[comment]: # attributes: notoc
[comment]: # (terms: baselinedev, baselinewma, change, changecount, count, countunique, find, first, firstclock, fuzzytime, last, lastclock, logeventid, logseverity, logsource, logtimestamp, monodec, monoinc, nodata, percentile, rate, trendavg, trendcount, trendmax, trendmin, trendstl, trendsum )
[comment]: # ({54b6ab68-7da5ea1c})
# 4 History functions
All functions listed here are supported in:
- [Trigger expressions](/manual/config/triggers/expression)
- [Calculated item formulas](/manual/config/items/itemtypes/calculated)
- [Expression macros](/manual/config/macros/expression_macros)
The functions are listed without additional information.
Click on the function to see the full details.
|Function|Description|
|--|--------|
|[change](#change)|The amount of difference between the previous and latest value.|
|[changecount](#changecount)|The number of changes between adjacent values within the defined evaluation period.|
|[count](#count)|The number of values within the defined evaluation period.|
|[countunique](#countunique)|The number of unique values within the defined evaluation period.|
|[find](#find)|Find a value match within the defined evaluation period.|
|[first](#first)|The first (the oldest) value within the defined evaluation period.|
|[firstclock](#firstclock)|The timestamp of the first (the oldest) value within the defined evaluation period.|
|[fuzzytime](#fuzzytime)|Check how much the passive agent time differs from the Zabbix server/proxy time.|
|[last](#last)|The most recent value.|
|[lastclock](#lastclock)|The timestamp of the Nth most recent value within the defined evaluation period.|
|[logeventid](#logeventid)|Check if the event ID of the last log entry matches a regular expression.|
|[logseverity](#logseverity)|The log severity of the last log entry.|
|[logsource](#logsource)|Check if log source of the last log entry matches a regular expression.|
|[logtimestamp](#logtimestamp)|The log message timestamp of the Nth most recent log item value.|
|[monodec](#monodec)|Check if there has been a monotonous decrease in values.|
|[monoinc](#monoinc)|Check if there has been a monotonous increase in values.|
|[nodata](#nodata)|Check for no data received.|
|[percentile](#percentile)|The P-th percentile of a period, where P (percentage) is specified by the third parameter.|
|[rate](#rate)|The per-second average rate of the increase in a monotonically increasing counter within the defined time period.|
[comment]: # ({/54b6ab68-7da5ea1c})
[comment]: # ({13dca3e2-4d343eb8})
##### Common parameters
- `/host/key` is a common mandatory first parameter for the functions referencing the host item history
- `(sec|#num)<:time shift>` is a common second parameter for the functions referencing the host item history, where:
- **sec** - maximum [evaluation period](/manual/config/triggers/expression#time-period) in seconds (time [suffixes](/manual/appendix/suffixes) can be used), or
- **\#num** - maximum [evaluation range](/manual/config/triggers/expression#time-period) in latest collected values (if preceded by a hash mark)
- **time shift** (optional) allows to move the evaluation point back in time.
See [more details](/manual/config/triggers/expression#time-shift) on specifying time shift.
[comment]: # ({/13dca3e2-4d343eb8})
[comment]: # ({aa4e1bf6-8f3a0028})
### Function details
Some general notes on function parameters:
- Function parameters are separated by a comma
- Optional function parameters (or parameter parts) are indicated by `<` `>`
- Function-specific parameters are described with each function
- `/host/key` and `(sec|#num)<:time shift>` parameters must never be quoted
[comment]: # ({/aa4e1bf6-8f3a0028})
[comment]: # ({bed62e87-4afc9a02})
##### change(/host/key) {#change}
The amount of difference between the previous and latest value.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
For strings returns: 0 - values are equal; 1 - values differ.
Parameters: see [common parameters](#common-parameters).
Comments:
- Numeric difference will be calculated, as seen with these incoming example values ('previous' and 'latest' value = difference):
'1' and '5' = `+4`
'3' and '1' = `-2`
'0' and '-2.5' = `-2.5`.
