{"id":10476,"date":"2026-09-20T07:20:00","date_gmt":"2026-09-20T05:20:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=10476"},"modified":"2026-10-26T13:45:17","modified_gmt":"2026-10-26T12:45:17","slug":"ga4-alerts-on-small-numbers-threshold-interval-and-statistical-noise","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ga4-alerts-on-small-numbers-threshold-interval-and-statistical-noise\/","title":{"rendered":"GA4 Alerts on Small Numbers: Threshold, Interval and Statistical Noise"},"content":{"rendered":"

A fall in add-to-cart events can indicate a broken checkout. Small event counts also fluctuate substantially without a technical fault. An alert therefore needs a suitable baseline, an explicit threshold and sufficiently current data.<\/p>\n

Three quantities need separate treatment: the observed deviation, the false-alarm probability and the probability of detecting a real fault. Crossing a threshold proves neither a technical failure nor the absence of chance. An alert that remains silent does not rule out a failure either.<\/p>\n

\n\"Poisson
Poisson example: relative distances for 2\u03c3, 3\u03c3 and 4\u03c3 lower control limits. No measured detection probabilities.<\/figcaption><\/figure>\n

A reproducible example for small counts<\/h2>\n

A Poisson count provides a simple model: events arrive independently at a constant rate. For an expected mean \u03bc, the standard deviation is \u221a\u03bc. With 25 expected events this is 5; with 2,500 it is 50. Relative variation falls from 20% to 2%.<\/p>\n

A simple lower control limit is L = \u03bc \u2212 3\u221a\u03bc. An alert fires when the observed count falls below L. The relative distance from the mean to this limit is 3\/\u221a\u03bc. The table assumes a known, stable expected value; estimating the baseline introduces additional uncertainty.<\/p>\n\n\n\n\n\n\n\n\n
Expected events per interval<\/th>\nDistance to the 3\u03c3 limit<\/th>\n<\/tr>\n<\/thead>\n
50<\/td>\n42.4 %<\/td>\n<\/tr>\n
200<\/td>\n21.2 %<\/td>\n<\/tr>\n
800<\/td>\n10.6 %<\/td>\n<\/tr>\n
3200<\/td>\n5.3 %<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

These percentages describe the distance to the control limit, not the smallest fault that can reliably be detected. With \u03bc = 50, the limit is approximately 28.8; integer counts of 28 or fewer trigger the alert. A real decline of one third reduces the new expected count to about 33.3. Some intervals can still fall below 28.8, while others remain above. A required detection probability needs a separate calculation.<\/p>\n

For \u03bc \u2264 9, this 3\u03c3 limit is zero or negative. No nonnegative count can fall below a limit of zero. This does not make outages inherently undetectable: an appropriately calibrated Poisson rule or a separate zero-event alert may be more suitable.<\/p>\n

A lower threshold changes both types of error<\/h2>\n

A limit at 2 rather than 3 standard deviations lies closer to the mean and responds to smaller deviations. The false-alarm probability also rises. For a known normal distribution, the one-sided probabilities below \u22122\u03c3 and \u22123\u03c3 are approximately 2.28% and 0.135%: a factor of almost 17.<\/p>\n

These normal-distribution values are not universal GA4 false-alarm rates. Small Poisson counts can only be whole numbers, such as 0, 1 or 2; overlapping windows and multiple metrics add dependencies and further opportunities for alerts. Settings therefore need evaluation against historical data that are as free from faults as possible. Frequent false alarms can reduce attention to genuine failures.<\/p>\n

