# Will influencer change the way a model might detect and anomaly? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-machine-learning\ **Created:** [March 3, 2023, 5:55am UTC](https://discuss.elastic.co/t/will-influencer-change-the-way-a-model-might-detect-and-anomaly/326908 "2023-03-03T05:55:58Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Umang\_Pachaury](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umang_pachaury/32/113523_2.png) [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Post date:** [March 3, 2023, 5:55am UTC](https://discuss.elastic.co/t/will-influencer-change-the-way-a-model-might-detect-and-anomaly/326908/1 "2023-03-03T05:55:58Z")
Hello Team, I am working with the machine learning tools provided by elastic. I am detecting certain rare events over time. But now I have certain fields that I want the model to take in consideration while detecting the anomaly. I read about influencers and have bit of a confusion that is the influencer only there so that we can blame them when an anomaly is detected or these influencer fields plays a role in detecting the anomaly. So if I configure a rare wizard job without influencers and a rare wizard job with influencers, will both of the jobs give me the same result ? Or the job with influencer fields will take those fields into consideration and then detect the anomaly? ---
**Author:** ![droberts195](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/droberts195/32/17692_2.png) [@droberts195](https://discuss.elastic.co/u/droberts195)\ **Post date:** [March 3, 2023, 11:12am UTC](https://discuss.elastic.co/t/will-influencer-change-the-way-a-model-might-detect-and-anomaly/326908/2 "2023-03-03T11:12:32Z")
Influencers do not change whether an anomaly is detected. Like you say, they exist to help attribute blame if an anomaly is detected. ---
**Author:** ![Umang\_Pachaury](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umang_pachaury/32/113523_2.png) [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Post date:** [March 6, 2023, 4:12am UTC](https://discuss.elastic.co/t/will-influencer-change-the-way-a-model-might-detect-and-anomaly/326908/3 "2023-03-06T04:12:44Z")
Ok , So can we have two by\_field's like detect rare things by field\_one by field\_two? I want my anomaly detected to be influenced by two other fields. I read about over field and partition field but I am not sure these will work in my scenario. ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [March 6, 2023, 5:29pm UTC](https://discuss.elastic.co/t/will-influencer-change-the-way-a-model-might-detect-and-anomaly/326908/4 "2023-03-06T17:29:15Z")
You cannot have two "by fields", but you can have a "by field" and a "partition field" to effectively have a double-split. However, the "by field" in the context of the `rare` detector function actually means "the field that I want to find a rare value in" - so it is effectively not a split. If you do a configuration like `rare by process partition=host` you are basically saying "find me a rare process on a host, but treat every host independently (that is, do not have a global list of rare processes for all hosts). The `over` field invokes population analysis. See more info here: [Temporal vs. Population Analysis in Elastic Machine Learning | Elastic Blog](https://www.elastic.co/blog/temporal-vs-population-analysis-in-elastic-machine-learning) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 3, 2023, 5:29pm UTC](https://discuss.elastic.co/t/will-influencer-change-the-way-a-model-might-detect-and-anomaly/326908/5 "2023-04-03T17:29:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.