I have 23 years worth of house price data, and I run a run that looks at median(price) with one influencer. I am having problems understanding the data shown in Anomaly Explorer. It displays 23 coloured rectangles in a row, so each one covers about a year's worth of data. In the Anomaly timeline, if I click on the the box for 2007 it shows me the Max anomaly score is 82, but down in Anomalies, it shows an anomaly with max severity 86. How do these two numbers relate?
If I click on the box for propertytype T, then it says the Max anomaly score is 35, but the Anomalies list includes one with max severity 70. Again, what is the relationship between the two numbers, if any? (This is in 6.0.0.-rc1, but I have seen similar results in 5.6.3).
The slight difference in scores between the timeline and the anomalies table in the Anomaly Explorer is down to the components using different result types.
For each machine learning job, different types of results are generated - bucket results, influencer results and record results. The 'Overall' anomaly timeline uses the bucket-level anomaly scores. The 'view by' swimlane below, and the list of Top Influencers on the left use the influencer-level anomaly scores. The table of anomalies at the bottom uses the record-level anomaly scores.
The bucket level results provide the top-level view of the job, the influencer results show which entities were anomalous, whilst the record results provide details on the individual anaomlies.
More information on the Anomaly Explorer can be found in the docs here, whilst this page explains the different types of machine learning results.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
