Im trying to create a correlation rule to trigger an alert for a percentage increase of events for a device. however according to the online help the calculation to work out the event average is....
'number of events recieved for messageID since enVision started collecting data for that device' DIVIDED BY 'time period'
BUT during the event collection I had a massive spike a year ago that will effect my daily and hourly average today!
SO can the average be reset? how can I know what envision is using for the average at any time?