Trigger help - Trigger for change over time for accumulated value

[Zablab]

I've got a tic metric I'd like to monitor in IIS that accumulates until the Application Pool\IIS Service is restarted.

This makes it harder to monitor because there's no set threshold\value to base a trigger off of. It can be as high as 500k for one instance and 10k for another.

So I'd like to create a trigger that executes if there is a spike, of say 10k in the last 10min.

Would anybody have any insight on how this can be done?

I've tried a mixture of last, max & count but can't seem to blend them, do I need multiple items to compare against or can this be done with a single item?



With appreciation,

[cyber]

rate() ?? I have never used it actually.. but if it is a steadily growing number, it may work...
Example:
=> rate(/host/key,30s) → If the monotonic increase over 30 seconds is 20, this function will return 0.67

rate(/host/key,600)>16 (10k/600)

Or .. (last(/host/key) - first(/host/key,10m)) >10000

Or ... save your data as "simple change" or "change per sec" (add in preprocessing) and then do things with that..?

[Zablab]

Thanks! I will have a look at these potential solutions and see if this will suffice, appreciate the information!