# Machine Learning low sum is not working as expected

**URL:** <https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [September 27, 2022, 4:49pm UTC](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292 "2022-09-27T16:49:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ann\_Abbott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ann_abbott/32/98018_2.png) [@Ann\_Abbott](https://discuss.elastic.co/u/Ann_Abbott)\
**Post date:** [September 27, 2022, 4:49pm UTC](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292/1 "2022-09-27T16:49:42Z")

</div>

Hi,

I am trying to use machine learning - anomaly detection.  
Whenever I try to use regular sum function it detects both low and high anomalies.  
High sum is also working expected since it's only showing high anomalies.  
The problem is low sum. I only want to see when there are low anomalies but it seems like both high and low are showing. Is there a way to only see lows?

 ![Screen Shot 2022-09-27 at 9.49.06 AM](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f6e8b49135202f7fdff48da84cc8ecbb15a9b178.png)

---

<div class="post-metadata">

**Author:** ![sophie\_chang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sophie_chang/32/18008_2.png) [@sophie\_chang](https://discuss.elastic.co/u/sophie_chang)\
**Post date:** [September 27, 2022, 7:08pm UTC](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292/2 "2022-09-27T19:08:54Z")

</div>

From the screenshot, the anomaly icon is a cross, rather than a circle. This indicates that the anomaly is multi-bucket ... which means that there is a low sum anomaly across the previous ~12 buckets (~6 hours), however the individual bucket (30 mins) would not have been anomalous.

We record actual and typical values for each 30 mins bucket as standard, so the overlay of multi-bucket anomalies is very difficult to plot on a single chart and it is not easy to see (unless you know about them already).. if you have any idea how we could have made this clearer, please feel free to let us know.

More info on multi-bucket [Interpreting multi-bucket impact anomalies using Elastic machine learning features | Elastic Blog](https://www.elastic.co/blog/interpreting-multi-bucket-impact-anomalies-using-elastic-machine-learning-features)

Hope that helps  
Sophie

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2022, 7:09pm UTC](https://discuss.elastic.co/t/machine-learning-low-sum-is-not-working-as-expected/315292/3 "2022-10-25T19:09:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.