What do "actual" and "typical" columns mean in the Anomaly explorer?


I am analyzing data with the Elastic X-Pack.
What does the "actual" and "typical" columns mean?
Is it the severity? the count of emails?

I do not understand.

Thank you

actual is the value that was observed for that detector in that particular bucket.

typical is the value that the model is expecting given past behavior.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.