I'm having unexplained results in an anomaly detection job.
Attached an image, where you can see clearly that the typical value is 216 - it's almost a straight line. (for the past 2 months)
The model in the other hand, claims that the typical value is 199, and marks the data points in the picture as an anomalies.
I'm not sure if it's the drop a little bit before, but it probably shouldn't change the typical that fast
the detector configuration is
"detector_description": "high_non_null_sum(count) by host partitionfield=client",
"by_field_name": "host ",
Is there a way I can improve the results?