Ml detector with exclude frequent enabled

Although, you can have fine grained control over the exact field values you exclude with Filter lists and this may often represent the right choice, they do require some manual configuration and ongoing maintenance. There is also nothing to stop you using both a Filter list and exclude frequent. Note that setting the value to "none" simply means no values are excluded.

Exclude frequent is most likely to be useful in contexts where you know that frequently occurring events are not of interest. In this context, frequent means generates values in a significant fraction of time buckets. So whether a field's values are excluded is a function of the job's bucket length.

Assuming exclude frequent fits your needs, I would recommend them mainly in conjunction with a population analysis. For example, you might want to look for unusually high values of x for each entity, but ignore entities which are always active in the system you're observing.

2 Likes