Does anomaly detection have time range?

OpenSearch Dashboards
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
1.3

Describe the issue:
If I want to utilize the real-time anomaly detection feature, how many data pointers can I utilize? For example, if I set the aggregate interval to 10 minutes, how many minutes of data can I use to detect anomalies?

Configuration:

Relevant Logs or Screenshots:

2

Hey @brock

By chance are you referring to Shingle size? if so then its 1 and 60.

3

Hi @Gsmitt
If I’ve been collecting log data since January 1, 2020, does OpenSearch’s anomaly detection use all the data from January 1, 2020 to June 22, 2023 (today) to detect if the current data is an anomaly?

4

Hey @brock

Good question, I personally dont know. But I think this may answer your question.

It states…

Preview sample anomalies and adjust the feature settings if needed. For sample previews, the anomaly detection plugin selects a small number of data samples—for example, one data point every 30 minutes—and uses interpolation to estimate the remaining data points to approximate the actual feature data. It loads this sample dataset into the detector. The detector uses this sample dataset to generate a sample preview of anomaly results.

5

@Gsmitt OMG thank you so much. This is exactly what I was looking for!!

6

@brock

No problem glad to help

1 Like