# Exclude samples with probe\_success == 0 from avg\_over\_time( probe\_duration\_seconds )

**URL:** <https://discuss.prometheus.io/t/exclude-samples-with-probe-success-0-from-avg-over-time-probe-duration-seconds/819>\
**Category:** PromQL\
**Created:** [March 2, 2022, 1:20pm UTC](https://discuss.prometheus.io/t/exclude-samples-with-probe-success-0-from-avg-over-time-probe-duration-seconds/819 "2022-03-02T13:20:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rdiez](https://avatars.discourse-cdn.com/v4/letter/r/7c8e57/32.png) [@rdiez](https://discuss.prometheus.io/u/rdiez)\
**Post date:** [March 2, 2022, 1:20pm UTC](https://discuss.prometheus.io/t/exclude-samples-with-probe-success-0-from-avg-over-time-probe-duration-seconds/819/1 "2022-03-02T13:20:12Z")

</div>

Hi all:

I am trying to use the following alert rules:

> **[Awesome Prometheus alerts](https://awesome-prometheus-alerts.grep.to/rules.html)**
>
> Collection of alerting rules

Alert 1) “Blackbox probe failed”  
expr: probe\_success == 0

Alert 2) “Blackbox slow probe”  
avg\_over\_time( probe\_duration\_seconds[1m] ) \> 1

The trouble is, every time a probe fails, I am getting the slow alert too. I would like to mask that slow alert out, but the avg\_over\_time() is introducing a delay which makes it difficult. Besides, I do not know enough about Prometheus yet.

I believe that, when a black box probe fails, its probe\_duration\_seconds equals the probe’s timeout.

I tried to modify the avg\_over\_time rule to leave out those periods where probe\_success == 0:

probe\_success and ( avg\_over\_time( probe\_duration\_seconds[30m] ) \>= 3 )

But that fails to parse. I do know enough to work this out with avg\_over\_time().

The idea is that only those values in probe\_duration\_seconds when probe\_success == 1 should be taken into consideration.

Maybe we could completely ignore those 30m periods where some probes failed at all. After all, we want to measure performance only on those periods where everything is working normally.

Can someone help write a proper alert rule to that effect?

Thanks in advance,  
rdiez