Make Threshold Metric more useful

[its02003]

Currently, the threshold metric object is lacking in potential, looking for some feedback on this proposal:

Current functionality:

thresholdMetric:
      source: 'splunk'
      query: '<query_string>'
      queryType: 'query'

A few questions:

1. What is the purpose of queryType here? I'm sure there are examples, so some would be helpful
2. Would there be an issue with adding a field like sourceType for things like splunk or newRelic and shift source to the exact URL to the instance being referred to?

• For most systems that are going to generate metrics, URL solves some nice issues:
  • Solves the use case at scale that there might be more than one source in use
  • Solves the use case where adding indexes and spaces within a source allows for differentiation
  • Allows the query field to be used more explicitly as the query string for various platforms which generate the metrics

Proposed Functionality:

thresholdMetric:
      source: '<url_to_specific_splunk_instance_and_app>'
      sourceType: 'splunk'
      query: 'index=<index> host IN (<hosts>)'
      queryType: 'query'

[ian-bartholomew]

This is a good question, but I think that its a better question to be asked in the spec.

Would there be an issue with adding a field like sourceType for things like splunk or newRelic and shift source to the exact URL to the instance being referred to?

When we were deciding on how to open source this, we debated how to express the data source without tying it to a specific implementation. For example, at nobl9, we have an agent-based architecture so we need the external connection configuration in order to connect to it. But if this is used by an observability platform, configuring an external source wouldn't make sense, it would be assumed to be using that platform. So we kept that out, allowing the implementation to define that.

The other part is that we wanted to keep the connection config out of the metric definition, since you will have multiple SLOs per data source, and having to define that connection for each metric is brittle. So for this case, source is meant to point to a data source already defined in the implementation.

What is the purpose of queryType here?

Since each data provider might have multiple ways of getting data, like NewRelic has both NRQL and NerdGraph, so queryType is meant to give a hint to the implementation in order to better know how to handle the query.

I will open an issue with OpenSLO to make this more clear.

[programmer04]

I think it has been resolved in PR OpenSLO/OpenSLO#111. Issue OpenSLO/OpenSLO#107 in detail describes different possibilities. Thus we decided to be as generic as possible and left everything related to metric queries and sources for a specific implementation. Thanks for your involvement @its02003! If you have still some thoughts to share, please create a new issue