Anomaly Detections page

In the Anomaly Detections page, you can add detectionss to the report, which is immediately refreshed to display the anomalies for the selected focus date.

Report configuration

Reports can be configured for dates, time periods, and dimensions:

  • A report can be configured to display anomalies for over a range of dates. Report data includes detections that are calculated for the preceding rolling window.
  • In each report, you can display Hourly or Daily anomalies, but not both.
  • All anomaly detections that are not based on dimensions are generated from the No Dimension Report Group for the event.

    Depending on the volume of data, the tracking of anomaly detections can require significant data storage. To constrain the storage requirements for anomaly detections, Discover requires that you manually choose to track each detection.

  • If a dimension is already added, the list of available Anomaly Detections is filtered to show only those detections that can be used with the included dimension.

Anomaly Detections page interface

In the Anomaly Detections page:

  • The type of anomaly you are adding is listed in the title bar.
  • Both inactive and active anomalies are displayed.
  • To filter the display, enter a text string in the Filter textbox and press RETURN. The Anomaly Detection Selector is refreshed to display only the anomalies whose name includes the string you entered.
  • To select an anomaly, click the check box next to its name.
  • To add the selected anomalies to the report, click Select.
  • To cancel, click Cancel.
  • If the added anomaly contains a dimension, the dimension is listed after the colon. For example, the dimension in the anomaly Network Time : URL is the URL dimension.

Anomaly Detections page actions

In the Anomaly Detections page, you can:

  • Add an anomaly to the report. You can add anomalies through the left panel. Click Add Anomaly Detection. If the report is empty, you can select the type of anomaly to add (Add Hourly Anomaly or Add Daily Anomaly ).
  • Add dimensions to a report to filter Anomaly Detection data by specific contextual values.
  • View additional information about a Anomaly Detection is available in the tooltip.
  • Change the focus date range for the report.

When a anomaly is added to the report, the window is automatically updated. Report commands are available in the toolbar above the report window.

After you add either a daily or hourly anomaly to a report, you can display only anomalies of that type. To report on the other type of anomalies, you must configure a new report.

Anomaly Detection context menu

After an Anomaly Detection is added to the chart, the following menu items are available in the drop-down next to the Anomaly Detection in the left panel:

Menu Item
Description
Rename
Rename the Anomaly Detection. This renaming applies to the report only; the source data name is not changed.
Remove
Remove the Anomaly Detection from the report.

Hourly versus Daily anomalies

In each report, you can display Hourly or Daily anomalies, but not both. When hourly anomalies are selected, only Hourly anomalies can be used in the report.

  • If you are using Hourly anomalies, you can configure the hour that is displayed in the report.
  • To switch between Daily and Hourly anomalies or vice versa, clear the report.

Anomalies can be created for event values, dimensional values, or ratios.

Top N filtering

Optionally, you can configure the report to display a selected number of the topmost anomalies, which are based on the absolute value of the calculated deviation. For example, suppose that your report displays the following anomalies: