Analyze Anomaly Detections

Through the Portal, you can generate reports on the anomaly detection that are configured through the Event Manager. To create and review anomaly detection reports, select Reports > Anomaly Detection in the Portal menu.

Definition

In Discover, an anomaly detection is a stored calculation of deviations in the values of events, dimensions, or ratios. Using the recorded values and counts of the event or dimension, deviations are calculated based on the configured rolling window. The rolling window is defined by a parameter.

Calculation

The standard deviations for today are reported based on historical data. The dataset that is used for calculating anomaly detections are based on days of data that are retained and currently available and the mode that is used for calculating them.

Since daily deviations are calculated over a period of multiple weeks, you must create the daily anomalies and allow them to acquire at least two weeks worth of data before you generate Anomaly Detection reports. Otherwise, the data may not be meaningful.

Calculated for

Anomaly Detection report data can be calculated for:

  1. Events
  2. Events with dimension values

    In case of Anomaly Detection for dimensions, only the values that are displayed in a dimension's whitelist and are marked for Anomaly Detection tracking can be displayed in an Anomaly Detection report. For Anomaly Detection dimensions, you must create a whitelist of values and mark a set of values first.

  3. Ratios of Event Counts

    The creation and reporting on Hourly, dimension, and ratio anomalies is an enhancement that is available since version 12.1.1.

These values are then aggregated for storage on an hourly or daily basis. Storage of hourly anomalies requires more space.

The calculated anomalies can then be displayed in the Anomaly Detection page to graphically show variations in values or counts.

You can also apply dimensions to the Anomaly Detection report to filter the display to show only the Anomaly Detection information within a narrowed context.

By default, Anomaly Detections are not calculated and stored for events and dimensions.

  • If you want, you can enable auto-creation of anomaly detectionss for all currently active events and dimensions.
  • If auto-creation is not enabled, you must manually create anomaly detections for each event and dimension you want to track.