Spikey data can be challenging to model, it's true. I am glad that you are seeing better results after a longer learning time, and I hope we can help you get an even better model fit.
What version of ML are you using? We have had some recent improvements to periodicity detection, so would be good to know if you are using the latest.
sum, it is not possible to specify that the value is always positive... we have not provided the configuration option, because it is not often true that the value is always positive (except in your case of course).
One caveat is when you are analysing a count of something, but the data is aggregated, and the ML function chosen is a sum. This sounds like your example for
sum(number of requests). This is really a count. Using the Adv Config, it is possible to create a job that uses
summary_count_field: number_of_request and then the detector can use a
count function. This will be aware that the value cannot be negative. I suggest to try this, as it is preferred to use a count function for counts.
The bounds plotted are a 2D simplified representation of a complex model. In some instances you may see an anomaly lying within the bounds. This can happen in cases where modes have been detected in the data. The plotted bounds (the shaded area) will span multiple modes. (It also useful to check that the chart aggregation interval is that same as the bucket span i.e. zoom in).
The anomalies on July 14th, occur approx 16 days after the model has begun to settle. This still may be a case of too little time to learn, although I would be interested to see the results from modelling the data as a count function.
You dataset is very interesting. If you are able to share it with us, we could help you further with configuration and provide more detailed explanations, and it may help us improve the modelling and configuration experience.