How to calculate burn rate for SLOs?
Yes, you are interpreting that correctly.
When you express your SLO as a percentage, you should express your error rate as a percentage too. So, in you example your error rate of 1 is 100%. That would make the equation:

(100-95/100) * 1 hour * 1 = 0.05 hours = 3 minutes

The period in that equation is the reporting period that you have chosen for your SLO. You have not mentioned what time period you chose. The examples in the workbook are 30 days. If you use a 30 day (720 hour) period in your example, you would consume approximately 0.14% of your error budget in the 3 minutes it takes for the alert to fire:

( 1 * 1 hour ) / 720 hours = 0.14%

The rates are different because they are measured over different time periods. (Note that the graph is using a logarithmic scale, so the actual error rate and the peak of the 5m measurement is 15%, not 10%.)


Consider what you would measure one minute after the errors started:


The 5m measurement would see 4 minutes of no errors plus one minute of 15% errors, which gives an overall error rate of 3%.
The 60m measurement would see 59 minutes of no errors plus one minute of 15% errors, which is just an overall error rate of 0.25%.

Then 5 minutes after the errors started:


The 5m measurement would see 5 minutes of 15% errors, so the overall rate would be 15%.
The 60m measurement would see 55 minutes of no errors plus 5 minutes of 15% errors, so the overall rate would be 1.25%. This is actually still too low to trigger the alert, so it will actually take more than 5 minutes to alert.

Using the equation from before, the actual time taken to alert is 5.76 minutes:

5.76 = (0.001/0.15) * 60 * 14.4


Your PromQL seems to be looking at the good events instead of the bad events, as the le="2" selector is for the bucket counting latencies less than or equal to (le) 2 seconds. You may want to create a separate "good_latency_rate1h" recording rule for the good events, and then use something like "(1-good_latency_rate1h) > (14.4*0.001)" for your alerts.