I'm trying to create an alert for orion to have a SWQL query to look at a volume's current rate of change and then if it notices a larger than average change to create an alert. I know this has been asked multiple times, however i was looking int what data i can access via the SWQL and think i found a different way to look at it where it might be worth looking again.
I have been able to get a consolidated average of the disk percent usage with the following query (may not be the most elegant but it gets the job done for now)
Select day, Avg(pcnt) over(partition by day order by day rows between 6 preceding and current row) as myavg
SELECT DATETRUNC('Day',DateTime) as day, sum(PercentDiskUsed) as pcnt
Where VolumeID = '68'
Group By DateTime
Group by day
Order By day DESC
right now i have it hard coded to a specific volume to test. this is giving me the average volume side each day and also trucating the current data into a single point and finally is giving me one value as a singe day so I'm not messing with random time stamps.
Right now i cant figure out how to take this and figure out what the average change is over any period of time, be it to the first record or just say 30 days or a week.
If anyone has any ideas i would greatly appreciate it.