hi all can i understand how `bucket start` is set in anomali Elementary Community #community-support

hi all can i understand how `bucket_start` is set...

Oliver Ng

11/29/2024, 1:08 PM

hi all can i understand how

bucket_start

is set in anomalies detection, please? originally, i thought it'd be set by

training_period

, however it seems

bucket_start

is always set to some 100 days before current_date() despite i have configured

training_period

to be 14 days appreciate the help 🙏🏼

🧵 1

Oliver Ng

11/29/2024, 1:11 PM

Copy code

select edr_bucket_start, edr_bucket_end
from (

    select edr_bucket_start,
    timestamp_add(cast(edr_bucket_start as timestamp), INTERVAL cast(1 as INT64) day) as edr_bucket_end
    from unnest(generate_timestamp_array(cast(
    timestamp_trunc(cast(cast('2024-08-23 00:00:00' as timestamp) as timestamp), day)
    as timestamp), cast('2024-11-29 12:17:28.562309+00:00' as timestamp), interval 1 day)
    ) as edr_bucket_start
where timestamp_add(cast(edr_bucket_start as timestamp), INTERVAL cast(1 as INT64) day) <= cast('2024-11-29 12:17:28.562309+00:00' as timestamp)
) results
where edr_bucket_start >= cast(timestamp_trunc(cast(cast('2024-08-23 00:00:00' as timestamp) as timestamp), day) as timestamp)
and edr_bucket_end <= cast('2024-11-29 12:17:28.562309+00:00' as timestamp)

this is how

bucket_start

and

bucket_end

are generated and i'd hope to understand what configures

bucket_start

2024-08-23 00:00:00

Tiphaine Castel

02/10/2025, 10:56 AM

Hi @Oliver Ng I have the same issue, did you find out in the end ?

9 Views

Open in Slack

Previous Next