# Order of Influencers in anomaly timeline overview?

**URL:** <https://discuss.elastic.co/t/order-of-influencers-in-anomaly-timeline-overview/231862>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 9, 2020, 7:59pm UTC](https://discuss.elastic.co/t/order-of-influencers-in-anomaly-timeline-overview/231862 "2020-05-09T19:59:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 9, 2020, 7:59pm UTC](https://discuss.elastic.co/t/order-of-influencers-in-anomaly-timeline-overview/231862/1 "2020-05-09T19:59:58Z")

</div>

Hello,

When I create an ml job, for example high\_count by source.address with high cardinality influencers, for example on user.name. So I get a huge list of anomalies, but I can maximally show 50 in the anomaly timeline in the anomaly explorer. Are those 50 the ones with highest anomaly scores? Why do I find on the top of the list user names which seem to have 'less' anomalies then others more at the end of the list? How are the influencers ordered?

Most interesting for me are the ones with high actual values. Is there a way to only show the top 50 with the highest actual value in the anomaly explorer?

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 10, 2020, 11:02am UTC](https://discuss.elastic.co/t/order-of-influencers-in-anomaly-timeline-overview/231862/2 "2020-05-10T11:02:34Z")

</div>

Take a look [at this blog](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works) which describes how the scoring works and what the grid of influencers is telling you.

In a nutshell, it tells you which entities are the most unusual over the time-range you select. The most unusual bubble to the top of the grid

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [May 10, 2020, 4:58pm UTC](https://discuss.elastic.co/t/order-of-influencers-in-anomaly-timeline-overview/231862/3 "2020-05-10T16:58:24Z")

</div>

Thanks for the link. That clarifies somewhat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2020, 4:58pm UTC](https://discuss.elastic.co/t/order-of-influencers-in-anomaly-timeline-overview/231862/4 "2020-06-07T16:58:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.