# ML unexplained results

**URL:** <https://discuss.elastic.co/t/ml-unexplained-results/258097>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [December 9, 2020, 9:20am UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097 "2020-12-09T09:20:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Post date:** [December 9, 2020, 9:20am UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097/1 "2020-12-09T09:20:27Z")

</div>

Hello,

I'm having unexplained results in an anomaly detection job.

Attached an image, where you can see clearly that the typical value is 216 - it's almost a straight line. (for the past 2 months)

The model in the other hand, claims that the typical value is 199, and marks the data points in the picture as an anomalies.  
I'm not sure if it's the drop a little bit before, but it probably shouldn't change the typical that fast

the detector configuration is  
{  
"detector\_description": "high\_non\_null\_sum(count) by host partitionfield=client",  
"function": "high\_non\_null\_sum",  
"field\_name": "count",  
"by\_field\_name": "host ",  
"partition\_field\_name": "client",  
"detector\_index": 0  
}

Is there a way I can improve the results?

Thanks!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d3bf66ff49b6e8252b156e83ca375afbf71ae87c.png)

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 9, 2020, 3:09pm UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097/2 "2020-12-09T15:09:27Z")

</div>

Is the graph for a specific `host` and `client`? What would you see if you created a saved search, filtered for only that `host` and `client` and did a job with model bounds turned on? Might give us a clue as to what is happening.

Also, it is always best to let us know what version you're using when you post questions

---

<div class="post-metadata">

**Author:** ![liorg2](https://avatars.discourse-cdn.com/v4/letter/l/ed8c4c/32.png) [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Post date:** [December 9, 2020, 6:15pm UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097/3 "2020-12-09T18:15:19Z")

</div>

Thanks

I'm using 7.10, and will upload the chart in the morning

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2021, 6:15pm UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097/4 "2021-01-06T18:15:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.