Verified against ChatGPT · 2026-08-13
Triage a data anomaly before you page anyone about it
Works through a spotted anomaly in a metric or dataset to separate a real operational problem from a data-pipeline glitch or reporting artifact, before escalating it to a team that will drop what they're doing.
The prompt
Ready to copy — highlighted parts are example details you can swap.
I've spotted something anomalous in a metric and need to triage it before deciding whether to escalate — escalating a false alarm burns trust with the team, but sitting on a real issue is worse. Work through this like an on-call analyst would. THE ANOMALY Checkout completion rate dropped from a typical 68% to 41% starting at roughly 2:15pm today, still at that level as of now. WHAT'S NORMAL FOR THIS METRIC Checkout completion rate typically ranges 65-72% on weekdays, with a known dip to around 58% during major promotional traffic spikes. RECENT CHANGES THAT COULD BE RELATED A payment provider integration was updated at 2:00pm today; no marketing campaigns launched today. WHO WOULD GET PAGED IF THIS IS ESCALATED The on-call engineering lead, who would be pulled off other work immediately if paged. Work through these in order, and stop early with a recommendation the moment one of them gives a clear answer rather than always running the full sequence: 1. Rule out a reporting/pipeline artifact first: does the anomaly's shape look like something a real business event would produce, or does it look like a classic pipeline symptom (a value dropping to exactly zero, a sudden duplicate spike, a metric that stops updating rather than moving)? A hard cliff to exactly zero is a very different signal from a gradual real decline. 2. Check whether the recent changes given plausibly explain it, and how directly — a deploy that touched this exact system an hour before the anomaly started is a much stronger candidate than an unrelated change from three days ago. 3. Assess severity if this turns out to be real: is this the kind of anomaly that gets worse the longer it's unaddressed (an active outage or data-loss issue) or one that's already fully realized and just needs investigation on a normal timeline (a one-time data entry error)? 4. Recommend one of: escalate now to the person/team named, investigate further yourself first and only escalate if a specific check comes back positive (name that check), or downgrade — log it as noise and move on. WHAT NOT TO DO Do not recommend escalation just because something looks unusual — plenty of anomalies are explainable, non-urgent, or artifacts, and treating every anomaly as page-worthy is how alert fatigue starts. OUTPUT FORMAT 1. Pipeline-artifact check: result and reasoning 2. Recent-change correlation: result and how directly it explains the anomaly 3. Severity-if-real assessment 4. Recommendation: escalate now / investigate further first (name the specific check) / downgrade as noise 5. If escalating, the exact one-paragraph summary to send, written so the recipient understands the issue and its urgency without needing to ask a follow-up question first
Customize
Optional — swap in your own details for the highlighted parts above.
Why this works
Ordering the checks with pipeline-artifact elimination first, and permitting an early stop rather than requiring the full sequence every time, mirrors how an experienced on-call analyst actually triages, and matters here because a model asked open-endedly to "analyze this anomaly" has no default preference for checking the boring, unglamorous explanation (broken pipeline) before the interesting one (a real business event), and will often jump straight to narrative explanations that make for a better-sounding answer even when a hard cliff to exactly zero is a textbook pipeline symptom that a real business event essentially never produces on its own. Requiring the recent-change correlation to be scored by directness (an hour-old deploy to this exact system versus a three-day-old unrelated change) rather than just listed as "could be related" prevents the common failure where a model surfaces every plausible-sounding recent change with equal weight, which is functionally useless to someone trying to decide what to actually investigate first — the payment-provider deploy fifteen minutes before the drop should visibly outrank a marketing change that didn't even happen. The explicit ban on escalating just because something "looks unusual" targets alert fatigue directly: an on-call system or analyst that escalates every anomaly regardless of severity trains the receiving team to deprioritize or ignore future alerts, so the model needs to be told explicitly that recommending escalation is a cost with its own downside, not a free default safe choice. Requiring the exact escalation message to be drafted, not just a recommendation to escalate, matters because the person being paged needs to understand severity and likely cause in the first sentence without a back-and-forth, and a vague "something's wrong with checkout, can you look" message wastes the exact response time the escalation was meant to protect.
What you get back
Pipeline-artifact check: the drop is a step change to a new sustained level (68% to 41%), not a cliff to zero and not a stopped-updating symptom, which looks more consistent with a real behavioral change than a pipeline break. Recent-change correlation: the payment provider integration update at 2:00pm is a very strong candidate — it started roughly 15 minutes before the anomaly and touches the exact system involved. Severity: this looks like an active, ongoing issue that gets worse the longer it runs, since every additional minute means more lost completions. Recommendation: escalate now to the on-call engineering lead. Escalation message: "Checkout completion rate dropped from ~68% to 41% starting ~2:15pm today and hasn't recovered — timing lines up closely with the 2:00pm payment provider integration update, which is the leading suspect. Recommend checking that integration first."
Verified against
ChatGPT GPT-5.1 · 2026-08-13
Changelog
- 2026-08-13 — Initial publish, verified against ChatGPT GPT-5.1.
Need this built into your business?
If a prompt isn't enough — what Scult builds, built and maintained for you — that's Scult's day job.
EXPLORE WHAT SCULT BUILDS
