Alert time distribution

This tile shows the ratio of alerts firing outside vs during working hours. A high proportion of out-of-hours alerts indicates alert noise or poor thresholds, often the fastest way to reduce on-call fatigue without increasing risk.

We'll use an SQL Analytics query to categorize each alert as either In hours or Out of hours, based on when it occurred. Then we'll aggregate the data by those two categories and count the number of alerts in each.

The result is a simple breakdown of alerts that occur during working hours versus those that impact on-call engineers outside of them.

Configuring the tile

Configure the following in the tile editor.

1. Data source: Select Azure.
2. Data stream: Select Alerts.
3. Objects: Select the monitored objects you want to track alerts for.
4. Parameters:
   1. Monitor condition: Select Fired.
   2. Severity: Leave blank to capture every severity level.
5. Filter | Group | Sort: Enable the SQL toggle then enter the following query and click Execute:
   
   Copy

   WITH alerts AS (
     SELECT CAST("properties.essentials.startDateTime" AS TIMESTAMP) AS alert_ts
     FROM dataset1
   )
   
   SELECT
     CASE
       WHEN dayofweek(alert_ts) BETWEEN 1 AND 5
        AND alert_ts >= DATE_TRUNC('day', alert_ts) + INTERVAL 9 HOUR
        AND alert_ts <  DATE_TRUNC('day', alert_ts) + INTERVAL 18 HOUR
       THEN 'In hours'
       ELSE 'Out of hours'
     END AS hours_bucket,
     COUNT(*) AS alert_count
   FROM alerts
   GROUP BY hours_bucket
   ORDER BY alert_count DESC;

6. Columns: Click Edit
   next to the Alert Count column then set the Decimal Places to 0.
7. Visualization: Select Donut.
   1. Mapping:The Value and Label fields are automatically mapped.
   2. Legend > Type: Select Table.
8. Click Save.

Was this article helpful?