query the dt.davis.events table with DQL, for example fetch dt.davis.events filtered by event.status and summarized by event.name or event.category. Each record represents one detector trigger per entity, distinct from grouped problems in dt.davis.problems.

Create a workflow with a problem trigger, add a condition filter such as matchesPhrase(dt.alert_group, "team-name"), and connect a Slack, email, ServiceNow, or HTTP request action. Trigger on problems rather than raw events to avoid duplicate notifications.

High alert volume usually comes from overly broad entity selectors, tight thresholds, or per-entity detectors. Consolidate entities into one detector using by: dimensions, start with LOW sensitivity, and filter notifications by severity and dt.alert_group.

No, this skill covers alert configuration and flow only. For querying active problems, root cause analysis, and problem merge logic, the related dt-obs-problems skill and its problem-merging reference should be used instead.