signalfx.Detector

Provides a Splunk Observability Cloud detector resource. This can be used to create and manage detectors.

If you’re interested in using Splunk Observability Cloud detector features such as Historical Anomaly, Resource Running Out, or others, consider building them in the UI first and then use the “Show SignalFlow” feature to extract the value for program_text. You can also see the documentation for detector functions in signalflow-library.

NOTE When you want to change or remove write permissions for a user other than yourself regarding detectors, use a session token of an administrator to authenticate the Splunk Observability Cloud provider. See Operations that require a session token for an administrator.

Example

resource "signalfx_detector" "application_delay" {
  count = length(var.clusters)

  name        = " max average delay - ${var.clusters[count.index]}"
  description = "your application is slow - ${var.clusters[count.index]}"
  max_delay   = 30
  tags        = ["app-backend", "staging"]

  # Note that if you use these features, you must use a user's
  # admin key to authenticate the provider, lest Terraform not be able
  # to modify the detector in the future!
  authorized_writer_teams = [signalfx_team.mycoolteam.id]
  authorized_writer_users = ["abc123"]

  program_text = <<-EOF
        signal = data('app.delay', filter('cluster','${var.clusters[count.index]}'), extrapolation='last_value', maxExtrapolations=5).max()
        detect(when(signal > 60, '5m')).publish('Processing old messages 5m')
        detect(when(signal > 60, '30m')).publish('Processing old messages 30m')
    EOF
  rule {
    description   = "maximum > 60 for 5m"
    severity      = "Warning"
    detect_label  = "Processing old messages 5m"
    notifications = ["Email,foo-alerts@bar.com"]
  }
  rule {
    description   = "maximum > 60 for 30m"
    severity      = "Critical"
    detect_label  = "Processing old messages 30m"
    notifications = ["Email,foo-alerts@bar.com"]
  }
}

provider "signalfx" {}

variable "clusters" {
  default = ["clusterA", "clusterB"]
}

Notification format

As Splunk Observability Cloud supports different notification mechanisms, use a comma-delimited string to provide inputs. If you want to specify multiple notifications, each must be a member in the list, like so:

notifications = ["Email,foo-alerts@example.com", "Slack,credentialId,channel"]

See Splunk Observability Cloud Docs for more information.

Here are some example of how to configure each notification type:

Email

notifications = ["Email,foo-alerts@bar.com"]

Jira

Note that the credentialId is the Splunk-provided ID shown after setting up your Jira integration. See also signalfx.jira.Integration.

notifications = ["Jira,credentialId"]

OpsGenie

Note that the credentialId is the Splunk-provided ID shown after setting up your Opsgenie integration. Team here is hardcoded as the responderType as that is the only acceptable type as per the API docs.

notifications = ["Opsgenie,credentialId,responderName,responderId,Team"]

PagerDuty

notifications = ["PagerDuty,credentialId"]

Slack

Exclude the # on the channel name:

notifications = ["Slack,credentialId,channel"]

Team

Sends notifications to a team.

notifications = ["Team,teamId"]

TeamEmail

Sends an email to every member of a team.

notifications = ["TeamEmail,teamId"]

Splunk On-Call (formerly VictorOps)

notifications = ["VictorOps,credentialId,routingKey"]

Webhooks

You need to include all the commas even if you only use a credential id.

You can either configure a Webhook to use an existing integration’s credential id:

notifications = ["Webhook,credentialId,,"]

Or configure one inline:

notifications = ["Webhook,,secret,url"]

