Formula Used
Rolling detection compares each value against recent observations. It estimates a local mean and deviation. Scores beyond the chosen threshold become anomaly candidates.
score(t) = (x(t) - expected(t)) / local_standard_deviation(t) upper(t) = expected(t) + threshold × local_standard_deviation(t) lower(t) = expected(t) - threshold × local_standard_deviation(t)
How to Use
Paste data or upload a compatible CSV file. Select timestamp, value, and optional series columns. Configure preprocessing, detection, and chart settings before calculation.
Review highlighted points and anomaly event identifiers. Compare series statistics and inspect detailed residual values. Export tables, charts, configuration, or a PDF report.
Example Data Table
| Timestamp | Value | Series | Expected result |
|---|---|---|---|
| 2026-07-07 | 109 | Traffic | Normal |
| 2026-07-08 | 175 | Traffic | Positive anomaly |
| 2026-07-12 | 42 | Traffic | Negative anomaly |
Interpretation Guide
Higher absolute scores indicate stronger deviations from expectations. Positive anomalies exceed upper limits, while negative anomalies fall below. Consecutive points can represent one operational anomaly event.
Results depend on window size and chosen sensitivity. Seasonal data benefits from an appropriate seasonal period. Validate important findings against business or system context.
Frequently Asked Questions
What is a time-series anomaly?
It is an observation that differs meaningfully from expected behavior. Anomalies may be isolated points or sustained events. Context determines whether each anomaly needs further investigation.
Which detection method should I choose?
Rolling Z-scores suit many regularly sampled datasets. Hampel filtering handles occasional extreme points robustly. Seasonal residuals help when repeating patterns dominate behavior.
What threshold should I use?
A threshold near three is a common starting point. Lower values increase sensitivity and false alarms. Higher values detect only stronger and rarer deviations.
How large should the rolling window be?
Choose enough points to represent normal local behavior. Short windows react quickly but may fluctuate. Long windows remain stable but adapt more slowly.
Can I analyze multiple series?
Yes, provide a series column in your input. Detection runs independently for every named series. The comparison table summarizes differences across those series.
How are missing values handled?
You may ignore, replace, fill, or interpolate values. Linear interpolation works well for short internal gaps. Large gaps should receive careful domain-specific review.
What are simulated machine-learning methods?
They use robust local scoring without external model libraries. They approximate isolation, density, and boundary behavior. Use dedicated ML services for production-grade model training.
Can I export the results?
You can export CSV tables and chart images. The page also creates a compact PDF report. Configuration files preserve selected controls for later reuse.
Are detected anomalies always errors?
No, anomalies may represent valid and important events. Promotions, outages, launches, and holidays create legitimate deviations. Always combine automated results with contextual human review.