- In triggers, useful for catching sudden spikes (or drops), counter resets, numeric state transitions.
- See also: [abs](/manual/config/triggers/expression/math#abs) for comparison.
Examples:
```default
change(/host/system.uptime)<0 #system uptime change has been negative since the last value (indicating a reboot)
change(/host/system.cpu.load[all,avg1])>2 #CPU load (for one minute) has jumped by more than 2 since the last value
change(/host/vfs.fs.size[/,free])<-1G #free disk space has dropped by more than 1 GB between checks
```
[comment]: # ({/bed62e87-4afc9a02})
[comment]: # ({6eb2b572-57458a90})
##### changecount(/host/key,(sec|#num)<:time shift>,) {#changecount}
The number of changes between adjacent values within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters)
- **mode** (must be double-quoted) - possible values: *all* - count all changes (default); *dec* - count decreases; *inc* - count increases
Comments:
- For non-numeric value types, the *mode* parameter is ignored.
- In triggers, useful for catching frequent state changes (indicating instability).
Examples:
```default
changecount(/host/icmpping,10m)>5 #ping status has changed more than 5 times in 10 minutes
changecount(/host/vfs.file.contents["/sys/class/net/eth0/operstate"],1h)>5 #operational state of eth0 has changed more than 5 times in an hour
changecount(/host/proc.num[httpd],15m)>10 #the number of httpd processes has changed more than 10 times in 15 minutes
changecount(/host/key,#10,"inc") #the number of value increases (relative to the adjacent value) among the last 10 values
changecount(/host/key,24h,"dec") #the number of value decreases (relative to the adjacent value) for the last 24 hours until now
```
[comment]: # ({/6eb2b572-57458a90})
[comment]: # ({1f9dc9af-f9ce5dd9})
##### count(/host/key,(sec|#num)<:time shift>,,) {#count}
The number of values within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters)
- **operator** (must be double-quoted)
Supported `operators`:
*eq* - equal (default for integer, float)
*ne* - not equal
*gt* - greater
*ge* - greater or equal
*lt* - less
*le* - less or equal
*like* (default for string, text, log) - matches if contains pattern (case-sensitive)
*bitand* - bitwise AND
*regexp* - case-sensitive match of the regular expression given in `pattern`
*iregexp* - case-insensitive match of the regular expression given in `pattern`
- **pattern** - the required pattern (string arguments must be double-quoted)
Comments:
- Float items match with the precision of 2.22e-16.
- *like* is not supported as operator for integer values.
- *like* and *bitand* are not supported as operators for float values.
- For string, text, and log values only *eq*, *ne*, *like*, *regexp* and *iregexp* operators are supported.
- With *bitand* as operator, the fourth `pattern` parameter can be specified as two numbers, separated by '/': **number_to_compare_with/mask**.
count() calculates "bitwise AND" from the value and the *mask* and compares the result to *number_to_compare_with*.
If the result of "bitwise AND" is equal to *number_to_compare_with*, the value is counted.
If *number_to_compare_with* and *mask* are equal, only the *mask* need be specified (without '/').
- With *regexp* or *iregexp* as operator, the fourth `pattern` parameter can be an ordinary or [global](/manual/regular_expressions#global-regular-expressions) (starting with '@') regular expression.
In case of global regular expressions case sensitivity is inherited from global regular expression settings.
For the purpose of regexp matching, float values will always be represented with 4 decimal digits after '.'.
Also note that for large numbers difference in decimal (stored in database) and binary (used by Zabbix server) representation may affect the 4th decimal digit.
