topic Anomaly detection configuration with Smartscape ID in Alerting

Anomaly detection configuration with Smartscape ID

Thomas_Matzke — Wed, 10 Jun 2026 09:20:15 GMT

I'm trying to set up an anomaly detection based on metrics that are derived from user.events. The user events contain the fields dt.rum.application.entity and dt.smartscape_source.id, but not dt.source_entity.

When configuring a new detection in the Anomaly Detection app there is this hint "Add 'by:{dt.source_entity}' to connect events with an entity".

Does any of the two fields mentioned above works as source for connecting the anomaly to an entity, since DT is transitioning to the Smartscape topology?

Re: Anomaly detection configuration with Smartscape ID

sujit_k_singh — Wed, 10 Jun 2026 11:48:53 GMT

Hi @Thomas_Matzke

dt.smartscape_source.id should work as your entity connection field. In your DQL query, use by:{dt.smartscape_source.id} in place of by:{dt.source_entity}.

If your goal is to associate the anomaly with the RUM application specifically, use dt.rum.application.entity instead. Both fields reference valid entity IDs in the topology. If the Anomaly Detection app doesn't accept them directly, you may need a lookup in your DQL to map to dt.source_entity.

Thanks,

Sujit