Anomaly detection configuration with Smartscape ID

[Thomas_Matzke]

I'm trying to set up an anomaly detection based on metrics that are derived from user.events. The user events contain the fields dt.rum.application.entity and dt.smartscape_source.id, but not dt.source_entity.

When configuring a new detection in the Anomaly Detection app there is this hint "Add 'by:{dt.source_entity}' to connect events with an entity". 

Does any of the two fields mentioned above works as source for connecting the anomaly to an entity, since DT is transitioning to the Smartscape topology?

[sujit_k_singh · Accepted solution]

Hi @Thomas_Matzke 

dt.smartscape_source.id should work as your entity connection field. In your DQL query, use by:{dt.smartscape_source.id} in place of by:{dt.source_entity}.

If your goal is to associate the anomaly with the RUM application specifically, use dt.rum.application.entity instead. Both fields reference valid entity IDs in the topology. If the Anomaly Detection app doesn't accept them directly, you may need a lookup in your DQL to map to dt.source_entity.

Thanks,

Sujit