Arguments

• name - (Required) Name of the detector.
• program_text - (Required) Signalflow program text for the detector. More info in the Splunk Observability Cloud docs.
• description - (Optional) Description of the detector.
• authorized_writer_teams - (Optional) Team IDs that have write access to this detector. Remember to use an admin’s token if using this feature and to include that admin’s team id (or user id in authorized_writer_users).
• authorized_writer_users - (Optional) User IDs that have write access to this detector. Remember to use an admin’s token if using this feature and to include that admin’s user id (or team id in authorized_writer_teams).
• max_delay - (Optional) How long (in seconds) to wait for late datapoints. See Delayed Datapoints for more info. Max value is 900 seconds (15 minutes). Auto (as little as possible) by default.
• min_delay - (Optional) How long (in seconds) to wait even if the datapoints are arriving in a timely fashion. Max value is 900 (15m).
• show_data_markers - (Optional) When true, markers will be drawn for each datapoint within the visualization. true by default.
• show_event_lines - (Optional) When true, the visualization will display a vertical line for each event trigger. false by default.
• disable_sampling - (Optional) When false, the visualization may sample the output timeseries rather than displaying them all. false by default.
• time_range - (Optional) Seconds to display in the visualization. This is a rolling range from the current time. Example: 3600 corresponds to -1h in web UI. 3600 by default.
• start_time - (Optional) Seconds since epoch. Used for visualization. Conflicts with time_range.
• end_time - (Optional) Seconds since epoch. Used for visualization. Conflicts with time_range.
• tags - (Optional) Tags associated with the detector.
• teams - (Optional) Team IDs to associate the detector to.
• rule - (Required) Set of rules used for alerting.
  • detect_label - (Required) A detect label which matches a detect label within program_text.
  • severity - (Required) The severity of the rule, must be one of: "Critical", "Major", "Minor", "Warning", "Info".
  • description - (Optional) Description for the rule. Displays as the alert condition in the Alert Rules tab of the detector editor in the web UI.
  • disabled - (Optional) When true, notifications and events will not be generated for the detect label. false by default.
  • notifications - (Optional) List of strings specifying where notifications will be sent when an incident occurs. See Create A Single Detector for more info.
  • parameterized_body - (Optional) Custom notification message body when an alert is triggered. See Set Up Detectors to Trigger Alerts for more info.
  • parameterized_subject - (Optional) Custom notification message subject when an alert is triggered. See Set Up Detectors to Trigger Alerts for more info.
  • runbook_url - (Optional) URL of page to consult when an alert is triggered. This can be used with custom notification messages.
  • tip - (Optional) Plain text suggested first course of action, such as a command line to execute. This can be used with custom notification messages.
• viz_options - (Optional) Plot-level customization options, associated with a publish statement.
  • label - (Required) Label used in the publish statement that displays the plot (metric time series data) you want to customize.
  • display_name - (Optional) Specifies an alternate value for the Plot Name column of the Data Table associated with the chart.
  • color - (Optional) Color to use : gray, blue, azure, navy, brown, orange, yellow, iris, magenta, pink, purple, violet, lilac, emerald, green, aquamarine.
  • value_unit - (Optional) A unit to attach to this plot. Units support automatic scaling (eg thousands of bytes will be displayed as kilobytes). Values values are Bit, Kilobit, Megabit, Gigabit, Terabit, Petabit, Exabit, Zettabit, Yottabit, Byte, Kibibyte, Mebibyte, Gibibyte (note: this was previously typoed as Gigibyte), Tebibyte, Pebibyte, Exbibyte, Zebibyte, Yobibyte, Nanosecond, Microsecond, Millisecond, Second, Minute, Hour, Day, Week.
  • value_prefix, value_suffix - (Optional) Arbitrary prefix/suffix to display with the value of this plot.

Notes

Use both max_delay in your detector configuration and an extrapolation policy in your program text to reduce false positives and false negatives.

• max_delay allows Splunk Observability Cloud to continue with computation if there is a lag in receiving data points.
• extrapolation allows you to specify how to handle missing data. An extrapolation policy can be added to individual signals by updating the data block in your program_text.

See Delayed Datapoints for more info.

Attributes

In a addition to all arguments above, the following attributes are exported:

• id - The ID of the detector.
• label_resolutions - The resolutions of the detector alerts in milliseconds that indicate how often data is analyzed to determine if an alert should be triggered.
• url - The URL of the detector.

Create Detector Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Detector(name: string, args: DetectorArgs, opts?: CustomResourceOptions);

@overload
def Detector(resource_name: str,
             args: DetectorArgs,
             opts: Optional[ResourceOptions] = None)

@overload
def Detector(resource_name: str,
             opts: Optional[ResourceOptions] = None,
             program_text: Optional[str] = None,
             rules: Optional[Sequence[DetectorRuleArgs]] = None,
             end_time: Optional[int] = None,
             authorized_writer_users: Optional[Sequence[str]] = None,
             authorized_writer_teams: Optional[Sequence[str]] = None,
             max_delay: Optional[int] = None,
             min_delay: Optional[int] = None,
             name: Optional[str] = None,
             description: Optional[str] = None,
             disable_sampling: Optional[bool] = None,
             show_data_markers: Optional[bool] = None,
             show_event_lines: Optional[bool] = None,
             start_time: Optional[int] = None,
             tags: Optional[Sequence[str]] = None,
             teams: Optional[Sequence[str]] = None,
             time_range: Optional[int] = None,
             timezone: Optional[str] = None,
             viz_options: Optional[Sequence[DetectorVizOptionArgs]] = None)

func NewDetector(ctx *Context, name string, args DetectorArgs, opts ...ResourceOption) (*Detector, error)

public Detector(string name, DetectorArgs args, CustomResourceOptions? opts = null)

public Detector(String name, DetectorArgs args)
public Detector(String name, DetectorArgs args, CustomResourceOptions options)

type: signalfx:Detector
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

Example

The following reference example uses placeholder values for all input properties.

