Search code examples
prometheuspromql

Avoiding multiple subqueries in PromQL with offset to get historic averages

I have a prometheus server that offers a long retention of 13 months. I want to find anomalies for the number of registrations my web app gets. My idea was to take a look at the number of registrations of the previous weeks as they vary depending on the week day.

To compare my current value across the values of the previous 4 weeks would require me to write 4 subqueries.

My question:

Is there an easier way to get the average of a 1h increase of the previous weekdays among the last 4 weeks? To make it clearer I want to get the average of these 4 queries so that I can compare it with my current number of web_registrations.

sum(increase(web_registrations[1h] offset 1w))
sum(increase(web_registrations[1h] offset 2w))
sum(increase(web_registrations[1h] offset 3w))
sum(increase(web_registrations[1h] offset 4w))
Solution

  • Try something like the following:

    (
  sum(increase(web_registrations[1h] offset 1w)) +
  sum(increase(web_registrations[1h] offset 2w)) +
  sum(increase(web_registrations[1h] offset 3w)) +
  sum(increase(web_registrations[1h] offset 4w))
) / 4

    It will return the average increase for the last hour over the last 4 weeks.

    See more details on such query types at https://about.gitlab.com/blog/2019/07/23/anomaly-detection-using-prometheus/ .