# Advanced Configuration Machine Learning **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-machine-learning\ **Created:** [September 29, 2022, 10:42am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446 "2022-09-29T10:42:38Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [September 29, 2022, 10:42am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/1 "2022-09-29T10:42:38Z")
I want to use high count function for a field , for this i select Advanced Confiugration wizard **Machine Learning \> Anomaly Detection \> Create Job \> Advanced configuration** ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/16bafcc17807c9c9d67bf6d2e7a89b5574909958.png) Here i am using high\_count detector for test field , i want to find anomaly in this field and i have another field called verb.keyword which contain service name , so basically verb.keyword (service name) based anomaly detection on high\_count of test value (decline count) While selecting detector it shown me two options `by_field` and `over_field` ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/2/92f83b5300bb4762819f2a2efcea7ec181a05e51.png) I randomly selected By field and i don't know the difference between by field and over field in influencer i choose verb.keyword ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b42fab5d5cb8607d0a335dcb8cbde14d72bdbaa2.png) How can i know what i have to choose in by\_field or in over\_field is there any option where i can choose high\_count becuase i cant see in multi-metric. ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [September 29, 2022, 1:53pm UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/2 "2022-09-29T13:53:17Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/9/8/984d8ca1c35d08b10edf70b69e22c7d95688b5ea.png) And what is this `found for` mean here in above image ---
**Author:** ![dkyle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dkyle/32/59114_2.png) [@dkyle](https://discuss.elastic.co/u/dkyle)\ **Post date:** [September 29, 2022, 2:36pm UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/3 "2022-09-29T14:36:12Z")
> How can i know what i have to choose in by\_field or in over\_field Choose an over\_field when you want to perform a population analysis, choose a by\_field when you want to split your data by a value in another field. You can learn more about population analysis at [Configuring population analysis | Machine Learning in the Elastic Stack [master] | Elastic](https://www.elastic.co/guide/en/machine-learning/master/ml-configuring-populations.html) > is there any option where i can choose high\_count becuase i cant see in multi-metric. The `high_count` function is available in the multi metric wizard, first pick the option `High count(Event rate)` in the field picker ![Screenshot 2022-09-29 at 15.20.34](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bdc1687eb0ab3f5741312467dac635f7a097261.png) then pick a split field. From the description of your data I suggest using `verb.keyword` as the split field. The `count` functions work with event rates, i.e. the number of occurrences of the event in a time period. high count split by `verb.keyword` will find anomalies where there is an unusually high number of events for any of the values of `verb.keyword`. What is in the `test` field? Is it a numerical value? If `test` is a number then consider the `high_sum` function on the test field split by `verb.keyword` ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [September 29, 2022, 3:37pm UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/4 "2022-09-29T15:37:22Z")
Hi David, Test is a number field and we want to apply high count. Is there any difference between high\_count and High Count(Event rate) ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [September 29, 2022, 6:41pm UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/5 "2022-09-29T18:41:21Z")
Thank you @dkyle , can you please tell me what this graph depict ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a4b1f8671b1ec52bf3b9580d8606469751d96285.png) In this job i applied **high\_count by test over "verb.keyword"** and also choose verb.keyword as an inluencer What this above graph shoowing, i know upper bound and lower bound but what does these(upper and lower bound) means in above graph And one thing i learned that in single metric viewer we get slider to view anomaly and in Anomaly Explorer we can see as a table . So am i right about **Single Metric Viewer** and **Anomaly Explorer** ---
**Author:** ![dkyle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dkyle/32/59114_2.png) [@dkyle](https://discuss.elastic.co/u/dkyle)\ **Post date:** [September 29, 2022, 7:43pm UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/6 "2022-09-29T19:43:25Z")
> Is there any difference between high\_count and High Count(Event rate) No they are both the same function but the text description is slightly different I recommend reviewing the [documentation](https://www.elastic.co/guide/en/machine-learning/current/ml-functions.html) for the different anomaly detector functions. Count functions are described as "Count functions detect anomalies when the number of events in a bucket is anomalous.". If `test` is a numerical field and you are looking for anomalies in the value of `test` then try the [metric](https://www.elastic.co/guide/en/machine-learning/current/ml-metric-functions.html) function. In the chart above you see a plot of the number of documents over time that contain the `verb.keyword` field with the value `REPL_BACKLOG_REPORT`. The count goes from 1 to 3, per bucket interval there is nothing particularly interesting here. I am guessing that analysing the value of `test` with a metric function will be more interesting. ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [September 30, 2022, 3:37am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/7 "2022-09-30T03:37:39Z")
How can you see the bucket when you said > The count goes from 1 to 3, per bucket interval there is nothing particularly interesting here. ---
**Author:** ![dkyle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dkyle/32/59114_2.png) [@dkyle](https://discuss.elastic.co/u/dkyle)\ **Post date:** [September 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/8 "2022-09-30T07:52:31Z")
![Screenshot 2022-09-30 at 08.51.03](https://us1.discourse-cdn.com/elastic/original/3X/5/9/59fcc2ce83cf9b9709dc5b85885b90ebfa10dbb7.png) The bucket span or interval is 15minutes. Bucket span is a configuration option when creating the job ---
**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Post date:** [September 30, 2022, 7:58am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/9 "2022-09-30T07:58:43Z")
@dkyle thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 28, 2022, 7:58am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446/10 "2022-10-28T07:58:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.