AnomaliDetection does not detect outlier data

[ashishmgupta]

In the below dataset, there are two different ISPs for the user from their usual ones.
NordVPN for John and Quadranet for Jill – but this search using anomalidetection is detecting only john’s but not Jill’s.
Any idea why and what is the better way to detect the ISP outlier?

source="isp_data2.csv"  index="test" sourcetype="csv"
| anomalydetection "ISP" "EmailAddress" action=annotate
| eval isOutlier = if(probable_cause != "", "1", "0")
| table "ISP" "EmailAddress", probable_cause, isOutlier
| sort 100000 probable_cause

EmailAddress	ISP	timestamp
john@example.com	Comcast	1/1/2020
john@example.com	Comcast	1/2/2020
john@example.com	Comcast	1/3/2020
john@example.com	Comcast	1/4/2020
john@example.com	Comcast	1/5/2020
john@example.com	Comcast	1/6/2020
john@example.com	Comcast	1/7/2020
john@example.com	Comcast	1/8/2020
john@example.com	Comcast	1/9/2020
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	NordVPN	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
john@example.com	Comcast	########
jill@example.com	Spectrum	2/1/2020
jill@example.com	Spectrum	2/2/2020
jill@example.com	Spectrum	2/3/2020
jill@example.com	Spectrum	2/4/2020
jill@example.com	Spectrum	2/5/2020
jill@example.com	Spectrum	2/6/2020
jill@example.com	Spectrum	2/7/2020
jill@example.com	Spectrum	2/8/2020
jill@example.com	Spectrum	2/9/2020
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Quadranet	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	########
jill@example.com	Spectrum	3/1/2020

[tscroggins]

Hi @ashishmgupta,

As a quick fix, try:

| anomalydetection "ISP" "EmailAddress" action=annotate cutoff=false

[tayvionp]

You seem to be missing the filter command
| where isOutlier=1