Examples:
```default
count(/host/icmpping,30m,,"0")>5 #ping has failed more than 5 times in 30 minutes
count(/host/key,10m,"like","error") #the number of values for the last 10 minutes until now that contain 'error'
count(/host/key,10m,,12) #the number of values for the last 10 minutes until now that equal '12'
count(/host/key,10m,"gt",12) #the number of values for the last 10 minutes until now that are over '12'
count(/host/key,#10,"gt",12) #the number of values within the last 10 values until now that are over '12'
count(/host/key,10m:now-1d,"gt",12) #the number of values between 24 hours and 10 minutes and 24 hours ago from now that were over '12'
count(/host/key,10m,"bitand","6/7") #the number of values for the last 10 minutes until now having '110' (in binary) in the 3 least significant bits
count(/host/key,10m:now-1d) #the number of values between 24 hours and 10 minutes and 24 hours ago from now
```
[comment]: # ({/1f9dc9af-f9ce5dd9})
[comment]: # ({ab6b4d74-bf8dc20c})
##### countunique(/host/key,(sec|#num)<:time shift>,,) {#countunique}
The number of unique values within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters)
- **operator** (must be double-quoted).
Supported `operators`:
*eq* - equal (default for integer, float)
*ne* - not equal
*gt* - greater
*ge* - greater or equal
*lt* - less
*le* - less or equal
*like* (default for string, text, log) - matches if contains pattern (case-sensitive)
*bitand* - bitwise AND
*regexp* - case-sensitive match of the regular expression given in `pattern`
*iregexp* - case-insensitive match of the regular expression given in `pattern`
- **pattern** - the required pattern (string arguments must be double-quoted)
Comments:
- Float items match with the precision of 2.22e-16.
- *like* is not supported as operator for integer values.
- *like* and *bitand* are not supported as operators for float values.
- For string, text, and log values only *eq*, *ne*, *like*, *regexp* and *iregexp* operators are supported.
- With *bitand* as operator, the fourth `pattern` parameter can be specified as two numbers, separated by '/': **number_to_compare_with/mask**. countunique() calculates "bitwise AND" from the value and the *mask* and compares the result to *number_to_compare_with*.
If the result of "bitwise AND" is equal to *number_to_compare_with*, the value is counted.
If *number_to_compare_with* and *mask* are equal, only the *mask* need be specified (without '/').
- With *regexp* or *iregexp* as operator, the fourth `pattern` parameter can be an ordinary or [global](/manual/regular_expressions#global-regular-expressions) (starting with '@') regular expression.
In case of global regular expressions case sensitivity is inherited from global regular expression settings.
For the purpose of regexp matching, float values will always be represented with 4 decimal digits after '.'.
Also note that for large numbers difference in decimal (stored in database) and binary (used by Zabbix server) representation may affect the 4th decimal digit.
Examples:
```default
countunique(/host/key,10m) #the number of unique values for the last 10 minutes until now
countunique(/host/key,10m,"like","error") #the number of unique values for the last 10 minutes until now that contain 'error'
countunique(/host/key,10m,,12) #the number of unique values for the last 10 minutes until now that equal '12'
countunique(/host/key,10m,"gt",12) #the number of unique values for the last 10 minutes until now that are over '12'
countunique(/host/key,#10,"gt",12) #the number of unique values within the last 10 values until now that are over '12'
countunique(/host/key,10m:now-1d,"gt",12) #the number of unique values between 24 hours and 10 minutes and 24 hours ago from now that were over '12'
countunique(/host/key,10m,"bitand","6/7") #the number of unique values for the last 10 minutes until now having '110' (in binary) in the 3 least significant bits
countunique(/host/key,10m:now-1d) #the number of unique values between 24 hours and 10 minutes and 24 hours ago from now
```
[comment]: # ({/ab6b4d74-bf8dc20c})
[comment]: # ({9bb9907e-148d7d16})
##### find(/host/key,(sec|#num)<:time shift>,,) {#find}
Find a value match within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Returns: 1 - found; 0 - otherwise.
