# "View By' field in 'Anomaly Explorer' window **URL:** \ **Category:** Elasticsearch\ **Created:** [November 2, 2017, 9:05am UTC](https://discuss.elastic.co/t/view-by-field-in-anomaly-explorer-window/106152 "2017-11-02T09:05:42Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![anomalyml](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@anomalyml](https://discuss.elastic.co/u/anomalyml)\ **Post date:** [November 2, 2017, 9:05am UTC](https://discuss.elastic.co/t/view-by-field-in-anomaly-explorer-window/106152/1 "2017-11-02T09:05:42Z")
Hi, In the 'Anomaly Explorer' window under 'Anomaly Timeline' section there is a field called "View By". It displays all influencer names along with the 'job ID' value. This is used to filter and display the anomaly analysis related to selected keywords. On clicking any one cell from anomaly analysis results, its corresponding plots and table containing detailed information is displayed below. I would like to know whether the values displayed below have any relationship to the "View By" keyword influencers. It appears that "View By" section is used just to visually display the results and have no relationship to the results displayed below. Upon clicking a cell from the result, it displays all the metrics from overall metrics list which caused the anomaly. Is this an intended behaviour? Thanks. ---
**Author:** ![Peter\_Harverson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_harverson/32/21057_2.png) [@Peter\_Harverson](https://discuss.elastic.co/u/Peter_Harverson)\ **Post date:** [November 2, 2017, 11:01am UTC](https://discuss.elastic.co/t/view-by-field-in-anomaly-explorer-window/106152/2 "2017-11-02T11:01:21Z")
Hi, Apologies if I have not understood your question correctly, but yes, there is a relationship between the 'view by' influencer clicked on in the Anomaly timeline with the information displayed in the charts and table below. The charts and table display anomalies which have the clicked on cell value as an influencer. For example, here in an analysis of AWS monitoring data, I have 'instance' as a partition field, and 'instance' and 'region' as influencers. Viewing by instance, when I click on the `instance: i-7db7c747` cell in the timeline, I see charts for the highest scoring anomalies in unique time series for `instance: i-7db7c747`, and the table is filtered to show all the anomalies in this job with `instance: i-7db7c747`: ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/f/dff1982252a6a752a89d49d4d46cb309c5da3695.png) The situation is slightly more complicated when I view by region, which is an influencer but not a partitioning field. I click on a cell for `region: eu-central-1`, and again the charts and table display data for anomalies which have `region: eu-central-1` as an influencer. Note however that the series plotted in the charts are filtered only for the partitioning entity(s) from the anomalies - which here is `instance`, and not `region` which is only an influencer. The labels used on the charts indicate the partitioning entity(s) of the time series, and not the influencer value. I guess this may be the source of the confusion? ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d3b067c7333d4d5bc0a9c52d4cca527652c6ec6.png) So the key thing to note is that the time series and labels used in the charts correspond only to the partitioning entities i.e. the `partition`, `by` or `over` fields used in the analysis. The 'view by' influencer is used to filter the anomaly records which are displayed in the charts - the partitioning entity(s) of these records are then ultimately used for plotting the time series and the labels. Hope that helps. It is not an easy concept to decribe. Please let me know if you need any further clarification. Regards Pete ---
**Author:** ![anomalyml](https://avatars.discourse-cdn.com/v4/letter/a/3ab097/32.png) [@anomalyml](https://discuss.elastic.co/u/anomalyml)\ **Post date:** [November 2, 2017, 12:08pm UTC](https://discuss.elastic.co/t/view-by-field-in-anomaly-explorer-window/106152/3 "2017-11-02T12:08:25Z")
Thanks for the explanation. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 30, 2017, 12:08pm UTC](https://discuss.elastic.co/t/view-by-field-in-anomaly-explorer-window/106152/4 "2017-11-30T12:08:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.