var detectorResource = new SignalFx.Detector("detectorResource", new()
{
    ProgramText = "string",
    Rules = new[]
    {
        new SignalFx.Inputs.DetectorRuleArgs
        {
            DetectLabel = "string",
            Severity = "string",
            Description = "string",
            Disabled = false,
            Notifications = new[]
            {
                "string",
            },
            ParameterizedBody = "string",
            ParameterizedSubject = "string",
            RunbookUrl = "string",
            Tip = "string",
        },
    },
    EndTime = 0,
    AuthorizedWriterUsers = new[]
    {
        "string",
    },
    AuthorizedWriterTeams = new[]
    {
        "string",
    },
    MaxDelay = 0,
    MinDelay = 0,
    Name = "string",
    Description = "string",
    DisableSampling = false,
    ShowDataMarkers = false,
    ShowEventLines = false,
    StartTime = 0,
    Tags = new[]
    {
        "string",
    },
    Teams = new[]
    {
        "string",
    },
    TimeRange = 0,
    Timezone = "string",
    VizOptions = new[]
    {
        new SignalFx.Inputs.DetectorVizOptionArgs
        {
            Label = "string",
            Color = "string",
            DisplayName = "string",
            ValuePrefix = "string",
            ValueSuffix = "string",
            ValueUnit = "string",
        },
    },
});

example, err := signalfx.NewDetector(ctx, "detectorResource", &signalfx.DetectorArgs{
	ProgramText: pulumi.String("string"),
	Rules: signalfx.DetectorRuleArray{
		&signalfx.DetectorRuleArgs{
			DetectLabel: pulumi.String("string"),
			Severity:    pulumi.String("string"),
			Description: pulumi.String("string"),
			Disabled:    pulumi.Bool(false),
			Notifications: pulumi.StringArray{
				pulumi.String("string"),
			},
			ParameterizedBody:    pulumi.String("string"),
			ParameterizedSubject: pulumi.String("string"),
			RunbookUrl:           pulumi.String("string"),
			Tip:                  pulumi.String("string"),
		},
	},
	EndTime: pulumi.Int(0),
	AuthorizedWriterUsers: pulumi.StringArray{
		pulumi.String("string"),
	},
	AuthorizedWriterTeams: pulumi.StringArray{
		pulumi.String("string"),
	},
	MaxDelay:        pulumi.Int(0),
	MinDelay:        pulumi.Int(0),
	Name:            pulumi.String("string"),
	Description:     pulumi.String("string"),
	DisableSampling: pulumi.Bool(false),
	ShowDataMarkers: pulumi.Bool(false),
	ShowEventLines:  pulumi.Bool(false),
	StartTime:       pulumi.Int(0),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	Teams: pulumi.StringArray{
		pulumi.String("string"),
	},
	TimeRange: pulumi.Int(0),
	Timezone:  pulumi.String("string"),
	VizOptions: signalfx.DetectorVizOptionArray{
		&signalfx.DetectorVizOptionArgs{
			Label:       pulumi.String("string"),
			Color:       pulumi.String("string"),
			DisplayName: pulumi.String("string"),
			ValuePrefix: pulumi.String("string"),
			ValueSuffix: pulumi.String("string"),
			ValueUnit:   pulumi.String("string"),
		},
	},
})

var detectorResource = new Detector("detectorResource", DetectorArgs.builder()        
    .programText("string")
    .rules(DetectorRuleArgs.builder()
        .detectLabel("string")
        .severity("string")
        .description("string")
        .disabled(false)
        .notifications("string")
        .parameterizedBody("string")
        .parameterizedSubject("string")
        .runbookUrl("string")
        .tip("string")
        .build())
    .endTime(0)
    .authorizedWriterUsers("string")
    .authorizedWriterTeams("string")
    .maxDelay(0)
    .minDelay(0)
    .name("string")
    .description("string")
    .disableSampling(false)
    .showDataMarkers(false)
    .showEventLines(false)
    .startTime(0)
    .tags("string")
    .teams("string")
    .timeRange(0)
    .timezone("string")
    .vizOptions(DetectorVizOptionArgs.builder()
        .label("string")
        .color("string")
        .displayName("string")
        .valuePrefix("string")
        .valueSuffix("string")
        .valueUnit("string")
        .build())
    .build());

