cpuZ: visualize z-scores for a cpu metric.

cpuZ-demo.juttle

// stats demos: statistics 101 for juttle data flows
//
// Each of the stream standardization approaches offered in stats is
// appropriate in a different setting. The demos here show some good
// and some bad choices.
//
import "stats.juttle" as stats;

// cpuZ: visualize z-scores for a cpu metric.
//
// For cpu metrics, which range from 0 to 100% (and don't cross
// 0!)  coefficient of variation and mean-relative normalization
// are good things to try. In this demo, we feed two days of
// simulated CPU metrics into each of the normalization
// processors. Note how z and a psuedo-z-score using MAD recover poorly from
// periods of low variation (in which spread becomes a small
// divisor and is oversensitive to sudden change), while relMean
// gives nice clean signals at the transitions that then decay
// gradually as a "new normal" sets in.
//
// (A completely idle CPU at 0% would be a problem, of course)
//
export sub cpuZ() {
    read -demo 'cdn' -from :this year: -to :2d after this year: -every :m: name='cpu'
    | (@timechart -display.dataDensity 0 -title 'raw data' ; merge)
    | put cpu = value
    | keep time, cpu
    | (
        put -over :2h: name='z', value = stats.z('cpu')
            | @timechart -display.dataDensity 0 -title 'z-score';
        put -over :2h: name='z', value = (cpu - percentile('cpu', 0.5)) / mad('cpu')
            | @timechart -display.dataDensity 0 -title 'MAD z-score';
        put -over :2h: name='z', value = stats.relMean('cpu') - 1
            | @timechart -display.dataDensity 0 -title 'relative variation';
      )
}