What does a anomalies command report mean when giving error: A separating field was not found, carring on without it.

[rsimmons]

The anomalies command reports this error: "A separating field was not found. Carrying on without it."

What does that mean?

Background:

I am looking for unusual response times. This worked fine:

... | anomalies field=responseTime

Next I tried to look for anomalies by host. This gave the error message above:

... | anomalies field=responseTime by host

[Stephen_Sorkin]

This means that the "host" field was not found in the table passed into the anomalies command. What does the rest of the search look like?

[rsimmons]

The two complete searches are:

sourcetype="access_combined" | anomalies field=responseTime

and

sourcetype="access_combined" | anomalies field=responseTime by host