Report display issues

When you are creating an Anomaly Detection report, you are relying on the successful capture, aggregation, and storage of the underlying data. The variations in this data are then calculated and stored, becoming available for reporting. While you use the Anomaly Detections page to add anomalies, as soon as they are created, or to combine multiple anomalies for any focus date, the underlying data might not support the report.

No data in the report

It can take at least two weeks after an anomaly is created before it is populated with sufficient useful data to populate an Anomaly Detections report. If the report is blank, the combination of anomalies and focus date results in no available data at all. If there is no data in the report, change the date range. If you cannot find a date that contains anomaly data, you must review the date against the creation date for the anomaly in the Change History dialog. Through the Discover Report Builder, you can create a simple report to verify that the source events or dimensions are populated with data for the selected focus date.

If the report contains multiple anomalies and one of the anomalies lack data, the data for the other anomaly is still displayed. Try removing the anomaly that contains data to see whether the preceding error message is then displayed.

If you cannot find the anomaly to add, verify that you selected the correct type of anomaly to add. Only Hourly anomalies are displayed if you are using Hourly anomalies in the report page.

Report display limits

If you add an Anomaly Detection or dimension, and the total number of potential rows to be displayed in the detail table exceeds 1,000 rows, a warning appears indicating that the report performance can be affected. If you ignore the warning, the Report Builder attempts to query and display the report. If this row limit is indeed exceeded in the returned data, the report is not displayed. If the warning is canceled, the proposed changes are maintained so that you can apply filtering to reduce the scope of the report.