Parameters:
- See [common parameters](#common-parameters)
- **sec** or **#num** (optional) - defaults to the latest value if not specified
- **operator** (must be double-quoted)
Supported `operators`:
*eq* - equal (default for integer, float)
*ne* - not equal
*gt* - greater
*ge* - greater or equal
*lt* - less
*le* - less or equal
*like* (default for string, text, log) - matches if contains the string given in `pattern` (case-sensitive)
*bitand* - bitwise AND
*regexp* - case-sensitive match of the regular expression given in `pattern`
*iregexp* - case-insensitive match of the regular expression given in `pattern`
- **pattern** - the required pattern (string arguments must be double-quoted); [Perl Compatible Regular Expression](https://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions) (PCRE) regular expression if `operator` is *regexp*, *iregexp*
Comments:
- If more than one value is processed, '1' is returned if there is at least one matching value.
- *like* is not supported as operator for integer values.
- *like* and *bitand* are not supported as operators for float values.
- For string, text, and log values only *eq*, *ne*, *like*, *regexp* and *iregexp* operators are supported.
- With *regexp* or *iregexp* as operator, the fourth `pattern` parameter can be an ordinary or [global](/manual/regular_expressions#global-regular-expressions) (starting with '@') regular expression.
In case of global regular expressions case sensitivity is inherited from the global regular expression settings.
Examples:
```default
find(/host/key,10m,"like","error") #find a value that contains 'error' within the last 10 minutes until now
find(/host/agent.version,,"like","beta")=1 #Zabbix agent has beta version, must be upgraded
find(/host/log[/var/log/nginx/access.log],,"regexp"," 500 ")=1 #internal web server error has been found
```
[comment]: # ({/9bb9907e-148d7d16})
[comment]: # ({86057069-0ae5f587})
##### first(/host/key,sec<:time shift>) {#first}
The first (the oldest) value within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters)
See also [last()](#last).
Example:
```default
first(/host/key,1h) #retrieve the oldest value within the last hour until now
```
[comment]: # ({/86057069-0ae5f587})
[comment]: # ({f7e55e49-77c121f4})
##### firstclock(/host/key,sec<:time shift>) {#firstclock}
The timestamp of the oldest value within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters).
The function fails with an error if no data has been collected in the given period.
See also [lastclock()](#lastclock).
Examples:
```default
firstclock(/host/key,1h) #retrieve the timestamp of the oldest value within the last hour
firstclock(/host/key,1h:now-24h) #retrieve the timestamp of the oldest value within the last hour a day ago
```
[comment]: # ({/f7e55e49-77c121f4})
[comment]: # ({96c1f032-1c3609f8})
##### fuzzytime(/host/key,sec) {#fuzzytime}
Check how much the passive agent time differs from the Zabbix server/proxy time.
Supported value types: *Float*, *Integer*.
Returns: 1 - difference between the passive item value (as timestamp) and Zabbix server/proxy timestamp (the clock of value collection) is less than or equal to *sec* seconds; 0 - otherwise.
Parameters:
- See [common parameters](#common-parameters).
Comments:
- Usually used with the 'system.localtime' item to check that local time is in sync with the local time of Zabbix server.
*Note* that 'system.localtime' must be configured as a [passive check](/manual/appendix/items/activepassive#passive-checks) for Zabbix agent; on Zabbix agent 2 it may be configured as an active check.
- Can be used also with the `vfs.file.time[/path/file,modify]` key to check that the file did not get updates for long time.
- This function is not recommended for use in complex trigger expressions (with multiple items involved), because it may cause unexpected results (time difference will be measured with the most recent metric), e.g. in `fuzzytime(/Host/system.localtime,60s)=0 or last(/Host/trap)<>0`.
