View the results
View anomaly detection job results
After the anomaly detection job has processed some data, you can view the results.
!!! Depending on the capacity of your machine, you might need to wait a few seconds for the machine learning analysis to generate initial results.
Bucket results
When you view your machine learning results, each bucket has an anomaly score. This score is a statistically aggregated and normalized view of the combined anomalousness of all the record results in the bucket.
The machine learning analytics enhance the anomaly score for each bucket by considering contiguous buckets. This extra multi-bucket analysis effectively uses a sliding window to evaluate the events in each bucket relative to the larger context of recent events. The multi-bucket impact indicates how strongly the final anomaly score is influenced by multi-bucket analysis. The bounds for the expected values are calculated per bucket, but multi-bucket analysis is not limited by that scope.
If you have more than one anomaly detection job, you can also obtain overall bucket results, which combine and correlate anomalies from multiple jobs into an overall score.
Bucket results provide the top level, overall view of the anomaly detection job and are ideal for alerts. For example, the bucket results might indicate that at 16:05 the system was unusual. This information is a summary of all the anomalies, pinpointing when they occurred. When you identify an anomalous bucket, you can investigate further by examining the pertinent records.
Influencer results
The influencer results show which entities were anomalous and when. One influencer result is written per bucket for each influencer that affects the anomalousness of the bucket. The machine learning analytics determine the impact of an influencer by performing a series of experiments that remove all data points with a specific influencer value and check whether the bucket is still anomalous. That means that only influencers with statistically significant impact on the anomaly are reported in the results. For jobs with more than one detector, influencer scores provide a powerful view of the most anomalous entities.
!!! The anomaly scores of bucket, influencer and record results might differ slightly. This disparity occurs because for each anomaly detection job, there are bucket results, influencer results, and record results. Anomaly scores are generated for each type of result.