When I create an ml job, for example high_count by source.address with high cardinality influencers, for example on user.name. So I get a huge list of anomalies, but I can maximally show 50 in the anomaly timeline in the anomaly explorer. Are those 50 the ones with highest anomaly scores? Why do I find on the top of the list user names which seem to have 'less' anomalies then others more at the end of the list? How are the influencers ordered?
Most interesting for me are the ones with high actual values. Is there a way to only show the top 50 with the highest actual value in the anomaly explorer?