Examples:
```default
fuzzytime(/host/system.localtime,5m)=0 #client local time differs from Zabbix server/proxy time by more than 5 minutes
fuzzytime(/host/system.localtime,5m)=0 and nodata(/host/system.localtime,10m)=0 #client local time differs from Zabbix server/proxy time by more than 5 minutes (while making sure the item has not stopped reporting data)
```
[comment]: # ({/96c1f032-1c3609f8})
[comment]: # ({a56ae5b5-8059d345})
##### last(/host/key,<#num<:time shift>>) {#last}
The most recent value.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters)
- **#num** (optional) - the Nth most recent value
Comments:
- Take note that a hash-tagged time period (#N) works differently here than with many other functions.
For example: `last(/host/key)` is always equal to `last(/host/key,#1)`; `last(/host/key,#3)` - the third most recent value (*not* three latest values).
- Zabbix does not guarantee the exact order of values if more than two values exist within one second in history.
- See also [first()](#first).
Examples:
```default
last(/host/key) #retrieve the last value
last(/host/key,#2) #retrieve the previous value
last(/host/key,#1)<>last(/host/key,#2) #last two values differ
```
[comment]: # ({/a56ae5b5-8059d345})
[comment]: # ({37d8627c-e2c2d8a2})
##### lastclock(/host/key,<#num<:time shift>>) {#lastclock}
The timestamp of the Nth most recent value within the defined evaluation period.
Supported value types: *Float*, *Integer*, *String*, *Text*, *Log*.
Parameters:
- See [common parameters](#common-parameters);
- **#num** (optional) - the Nth most recent value.
The function fails with an error if no data has been collected in the given period or no Nth value has been collected.
See also [firstclock()](#firstclock).
Examples:
```default
lastclock(/host/key) #retrieve the timestamp of the latest value
lastclock(/host/key,#2) #retrieve the timestamp of the 2nd latest value
now()-lastclock(/host/heartbeat.item)>300 #more than 5 minutes have passed since the heartbeat item was updated
lastclock(/host/system.cpu.load[all,avg1])-lastclock(/host/system.cpu.load[all,avg1],#2)>300 #the update interval between last two values is above 5 minutes
((now()-lastclock(/host/system.cpu.load[all,avg1])<120 and last(/host/system.cpu.load[all,avg1])>5)) #CPU value is high and the value is fresh (less than 2 minutes)
```
[comment]: # ({/37d8627c-e2c2d8a2})
[comment]: # ({5cecd78d-ff5dcd5e})
##### logeventid(/host/key,<#num<:time shift>>,) {#logeventid}
Check if the event ID of the last log entry matches a regular expression.
Supported value types: *Log*.
Returns: 0 - does not match; 1 - matches.
Parameters:
- See [common parameters](#common-parameters)
- **#num** (optional) - the Nth most recent value
- **pattern** (optional) - the regular expression describing the required pattern, [Perl Compatible Regular Expression](https://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions) (PCRE) style (string arguments must be double-quoted)
Examples:
```default
logeventid(/host/eventlog[Security],,"^4625$")=1 #a log entry with ID matching "4625" (failed authentication) found
logeventid(/host/eventlog[System],,"^(6008|41)$")=1 #a log entry with ID matching "6008" or "41" found
```
[comment]: # ({/5cecd78d-ff5dcd5e})
[comment]: # ({d3497d35-5053b990})
##### logseverity(/host/key,<#num<:time shift>>) {#logseverity}
Log severity of the last log entry.
Supported value types: *Log*.
Returns: 0 - default severity; N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose).
Parameters:
- See [common parameters](#common-parameters)
- **#num** (optional) - the Nth most recent value
Zabbix takes log severity from the **Information** field of Windows event log.
Examples:
```default
logseverity(/host/log[/var/log/syslog],10m)>3 #a log entry with severity above "3" found
logseverity(/host/eventlog[System],10m)=4 #a log entry with severity equaling "Error" found
```
[comment]: # ({/d3497d35-5053b990})
[comment]: # ({b33d7f55-a9148f5c})
##### logsource(/host/key,<#num<:time shift>>,) {#logsource}
Check if log source of the last log entry matches a regular expression.
Supported value types: *Log*.
Returns: 0 - does not match; 1 - matches.
