Anomaly detection

A system comprising:

• a memory;
• and
• a processing device, operatively coupled to the memory, to:
• execute a search query over a period of time to produce values for a key performance indicator (KPI), the search query defining the KPI and deriving a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service;
• cause for display of a graphical user interface (GUI) enabling a user to indicate a sensitivity setting;
• receive, via the GUI, a user input indicating the sensitivity setting;
• identify zero or more of the values as anomalies based on the sensitivity setting indicated by the user input;
• and
• cause for display of a GUI comprising information related to the values identified as anomalies.

A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:

• execute a search query over a period of time to produce values for a key performance indicator (KPI), the search query defining the KPI and deriving a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service;
• cause for display of a graphical user interface (GUI) enabling a user to indicate a sensitivity setting;
• receive, via the GUI, a user input indicating the sensitivity setting;
• identify zero or more of the values as anomalies based on the sensitivity setting indicated by the user input;
• and
• cause for display of a GUI comprising information related to the values identified as anomalies.