Order of Influencers in anomaly timeline overview?

[willemdh]

Hello,

When I create an ml job, for example high_count by source.address with high cardinality influencers, for example on user.name. So I get a huge list of anomalies, but I can maximally show 50 in the anomaly timeline in the anomaly explorer. Are those 50 the ones with highest anomaly scores? Why do I find on the top of the list user names which seem to have 'less' anomalies then others more at the end of the list? How are the influencers ordered?

Most interesting for me are the ones with high actual values. Is there a way to only show the top 50 with the highest actual value in the anomaly explorer?

Grtz

Willem

[richcollier]

Take a look at this blog which describes how the scoring works and what the grid of influencers is telling you.

In a nutshell, it tells you which entities are the most unusual over the time-range you select. The most unusual bubble to the top of the grid

[willemdh]

Thanks for the link. That clarifies somewhat.