detector_resource = signalfx.Detector("detectorResource",
    program_text="string",
    rules=[signalfx.DetectorRuleArgs(
        detect_label="string",
        severity="string",
        description="string",
        disabled=False,
        notifications=["string"],
        parameterized_body="string",
        parameterized_subject="string",
        runbook_url="string",
        tip="string",
    )],
    end_time=0,
    authorized_writer_users=["string"],
    authorized_writer_teams=["string"],
    max_delay=0,
    min_delay=0,
    name="string",
    description="string",
    disable_sampling=False,
    show_data_markers=False,
    show_event_lines=False,
    start_time=0,
    tags=["string"],
    teams=["string"],
    time_range=0,
    timezone="string",
    viz_options=[signalfx.DetectorVizOptionArgs(
        label="string",
        color="string",
        display_name="string",
        value_prefix="string",
        value_suffix="string",
        value_unit="string",
    )])

const detectorResource = new signalfx.Detector("detectorResource", {
    programText: "string",
    rules: [{
        detectLabel: "string",
        severity: "string",
        description: "string",
        disabled: false,
        notifications: ["string"],
        parameterizedBody: "string",
        parameterizedSubject: "string",
        runbookUrl: "string",
        tip: "string",
    }],
    endTime: 0,
    authorizedWriterUsers: ["string"],
    authorizedWriterTeams: ["string"],
    maxDelay: 0,
    minDelay: 0,
    name: "string",
    description: "string",
    disableSampling: false,
    showDataMarkers: false,
    showEventLines: false,
    startTime: 0,
    tags: ["string"],
    teams: ["string"],
    timeRange: 0,
    timezone: "string",
    vizOptions: [{
        label: "string",
        color: "string",
        displayName: "string",
        valuePrefix: "string",
        valueSuffix: "string",
        valueUnit: "string",
    }],
});

type: signalfx:Detector
properties:
    authorizedWriterTeams:
        - string
    authorizedWriterUsers:
        - string
    description: string
    disableSampling: false
    endTime: 0
    maxDelay: 0
    minDelay: 0
    name: string
    programText: string
    rules:
        - description: string
          detectLabel: string
          disabled: false
          notifications:
            - string
          parameterizedBody: string
          parameterizedSubject: string
          runbookUrl: string
          severity: string
          tip: string
    showDataMarkers: false
    showEventLines: false
    startTime: 0
    tags:
        - string
    teams:
        - string
    timeRange: 0
    timezone: string
    vizOptions:
        - color: string
          displayName: string
          label: string
          valuePrefix: string
          valueSuffix: string
          valueUnit: string

Detector Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The Detector resource accepts the following input properties:

Outputs

All input properties are implicitly available as output properties. Additionally, the Detector resource produces the following output properties:

Look up Existing Detector Resource

Get an existing Detector resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: DetectorState, opts?: CustomResourceOptions): Detector

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        authorized_writer_teams: Optional[Sequence[str]] = None,
        authorized_writer_users: Optional[Sequence[str]] = None,
        description: Optional[str] = None,
        disable_sampling: Optional[bool] = None,
        end_time: Optional[int] = None,
        label_resolutions: Optional[Mapping[str, int]] = None,
        max_delay: Optional[int] = None,
        min_delay: Optional[int] = None,
        name: Optional[str] = None,
        program_text: Optional[str] = None,
        rules: Optional[Sequence[DetectorRuleArgs]] = None,
        show_data_markers: Optional[bool] = None,
        show_event_lines: Optional[bool] = None,
        start_time: Optional[int] = None,
        tags: Optional[Sequence[str]] = None,
        teams: Optional[Sequence[str]] = None,
        time_range: Optional[int] = None,
        timezone: Optional[str] = None,
        url: Optional[str] = None,
        viz_options: Optional[Sequence[DetectorVizOptionArgs]] = None) -> Detector

func GetDetector(ctx *Context, name string, id IDInput, state *DetectorState, opts ...ResourceOption) (*Detector, error)

public static Detector Get(string name, Input<string> id, DetectorState? state, CustomResourceOptions? opts = null)

public static Detector get(String name, Output<String> id, DetectorState state, CustomResourceOptions options)

Resource lookup is not supported in YAML

Supporting Types

DetectorRule, DetectorRuleArgs

DetectorVizOption, DetectorVizOptionArgs

Import

Detectors can be imported using their string ID (recoverable from URL: /#/detector/v2/abc123/edit, e.g.

$ pulumi import signalfx:index/detector:Detector application_delay abc123

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository

SignalFx pulumi/pulumi-signalfx

License

Apache-2.0

Notes

This Pulumi package is based on the signalfx Terraform Provider.