Alert monitoring of data based on recommended attribute values

A non-transitory computer-readable medium comprising instructions that, when executed by a hardware processor of a device, cause the device to perform operations comprising:

• accessing current time series data that comprises a time series of measurement values for a metric over a period of time, the time series comprising a set of attribute values associated with each measurement value in the time series;
• performing a graph-based process on the time series of measurement values to determine a plurality of candidate attribute value sets for anomaly alert monitoring of the metric based on sets of attribute values associated with the time series of measurement values, the performing of the graph-based process comprising:
• generating a tree that comprises:
• a root node associated with all measurement values in the time series;
• a plurality of children nodes, each child node of the plurality of children nodes being associated with a different attribute value set;
• and
• a plurality of connections, each connection of the plurality of connections from a parent node to a child node being associated with a weight determined based on:
• an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set associated with the child node;
• and
• a total count of measurement values in the time series;
• and
• traversing the tree to determine the plurality of candidate attribute value sets based on weights of one or more connections of the plurality of connections;
• selecting, from the plurality of candidate attribute value sets, a set of select attributes values based on at least one of user selection or automatic selection according to a set of criteria;
• configuring a new anomaly alert monitor based on the set of select attributes values;
• based on the new anomaly alert monitor, using a set of trained models to monitor new time series data for the metric based on the set of select attributes values and to detect whether any value anomalies exist in the new time series data;
• and
• causing an alert to be triggered, based on the new anomaly alert monitor, in response to detecting at least one value anomaly in the new time series data.

A method comprising:

• accessing, by one or more hardware processors, current time series data that comprises a time series of measurement values for a metric over a period of time, the time series comprising a set of attribute values associated with each measurement value in the time series;
• performing, by the one or more hardware processors, a graph-based process on the time series of measurement values to determine a plurality of candidate attribute value sets for anomaly alert monitoring of the metric based on sets of attribute values associated with the time series of measurement values, the performing of the graph-based process comprising:
• generating a tree that comprises:
• a root node associated with all measurement values in the time series;
• a plurality of children nodes, each child node of the plurality of children nodes being associated with a different attribute value set;
• and
• a plurality of connections, each connection of the plurality of connections from a parent node to a child node being associated with a weight determined based on:
• an individual count of measurement values that are in a portion of the time series and that are associated with an individual attribute value set associated with the child node;
• and
• a total count of measurement values in the time series;
• and
• traversing the tree to determine the plurality of candidate attribute value sets based on weights of one or more connections of the plurality of connections;
• selecting, by the one or more hardware processors and from the plurality of candidate attribute value sets, a set of select attributes values based on at least one of user selection or automatic selection according to a set of criteria;
• configuring, by the one or more hardware processors, a new anomaly alert monitor based on the set of select attributes values;
• based on the new anomaly alert monitor, using a set of trained models by the one or more hardware processors to monitor new time series data for the metric based on the set of select attributes values and to detect whether any value anomalies exist in the new time series data;
• and
• causing, by the one or more hardware processors, an alert to be triggered in response to detecting at least one value anomaly in the new time series data.