Summary

Adds a new example to the Alert Examples section in REFERENCE.md demonstrating how to compare current metric values against historical baselines using the two-alert pattern.

Changes

• Added Example 4: Comparing Current vs Historical Values after Example 3 (Predictive Disk Full Alert)
• Demonstrates the two-alert pattern required when comparing values (only ONE lookup line allowed per alert)
• Shows how to create a historical baseline alert (1-hour average)
• Shows how to reference the baseline in a current value alert using $alert_name syntax
• Explains cross-alert value references and practical use cases
• Renumbered subsequent examples (Network Packet Drops → Example 5, Z-Score → Example 6, etc.)

Motivation

Users often want to understand why an alert fired by comparing the current value against historical context (e.g., "current: X, average: Y"). This example addresses a common misconception that you can use multiple lookup lines in a single alert, showing the correct pattern of using separate coordinated alerts.

Testing

• Example follows existing documentation style and formatting
• All references to alert variables use correct syntax ($alert_name)
• Example clearly states the single-lookup constraint

Audit Context

Session Query (Original):

ну так и как мне вывести, почему пришёл алерт? например:
сейчас значение: ХХХ
в среднем: УУУ

такое возможно передать в алерт?

Session Query (English Translation):

So how can I display why an alert came? For example:
current value: XXX
on average: YYY

Is it possible to pass this in an alert?

Decision Verdict: surgical_edit

The user wanted to know how to display dynamic values (current vs average) in alert messages. The documentation now provides a clear example showing that:

1. Only ONE lookup line is allowed per alert
2. To compare current vs historical values, you must create separate alerts
3. Values can be referenced between alerts using $alert_name syntax
4. This pattern enables meaningful comparisons in calc expressions and warn/crit thresholds

Summary by cubic

Adds a new example to REFERENCE.md that compares current metric values to a 1h baseline using the two-alert pattern, and shows how to include both numbers in alert messages. Clarifies the single lookup rule and demonstrates variable interpolation in the info line with cross-alert references.

• New Features
  • Added “Example 4: Comparing Current vs Historical Values” with two alerts: 1h baseline and current 1m value.
  • Demonstrates cross-alert references ($alert_name) in calc/warn/crit and in info to output “current: X, average: Y”.
  • Notes the same-chart context requirement for references.
  • Renumbered following examples (Network Packet Drops → Example 5, Z-Score → Example 6, etc.).

^{Written for commit 2c9a769. Summary will update on new commits.}