data [required]
\nobject
JSON:API resource containing anomaly investigation results.
attributes [required]
\nobject
Attributes of an anomaly investigation response.
results [required]
\n[object]
Results returned in the same order as the submitted requests. This API version returns exactly one result.
anomalies [required]
\n[object]
Detected anomalies. This API version returns at most one anomaly.
anomaly_detection [required]
\nobject
Anomaly detection configuration used for the result.
configuration_source [required]
\nenum
Source of the anomaly detection configuration. \nAllowed enum values: request_formula,watchdog_explains_default
profile [required]
\nstring
Applied Watchdog Explains profile, or null when the request supplied an explicit anomalies() formula. The current Watchdog profile is watchdog_explains_v1.
detected_interval [required]
\nobject
Half-open time interval in milliseconds since the Unix epoch.
end [required]
\nint64
Exclusive end of the interval.
start [required]
\nint64
Inclusive start of the interval.
display_interval [required]
\nobject
Half-open time interval in milliseconds since the Unix epoch.
end [required]
\nint64
Exclusive end of the interval.
start [required]
\nint64
Inclusive start of the interval.
findings [required]
\n[ <oneOf>]
Deterministic explanations for the anomaly, ordered by importance.
<type=influential_tag>
\nobject
Finding that attributes an anomaly to an influential tag.
description [required]
\nstring
Deterministic explanation of the finding.
headline [required]
\nstring
Concise, deterministic finding title.
tag [required]
\nobject
Structured tag evidence for an influential-tag finding.
influence_type [required]
\nenum
Kind of influence a tag has on a series. \nAllowed enum values: shape,value
key [required]
\nstring
Influential tag key.
rating [required]
\ndouble
Influence rating from 1 through 5.
synonyms [required]
\n[object]
Tags grouped with this tag by Variation of Influence synonym analysis.
key [required]
\nstring
Synonymous tag key.
values [required]
\n[string]
Values associated with the synonymous tag.
values [required]
\n[string]
Influential values for the tag key.
type [required]
\nenum
Finding category for an influential tag. \nAllowed enum values: influential_tag
<type=anomaly>
\nobject
Finding that describes the anomaly when completed analysis produces no displayable influential tags.
description [required]
\nstring
Deterministic explanation of the finding.
headline [required]
\nstring
Concise, deterministic finding title.
type [required]
\nenum
Finding category for an anomaly without a displayable influential tag. \nAllowed enum values: anomaly
maximum_deviation [required]
\nobject
Most anomalous point within the detected interval.
delta_from_boundary [required]
\ndouble
Absolute distance between the observed value and the nearest anomaly boundary.
timestamp [required]
\nint64
Point timestamp in milliseconds since the Unix epoch.
value [required]
\ndouble
Observed value at the point.
series [required]
\nobject
Logical series on which the anomaly was detected.
group_tags [required]
\n[string]
Tags identifying the selected group. Empty for a query without grouping.
label [required]
\nstring
Display label for the selected series.
query_index [required]
\nint64
Zero-based index of the caller's formula that produced the series.
tag_analysis [required]
\nobject
Summary of optional influential-tag enrichment. Count and key fields are present only when analysis completes; enrichment availability does not affect completion of the investigation result.
analyzed_tag_keys
\n[string]
Tag keys analyzed. Present only when analysis completes.
status [required]
\nenum
Outcome of optional influential-tag enrichment. \nAllowed enum values: complete,unsupported,failed
tag_keys_analyzed
\nint64
Number of tag keys analyzed. Present only when analysis completes.
tag_values_analyzed
\nint64
Number of tag values analyzed. Present only when analysis completes.
type [required]
\nenum
Direction of an anomaly relative to its expected range. \nAllowed enum values: spike,dip
status [required]
\nenum
Status value indicating successful completion. \nAllowed enum values: complete
id [required]
\nenum
Stable identifier for an anomaly investigation response resource. \nAllowed enum values: 0
type [required]
\nenum
Resource type for a timeseries anomaly investigation. \nAllowed enum values: timeseries_anomaly_investigation
meta [required]
\nobject
Timeseries execution metadata for the single request accepted by this API version.
from_date [required]
\nint64
Effective start of the timeseries query in milliseconds since the Unix epoch.
interval [required]
\nint64
Effective timeseries interval in milliseconds.
queries [required]
\n[object]
Execution status for the request's queries.
name [required]
\nstring
Query name from the request.
status [required]
\nenum
Current execution status for a named query. \nAllowed enum values: running,done
res_type [required]
\nenum
Response metadata type for a timeseries anomaly investigation. \nAllowed enum values: timeseries_anomaly_investigation
results_warnings [required]
\n[object]
Non-fatal warnings produced while executing the investigation.
message [required]
\nstring
Human-readable warning message.
name [required]
\nstring
Machine-readable warning name.
to_date [required]
\nint64
Effective end of the timeseries query in milliseconds since the Unix epoch.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[object]
A list of errors.
detail
\nstring
A human-readable explanation specific to this occurrence of the error.
meta
\nobject
Non-standard meta-information about the error
source
\nobject
References to the source of the error.
header
\nstring
A string indicating the name of a single request header which caused the error.
parameter
\nstring
A string indicating which URI query parameter caused the error.
pointer
\nstring
A JSON pointer to the value in the request document that caused the error.
status
\nstring
Status code of the response.
title
\nstring
Short human-readable summary of the error.
errors [required]
\n[string]
A list of errors.
data [required]
\nobject
JSON:API resource containing an anomaly investigation request.
attributes [required]
\nobject
Attributes of an anomaly investigation request.
requests [required]
\n[object]
Timeseries requests to investigate. This API version accepts exactly one request.
formulas [required]
\n[object]
Formulas to evaluate. Each formula may contain an explicit anomalies() call or a supported metrics expression.
formula [required]
\nstring
Formula expression referencing one or more named queries.
limit
\nobject
Optional formula limit accepted for compatibility with Timeseries API requests. Formula limits have no effect on timeseries queries.
count
\nint64
Requested result limit. This field has no effect on a timeseries anomaly investigation.
order
\nenum
Sort order used when applying a formula series limit. \nAllowed enum values: asc,desc
from [required]
\nint64
Start of the investigation time window in milliseconds since the Unix epoch.
interval
\nint64
Optional requested aggregation interval in milliseconds.
queries [required]
\n[object]
Metrics queries referenced by the formulas.
aggregator
\nstring
Optional scalar aggregator accepted for request compatibility. This field is ignored for timeseries queries.
cross_org_uuids
\n[string]
Optional organization UUID used for a cross-organization query. Each query accepts at most one UUID; use separate queries for separate organizations. Influential-tag analysis is currently unsupported for cross-organization queries, but anomaly detection still runs.
data_source [required]
\nenum
Data source for an anomaly investigation query. \nAllowed enum values: metrics
name [required]
\nstring
Name used to reference this query from formulas.
query [required]
\nstring
Datadog metrics query expression.
to [required]
\nint64
End of the investigation time window in milliseconds since the Unix epoch. Must be later than from.
type [required]
\nenum
Resource type for a timeseries anomaly investigation. \nAllowed enum values: timeseries_anomaly_investigation