I am trying to achieve somthing like that in Zabbix: there is some data coming into one item in Zabbix, the threshold is of values is 15. I want to detect situation when last three values of the item are above the threshold, for example: 16, 17, 18, and then send the e-mail about that event. I do know how to configure items and actions, but I don't know how to configure trigger expression. I use something like that:
{test_trigger:test_item.last(#1)}>15&
{test_trigger:test_item.last(#2)}>15&
{test_trigger:test_item.last(#3)}>15
but this expression sends emails always, when last three values are above the limit, which I don't want to achieve. My expectation is something like that: after recieving three values above the threshold, send e-mail and reset the trigger.
You can try the following trigger expression:
{host:item.min(#3)} > 15 & {TRIGGER.VALUE} = 0 & {host:item.nodata(30)} = 0
If the last 3 values are above 15, the trigger will become PROBLEM if it is currently in OK state. After that it will return to OK state after no more than 30 seconds (either when data is received or nodata() function is processed by timer).