Parameters:
- See [common parameters](#common-parameters)
- **#num** (optional) - the Nth most recent value
- **pattern** (optional) - the regular expression describing the required pattern, [Perl Compatible Regular Expression](https://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions) (PCRE) style (string arguments must be double-quoted)
Normally used for Windows event logs.
Examples:
```default
logsource(/host/eventlog[Application],,"MSSQLSERVER")=1 #a log entry with source matching "MSSQLSERVER" found
logsource(/host/eventlog[System],,"Service Control Manager")=1 #a log entry with source matching "Service Control Manager" found
logsource(/host/eventlog[System],,"Service Control Manager")=1 and logeventid(/host/eventlog[System],,"^7031$")=1 #a log entry with source matching "Service Control Manager" and event ID matching "7031" found
```
[comment]: # ({/b33d7f55-a9148f5c})
[comment]: # ({64641457-49eac3d8})
##### logtimestamp(/host/key,<#num<:time shift>>) {#logtimestamp}
The log message timestamp of the Nth most recent log item value.
Supported value types: *Log*.
Parameters:
- See [common parameters](#common-parameters);
- **#num** (optional) - the Nth most recent value.
Comments:
- Calculation of time shift is based on the item value clock, not on the log message timestamp;
- The function fails with an error if:
- a non-log type item is received;
- no data has been collected in the given period;
- no Nth value has been collected;
- log message does not contain a timestamp value.
Examples:
```default
logtimestamp(/host/key) #retrieve the timestamp of the latest log message
logtimestamp(/host/key,#2) #retrieve the timestamp of the 2nd latest log message
logtimestamp(/host/key,#3:now-1d) #retrieve the timestamp of the 3rd latest log message a day ago
```
[comment]: # ({/64641457-49eac3d8})
[comment]: # ({2b7441d8-6a63b5c8})
##### monodec(/host/key,(sec|#num)<:time shift>,) {#monodec}
Check if there has been a monotonous decrease in values.
Supported value types: *Integer*.
Returns: 1 - if all elements in the time period continuously decrease; 0 - otherwise.
Parameters:
- See [common parameters](#common-parameters)
- **mode** (must be double-quoted) - *weak* (every value is smaller or the same as the previous one; default) or *strict* (every value has decreased)
Examples:
```default
monodec(/host/system.swap.size[all,free],60s) + monodec(/host2/system.swap.size[all,free],60s) + monodec(/host3/system.swap.size[all,free],60s) #calculate in how many hosts there has been a decrease in free swap size
monodec(/host/proc.num[nginx],10m,"strict")=1 #the number of nginx processes has monotonously decreased over 10 minutes
```
[comment]: # ({/2b7441d8-6a63b5c8})
[comment]: # ({09e06757-755c1821})
##### monoinc(/host/key,(sec|#num)<:time shift>,) {#monoinc}
Check if there has been a monotonous increase in values.
Supported value types: *Integer*.
Returns: 1 - if all elements in the time period continuously increase; 0 - otherwise.
Parameters:
- See [common parameters](#common-parameters)
- **mode** (must be double-quoted) - *weak* (every value is bigger or the same as the previous one; default) or *strict* (every value has increased)
Examples:
```default
monoinc(/host/system.localtime,#3,"strict")=0 #the system local time has not been increasing consistently
monoinc(/host/vfs.dir.count[/mnt/data/logs],24h,"weak")=0 #trigger if the file count has stagnated over 24 hours (expected to grow)
```
[comment]: # ({/09e06757-755c1821})
[comment]: # ({ce0040c4-178e3950})
##### nodata(/host/key,sec,) {#nodata}
Check for no data received.
Supported value types: *Integer*, *Float*, *Character*, *Text*, *Log*.
Returns: 1 - if no data received during the defined period of time; 0 - otherwise.
