Actual values in ML single metric viewer doesnt match the raw data

In th first image the actual is 2.987, but the values displayed in the Y axis, and the value displayed in the second image, that is next to this anomaly , aren't near the value of the actual, and it seems the typical is wrong too



I found this explanation from Rich

What is going on? or Im reading the graph wrong?

elastic version 7.5

It is difficult to say for sure without seeing your job configuration and knowing the product version.

My best guess, based on the information you provided, would be that this is an older version of the product and you are partitioning the data to perform anomaly detection. Historically, we would show the mean of all partition values in the time bucket in the single metric viewer (SMV), i.e. before version 7.6. In this case, when you hovered over an anomaly we would show you the actual and typical for just the partition which generated that anomaly in the tooltip. This is a subset of the data and can have a very different value to the mean of all partition values. When you hover over a time bucket where there isn't an anomaly it just returns the value of the mean for that time bucket.

We have now changed this behaviour so that you have to select a partition to view data in the SMV if you've performed a partitioned analysis and it shows you just the actual values for that partition. Before 7.6 you can still see this by entering the partition value of interest in the selection box at the top of the chart. Generally, for partitioned analyses it is better to use the anomaly explorer and drill down from there to see specific partitions' anomalies. This opens the SMV with the correct selection.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.