Longer intervals: more data, later response<\/h2>\n

In the Poisson example, four times the expected count halves the relative distance to the same 3\u03c3 limit. A longer window collects more events but costs time. A short fault can also be diluted by unaffected periods within the same window.<\/p>\n\n\n\n\n\n\n\n\n
Window<\/th>\nExpected events<\/th>\nDistance to the 3\u03c3 limit<\/th>\n<\/tr>\n<\/thead>\n
5 min<\/td>\n16.7<\/td>\n73.5 %<\/td>\n<\/tr>\n
15 min<\/td>\n50.0<\/td>\n42.4 %<\/td>\n<\/tr>\n
1 h<\/td>\n200.0<\/td>\n21.2 %<\/td>\n<\/tr>\n
4 h<\/td>\n800.0<\/td>\n10.6 %<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The table assumes a constant 4,800 events per day. The first row represents 16.67 expected events before rounding. Even the five-minute window can signal a substantial outage; a universal boundary of 100% would be incorrect.<\/p>\n

Window length and alert delay are different quantities. The onset and duration of the fault, evaluation schedule, window boundaries and data availability also matter. A four-hour window may be too slow for a checkout but appropriate for a daily data delivery.<\/p>\n

A suitable baseline reduces avoidable variation<\/h2>\n

Shop traffic follows daily and weekly patterns. Campaigns, holidays, customer groups and consent also affect counts. Real data can therefore vary more than the Poisson model predicts. The tables deliberately include no unsupported universal adjustment for \u201creal traffic\u201d.<\/p>\n

Comparison with the same hour and weekday can account for recurring patterns. Trends, special campaigns and a small number of reference weeks remain potential sources of error. This adjustment is neither guaranteed to equal a fourfold traffic increase nor sufficient to remove all uncertainty.<\/p>\n

Ratios need a suitable definition<\/h2>\n

An add-to-cart rate can partly compensate for changes in traffic volume. For a simple binomial model, each session counts at most once: sessions with at least one add-to-cart event divided by all sessions under consideration. All add-to-cart events per session form a different metric; repeated events can produce values above one.<\/p>\n

For independent sessions with a constant probability p, the rate has an approximate standard deviation of \u221a(p(1\u2212p)\/n), where n is the number of sessions. With 50 qualifying sessions out of 1,000, the rate is 5% and the estimated standard deviation is about 0.69 percentage points. Small samples still fluctuate. With zero sessions, the rate is undefined.<\/p>\n

Rates can also vary by channel, time of day and customer group. A fault need not change the rate visibly straight away. A control limit for event counts therefore cannot be applied unchanged to every ratio.<\/p>\n

\n

Questions and answers<\/h2>\n

Why does four times the count halve the relative distance?<\/h3>\n

In the Poisson model, the standard deviation grows with \u221a\u03bc. The relative distance of a k\u03c3 limit is k\/\u221a\u03bc. Multiplying \u03bc by four doubles the denominator and halves the distance. This describes the limit, not an automatically doubled detection probability.<\/p>\n

Is a complete outage easier to detect?<\/h3>\n

Often, yes. Under a stable Poisson model, the probability of zero events is e\u2212\u03bc<\/sup>. For \u03bc = 17 this is approximately 4.14 in 100 million intervals; for \u03bc = 2 it is already about 13.5%. A zero-event alert therefore needs a time-appropriate expectation. Missing or delayed measurement data can also produce zero; an alert does not prove that the shop has failed.<\/p>\n

Does an hourly GA4 alert arrive after one hour?<\/h3>\n

Only with suitably available data and evaluation. Regular GA4 reports can receive additions hours later; Google gives 24 to 48 hours for general processing. The daily BigQuery export has no guaranteed fixed completion time. An apparent decline may therefore be an incomplete delivery.<\/p>\n

The Realtime API covers the last 30 minutes for standard properties and up to 60 minutes for Analytics 360. A single hourly query with a 30-minute window does not cover a complete hour. More frequent evaluations with clear boundaries and storage that avoids double counting require a dedicated implementation. BigQuery streaming is faster but is a best-effort service with possible gaps. For completed purchases, the shop\u2019s order table may be a more suitable control source.<\/p>\n

The data source affects coverage, definition and completeness as well as latency. Timestamps, consent, filters and late arrivals therefore belong in alert validation alongside the statistical threshold. Sources checked on 24 October 2026.<\/p>\n<\/div>\n

\n

Sources<\/h2>\n