Normally, trigger functions look at the latest values—last() gets the last value and min(), max(), and avg()look at the specified time period, counting back from the current time. For some functions, we may also specify an additional parameter called time shift. This will make the function act as if we had traveled back in time; in other aspects, it will work exactly the same. One feature this allows is creating a trigger with relative thresholds. Instead of a fixed value such as 1, 5, or 10 for a CPU load trigger, we can make it fire if the load has increased compared to a period some time ago:

{A test host:system.cpu.load.avg(3600)}/
{A test host:system.cpu.load.avg(3600,86400)}>3 

In this example, we have modified the time period that we are evaluating—it has been increased to one hour. We have stopped comparing the result with a fixed threshold; instead, we are looking at the average values from some time ago—specifically, 86400 seconds, or one day, ago. Functionally, this expression checks whether the average CPU load for the last hour exceeds the average CPU load for the same hour one day ago more than 3 times.

This way, the CPU load can be 1, 5, or 500—this trigger does not care about the absolute value, just whether it has increased more than three times.

The second parameter for the avg() function we used was the time shift. To understand how it gets the values, let's assume that we have added a new item and that the time shift is set to 1 hour. It is 13:00:00 now, and a new value for the item has come in. We had previous values for 1 hour at 12:10:00, 12:20:00, and so on, up to 12:50:00. The time shift of one hour would get no values at all, as it would first step 1 hour back to 12:00:00 and then look for all the values 1 hour ago—but the first value we had was at 12:10:00:

As of Zabbix version 4.0.0, the following functions support the time shift parameter:

• avg()
• band()
• count()
• delta()
• forecast()
• last()
• max()
• min()
• percentile()
• strlen()
• sum()
• timeleft()