Hi Ben, both detectors are using "by" and "partition" fields (low cardinality, less than 10) and bucket span is 15 minutes. I agree that they might all be frequent, but was confused why they are detected as high severity if they are frequently happening. As @richcollier and @Tom_Veasey suggested I might go with a mixed model approach.
thanks