How to correctly write an expression for a Zabbix trigger?

Question

FreeBSD

There is a log file. From it the value is taken into the data element.
Sometimes this value increases sharply in plus - we are not interested in this, sometimes this value can sharply change into a minus. It is the changes in the minus that interest us. Moreover, you need to create several triggers for different time periods. Let's say the value has fallen by more than 2000 in the last 3 hours, by more than 5000 in the last 6 hours.
At the moment, I've implemented these triggers using delta, but as you'd expect, when the value jumps to plus, the triggers fire as well.

Answer 1

last 3 hours

The trigger function is time_shift. We compare the value that was N hours ago, and just received. true if the difference is greater than desired