Anomaly chart visualization

This article describes the anomaly chart visualization.

The anomaly chart visualization is similar to a timechart, but highlights anomalies using the series_decompose_anomalies function.

Syntax

T | render anomalychart [with ( propertyName = propertyValue [, …])]

Parameters

NameTypeRequiredDescription
Tstring✔️Input table name.
propertyName, propertyValuestringA comma-separated list of key-value property pairs. See supported properties.

Supported properties

All properties are optional.

PropertyNamePropertyValue
accumulateWhether the value of each measure gets added to all its predecessors. (true or false)
legendWhether to display a legend or not (visible or hidden).
seriesComma-delimited list of columns whose combined per-record values define the series that record belongs to.
yminThe minimum value to be displayed on Y-axis.
ymaxThe maximum value to be displayed on Y-axis.
titleThe title of the visualization (of type string).
xaxisHow to scale the x-axis (linear or log).
xcolumnWhich column in the result is used for the x-axis.
xtitleThe title of the x-axis (of type string).
yaxisHow to scale the y-axis (linear or log).
ycolumnsComma-delimited list of columns that consist of the values provided per value of the x column.
ysplitHow to split the visualization into multiple y-axis values. For more information, see Multiple y-axes.
ytitleThe title of the y-axis (of type string).
anomalycolumnsComma-delimited list of columns, which will be considered as anomaly series and displayed as points on the chart

ysplit property

This visualization supports splitting into multiple y-axis values. The supported values of this property are:

ysplitDescription
noneA single y-axis is displayed for all series data. (Default)
axesA single chart is displayed with multiple y-axes (one per series).
panelsOne chart is rendered for each ycolumn value. Maximum five panels.

Example

The example in this section shows how to use the syntax to help you get started.

let min_t = datetime(2017-01-05);
let max_t = datetime(2017-02-03 22:00);
let dt = 2h;
demo_make_series2
| make-series num=avg(num) on TimeStamp from min_t to max_t step dt by sid 
| where sid == 'TS1'   //  select a single time series for a cleaner visualization
| extend (anomalies, score, baseline) = series_decompose_anomalies(num, 1.5, -1, 'linefit')
| render anomalychart with(anomalycolumns=anomalies, title='Web app. traffic of a month, anomalies') //use "| render anomalychart with anomalycolumns=anomalies" to render the anomalies as bold points on the series charts.

Screenshot of anomaly chart output.