Incident wasn't closed when there is no more violation happen

Hi,

I have an NRQL-base incident created with the following condition setup.

NRQL: SELECT COUNT(account) AS count FROM test_event_table WHERE value > 50
Thrreshold: When sum of the query result is above 0 at least once in 5 mins
Advance Signal Setting: Fill data gaps with Last known value

The incident link.

I supposed that the incident will automatically be closed after I match this opposite condition Query result is below or equal to 0 for consecutive 5 mins.

Screenshot 2020-11-12 at 04.14.25.png1924×904 73.9 KB

However, it didn’t close as expected.

Besides that, official doc said Gapfill is affected by expirationDuration, what if I didn’t set the signal lost/expirationDuration? Will Gapfill keep filling the gap forever?

Can someone give me a hint?

Thanks in advance.

Hey there @yichi.lin -

The issue here is likely with the 0 in your result. Check out this post which explains why:

a 0 can never be returned by a count and a NULL can’t be evaluated numerically.

I am thinking that you’ll want to follow the advice in this article and set up your query in a different way. Let me know if this does not get you point in the right direction.

Hi @hross,

thanks for sharing the post. This is much clear to me and clarify the confusion.

Excellent news! I know that can be confusing, so I am glad to hear that you are sorted out.