Parameters:
- See [common parameters](#common-parameters)
- **sec** - the period should not be less than 30 seconds because the history syncer process calculates this function only every 30 seconds; `nodata(/host/key,0)` is disallowed
- **mode** - if set to *strict* (double-quoted), this function will be insensitive to proxy availability (see comments for details)
Comments:
- the 'nodata' triggers monitored by proxy are, by default, sensitive to proxy availability - if proxy becomes unavailable, the 'nodata' triggers will not fire immediately after a restored connection, but will skip the data for the delayed period.
Note that for passive proxies suppression is activated if connection is restored more than 15 seconds and no less than 2 seconds later.
For active proxies suppression is activated if connection is restored more than 15 seconds later.
To turn off sensitiveness to proxy availability, use the third parameter, e.g.: `nodata(/host/key,5m,"strict")`; in this case the function will fire as soon as the evaluation period (five minutes) without data has past.
- This function will display an error if, within the period of the 1st parameter:
- there's no data and Zabbix server was restarted
- there's no data and maintenance was completed
- there's no data and the item was added or re-enabled.
- Errors are displayed in the *Info* column in trigger [configuration](/manual/web_interface/frontend_sections/data_collection/hosts/triggers).
- This function may not work properly if there are time differences between Zabbix server, proxy and agent.
See also: [Time synchronization requirement](/manual/installation/requirements#time-synchronization).
Example:
```default
nodata(/host/agent.ping,5m)=1 #trigger if no data has been received from Zabbix agent for 5 minutes
```
[comment]: # ({/ce0040c4-178e3950})
[comment]: # ({8fe0ae58-e8041c00})
##### percentile(/host/key,(sec|#num)<:time shift>,percentage) {#percentile}
The P-th percentile of a period, where P (percentage) is specified by the third parameter.
Supported value types: *Float*, *Integer*.
Parameters:
- See [common parameters](#common-parameters)
- **percentage** - a floating-point number between 0 and 100 (inclusive) with up to 4 digits after the decimal point
Examples:
```default
percentile(/host/net.if.in[eth0,bytes],1h,95)>1000000 #95th percentile network input (bytes/sec) over 1 hour has gone beyond a threshold (e.g., 1 MB/s)
percentile(/host/system.cpu.util,5m,95)>80 #95th percentile of CPU utilization user-time percentage has gone above 80
percentile(/host/icmppingsec[192.168.0.2],15m,95)>0.15 #most latency measurements are below 150 ms but the higher-end tail (top 5%) implies regular lag
percentile(/host/net.if.in[eth0,bytes],1h,50) #calculate the 50th percentile (the median value) of incoming network traffic for an hour; this yields a different result from avg() (the average), as percentile does not consider outlier values
(percentile(/host/net.if.in[eth0,bytes],1h,50)+percentile(/host/net.if.in[eth0,bytes],1h,51))/2 #calculate precise median value with an even number of values for an hour
```
[comment]: # ({/8fe0ae58-e8041c00})
[comment]: # ({f390d752-3b1de601})
##### rate(/host/key,sec<:time shift>) {#rate}
The average per-second increase in a monotonically increasing counter within the defined time period.
Supported value types: *Float*, *Integer*.
Parameters:
- See [common parameters](#common-parameters)
Functionally corresponds to '[rate](https://prometheus.io/docs/prometheus/latest/querying/functions/#rate)' of PromQL.
Examples:
```default
rate(/host/key,30s) #if the monotonic increase over 30 seconds is 20, this function returns 0.67.
rate(/host/net.if.in[eth0,bytes],5m)>500000 #the incoming interface traffic rate on eth0 has exceeded 500 KB/s over the past 5 minutes
rate(/host/app.requests.count,1m)>100 #the request count counter has risen at >100 requests per second in the last minute
```
[comment]: # ({/f390d752-3b1de601})
[comment]: # ({ba58f5e4-ce01d749})
See [all supported functions](/manual/config/triggers/expression#functions).
[comment]: # ({/ba58f5e4-ce01d749})