EvaluatedSlice

Forecast result for a given slice.

JSON representation 
{
  "dimensions": [
    {
      object (PinnedDimension)
    }
  ],
  "history": {
    object (Timeseries)
  },
  "forecast": {
    object (Timeseries)
  },
  "status": {
    object (Status)
  },
  "detectionPointActual": number,
  "detectionPointForecast": number,
  "expectedDeviation": number,
  "anomalyScore": number
}
Fields
dimensions[]

object (PinnedDimension)

Values for all categorical dimensions that uniquely identify this slice.
history

object (Timeseries)

The actual values in the [ detectionTime - forecastHistory, detectionTime ] time range.

NOTE: This field is only populated if returnTimeseries is true.
forecast

object (Timeseries)

The forecasted values in the [ detectionTime + granularity, forecastParams.horizonTime ] time range.

NOTE: This field is only populated if returnTimeseries is true.
status

object (Status)

Evaluation status. Contains an error message if the anomalyScore is < 0.

Possible error messages:

  • "Time series too sparse": The returned time series for this slice did not contain enough data points (we require a minimum of 10).
  • "Not enough recent time series points": The time series contains the minimum of 10 points, but there are not enough close in time to the detection point.
  • "Missing detection point data": There were not events to be aggregated within the [detectionTime, detectionTime + granularity] time interval, so we don't have an actual value with which we can compare our prediction.
  • "Data retrieval error": We failed to retrieve the time series data for this slice and could not evaluate it successfully. Should be a transient error.
  • "Internal server error": Internal unexpected error.
detectionPointActual

number

The actual value at the detection time (see detectionTime).

NOTE: This value can be an estimate, so it should not be used as a source of truth.
detectionPointForecast

number

The expected value at the detection time, which is obtained by forecasting on the historical time series.
expectedDeviation

number

How much our forecast model expects the detection point actual will deviate from its forecasted value based on how well it fit the input time series.

In general, we expect the detectionPointActual to be in the [detectionPointForecast - expectedDeviation, detectionPointForecast + expectedDeviation] range. The more the actual value is outside this range, the more statistically significant the anomaly is.

The expected deviation is always positive.
anomalyScore

number

Summarizes how significant the change between the actual and forecasted detection points are compared with the historical patterns observed on the history time series.

Defined as |a - f| / (e + nt), where:

Anomaly scores between different requests and datasets are comparable. As a guideline, the risk of a slice being an anomaly based on the anomaly score is:

  • Very High if anomalyScore > 5.
  • High if the anomalyScore is in the [2, 5] range.
  • Medium if the anomalyScore is in the [1, 2) range.
  • Low if the anomalyScore is < 1.

If there were issues evaluating this slice, then the anomaly score will be set to -1.0 and the status field will contain details on what went wrong.

Timeseries

A time series.

JSON representation 
{
  "point": [
    {
      object (TimeseriesPoint)
    }
  ]
}
Fields
point[]

object (TimeseriesPoint)

The points in this time series, ordered by their timestamp.

TimeseriesPoint

A point in a time series.

JSON representation 
{
  "time": string,
  "value": number
}
Fields
time

string (Timestamp format)

The timestamp of this point.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
value

number

The value for this point.

It is computed by aggregating all events in the associated slice that are in the [time, time + granularity] range (see granularity) using the specified metric.