I have an NRQL-base incident created with the following condition setup.
SELECT COUNT(account) AS count FROM test_event_table WHERE value > 50
Thrreshold: When sum of the query result is above 0 at least once in 5 mins
Advance Signal Setting: Fill data gaps with Last known value
The incident link.
I supposed that the incident will automatically be closed after I match this opposite condition Query result is below or equal to 0 for consecutive 5 mins.
However, it didn’t close as expected.
Besides that, official doc said Gapfill is affected by expirationDuration, what if I didn’t set the signal lost/expirationDuration? Will Gapfill keep filling the gap forever?
Can someone give me a hint?
Thanks in advance.