# Anomaly Detection - Can' Forecast on Influencer

**URL:** <https://discuss.elastic.co/t/anomaly-detection-can-forecast-on-influencer/382754>\
**Category:** Kibana\
**Created:** [October 15, 2025, 4:57pm UTC](https://discuss.elastic.co/t/anomaly-detection-can-forecast-on-influencer/382754 "2025-10-15T16:57:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [October 15, 2025, 4:57pm UTC](https://discuss.elastic.co/t/anomaly-detection-can-forecast-on-influencer/382754/1 "2025-10-15T16:57:36Z")

</div>

Hello,

I created a anomaly detection job on memory utilization. I am using host.name as an influencer  
I see the forecast but when I run it doesn’t allow me to focus on an influencer?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3c64a5cb100c5c7b2117e780cd6c6b7bc316fd28.png)

My goal: I am trying to predict when memory will fill up on hosts

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [October 15, 2025, 9:58pm UTC](https://discuss.elastic.co/t/anomaly-detection-can-forecast-on-influencer/382754/2 "2025-10-15T21:58:19Z")

</div>

Hello, I figured it out:

Regardless of whether you have an influencer, you need to set a partition field:

```json
PUT _ml/anomaly_detectors/disk_utilization_by_host

{

  "description": "Anomaly detection for disk utilization per host",

  "analysis_config": {

    "bucket_span": "15m",

    "detectors": [

      {

        "function": "max",

        "field_name": "system.filesystem.used.pct",

        "partition_field_name": "host.name"

      }

    ],

    "influencers": ["host.name"]

  },

  "data_description": {

    "time_field": "@timestamp"

  },

  "datafeed_config": {

    "indices": ["metricbeat-*", "metrics-*"],

    "query": {

      "bool": {

        "filter": [

          { "exists": { "field": "system.filesystem.used.pct" } }

        ]

      }

    }

  }

}

```

Which leads to this;

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/69be299674e07985dbbaaf0865014f1672fba131.png)