# Anomaly detection Population Job **URL:** \ **Category:** Kibana\ **Created:** [September 6, 2023, 1:44pm UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451 "2023-09-06T13:44:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![NamithaJ97](https://avatars.discourse-cdn.com/v4/letter/n/c37758/32.png) [@NamithaJ97](https://discuss.elastic.co/u/NamithaJ97)\ **Post date:** [September 6, 2023, 1:44pm UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/1 "2023-09-06T13:44:29Z")
country state child\_count a a\_s1 302 a a\_s2 310 a a\_s3 308 a a\_s4 21 b b\_s1 14 b b\_s2 16 b b\_s3 17 b b\_s4 218 I have a population anomaly detection job to find the anomalies in child\_count. The Table shown above is the type of data which we are processing. Here I want to find the anomalies in child\_count across each state. Here as you can see for the country 'a' I have child\_count of the range 300 and one with child\_count '21' which can be treated as an anomlay(compairing it with other values of country 'a') and for country 'b' we have child\_count of range 14 to 17 and one with child\_count 218 which is also an anomaly.There is no other anomalies in this case. But after processing the data using population job where the entire data is splitted by 'state', it considers the entire data of one country as anomalies by comparing it with first country. But I don't want to compare child\_count of one country with another I just want to compare it with the previous child\_count of the same country. How can I achieve this (The actual data contains high cardinality value that's why I used population job here) ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [September 6, 2023, 6:06pm UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/2 "2023-09-06T18:06:37Z")
First and foremost - does your data also include a timestamp? If the data isn't really temporal in nature, then you should consider doing an [Outlier Detection](https://www.elastic.co/guide/en/machine-learning/current/ml-dfa-finding-outliers.html) analysis rather than a Population Analysis. ---
**Author:** ![NamithaJ97](https://avatars.discourse-cdn.com/v4/letter/n/c37758/32.png) [@NamithaJ97](https://discuss.elastic.co/u/NamithaJ97)\ **Post date:** [September 7, 2023, 4:49am UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/3 "2023-09-07T04:49:26Z")
My data include timestamp . So can I make use of outlier detection ---
**Author:** ![NamithaJ97](https://avatars.discourse-cdn.com/v4/letter/n/c37758/32.png) [@NamithaJ97](https://discuss.elastic.co/u/NamithaJ97)\ **Post date:** [September 8, 2023, 7:36am UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/4 "2023-09-08T07:36:48Z")
please reply @richcollier ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [September 11, 2023, 4:38pm UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/5 "2023-09-11T16:38:02Z")
It depends. Outlier detection is analysis mostly irrespective of time. Your data can be data from a certain time period (i.e. House sales prices from 2022). But, population analysis is meant to be a moment-by-moment analysis (essentially comparing every entity witnessed in an arbitrary time window - as in "last hour" or "last day") and comparing those entities against a learned "global" model of all entities that has been built up over time (ever since the Population Analysis job has been running). ---
**Author:** ![NamithaJ97](https://avatars.discourse-cdn.com/v4/letter/n/c37758/32.png) [@NamithaJ97](https://discuss.elastic.co/u/NamithaJ97)\ **Post date:** [September 15, 2023, 6:05am UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/6 "2023-09-15T06:05:35Z")
ok thanks. Can I use multiple arguments inside "by\_field\_name " as I want to split the data based on 3 field values(state,country,district) and analyze the splits with respect to their own history in population job. "detectors": [ { "detector\_description": "min(child\_count) by "country.keyword"", "function": "min", "field\_name": "child\_count", "by\_field\_name": ["country.keyword,state.keyword,district.keyword"], "detector\_index": 0 } ] But the above one throwing an error. How can I give multiple argument and split the analysis based on that ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [September 18, 2023, 12:07pm UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/7 "2023-09-18T12:07:39Z")
There are two fields that allow splits: `partition_field_name` `by_field_name` But, if you need to split more, you'll have to rely on some other methods. Namely, you'll have to create a [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html) that is a concatenation of two (or more) fields - something like: [Concatenate two fields by elastic content share](https://elastic-content-share.eu/runtime-fields/concatenate-two-fields/) Then choose the runtime field as the field to split on. Word of caution: don't split the data too thin - you might wind up with a very small number of unique combinations and thus have sparse data. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 16, 2023, 12:08pm UTC](https://discuss.elastic.co/t/anomaly-detection-population-job/342451/8 "2023-10-16T12:08:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.