Skip to main content

Machine learning, score, and forecast

SPOT learns the expected behavior of each source, metric, parameter set, and series. adaptive-robust-v3 is precision-first: a high score requires a change to be rare, material, and harmful for that metric.

ML complements thresholds. It does not confirm a root cause or replace Events, Jobs, Alerts, or SAP context.

Global controls​

The global Analysis menu starts disabled and can display:

  • Static thresholds: warning and critical lines.
  • Expected range: calibrated band and typical value.
  • Forecast: prediction for the next 24 hours.
  • ML score points: points on the actual series and a 0–100 score selector.

The setting applies to all compatible time charts. An expanded chart can enable Forecast or ML scores for that modal only.

What the model learns​

  • It uses up to 42 days of observations in internal 5-minute buckets.
  • It uses the source timezone to preserve daily, weekly, and daylight-saving patterns.
  • It compares level/trend, daily, weekly, combined-seasonality, and intermittent-signal models. It keeps the simplest model with equivalent accuracy in temporal validation.
  • It calibrates the expected band from previous prediction errors that did not use future data.
  • It remains warming_up until at least 21 days, three complete cycles, and 70% coverage are available.

Coverage follows each metric's canonical collection interval. For example, ICM error rates are collected every 15 minutes even though the engine keeps internal five-minute buckets; those regular samples are not counted as missing data.

SPOT queries the 42 days in seven-day chunks and, when a query is too large or times out, splits it down to six hours. It publishes a model only when the whole window is complete; a failed chunk leaves the variant in training_error and never creates a partial model.

Every view uses the exact source, metricId, parameters, and canonical series key. A visible name is never used to join models. An observation score belongs only to that timestamp; SPOT does not reuse the last score for a newer value.

Reading the score​

The 0–100 score combines:

  • Rarity: the calibrated probability of an equal or larger deviation.
  • Impact: how far the change exceeds a material minimum for its unit and normal scale.
  • Direction: increases normally matter for latency, utilization, errors, and age; decreases matter for free space, availability, and healthy ratios.
  • Persistence: windows of 3, 6, and 12 distinct observations complement the current point.

An improvement cannot open an ML incident. For example, lower latency or more free space may leave the expected band without representing degradation.

The calibrated scale makes 75 approximately a rare deviation and 90 a far more exceptional one, provided its impact is also material. Effective thresholds remain configurable with 0 ≤ warning < critical ≤ 100.

Spikes, persistence, and alerts​

An isolated point can remain visible evidence without opening an incident. The default precision profile requires two distinct anomalous observations over at least five minutes. Only an exceptional score-100 event with extreme impact can open from one point.

Re-evaluating the same bucket does not increase persistence or create another incident. Two distinct healthy observations resolve the ML condition. warming_up, no_recent_data, insufficient_history, insufficient_coverage, training_error, no_matching_series, and unavailable do not trigger ML.

Forecast and explanation​

Forecast covers 24 hours using the selected model and a calibrated band. The Now line separates history from the future. Its tooltip shows expected value, minimum, maximum, confidence, and model. Confidence reflects observed validation coverage, not only sample count.

Baseline and forecast expose independent states. An available forecast cannot hide a baseline that is still warming up or lacks sufficient coverage. Messages distinguish missing recent data, insufficient history or coverage, training errors, unmatched series, and unavailability. Ready forecasts refresh once per hour.

If warming_up remains unchanged for more than one training cycle while the chart still receives recent data, check Alerts → ML coverage. The state should identify insufficient coverage or history; a persistent processing error requires review by the SPOT administrator.

Charts and Alert Center explain:

  • observed value, typical value, and expected band;
  • absolute and relative change;
  • point score and multi-bucket score;
  • rarity, impact, direction, and persistence;
  • model, effective samples, coverage, and score reasons.

Check Alerts → ML coverage for version, generation, timezone, state, coverage, calibration, and last inference before enabling an ML rule. Forecast remains visual evidence and does not open predictive alerts.