The anomalies command reports this error: "A separating field was not found. Carrying on without it."
What does that mean?
I am looking for unusual response times. This worked fine:
... | anomalies field=responseTime
Next I tried to look for anomalies by host. This gave the error message above:
... | anomalies field=responseTime by host