Documentation

anomalydetection.mad() function

anomalydetection.mad() is a user-contributed function maintained by the package author.

anomalydetection.mad() uses the median absolute deviation (MAD) algorithm to detect anomalies in a data set.

Input data requires _time and _value columns. Output data is grouped by _time and includes the following columns of interest:

  • _value: difference between of the original _value from the computed MAD divided by the median difference.
  • MAD: median absolute deviation of the group.
  • level: anomaly indicator set to either anomaly or normal.
Function type signature
(<-table: stream[B], ?threshold: A) => stream[{C with level: string, _value_diff_med: D, _value_diff: D, _value: D}] where A: Comparable + Equatable, B: Record, D: Comparable + Divisible + Equatable

For more information, see Function type signatures.

Parameters

threshold

Deviation threshold for anomalies.

table

Input data. Default is piped-forward data (<-).

Examples

Use the MAD algorithm to detect anomalies

import "contrib/anaisdg/anomalydetection"
import "sampledata"

sampledata.float()
    |> anomalydetection.mad(threshold: 1.0)

View example input and output


Was this page helpful?

Thank you for your feedback!


New in InfluxDB 3.5

Key enhancements in InfluxDB 3.5 and the InfluxDB 3 Explorer 1.3.

See the Blog Post

InfluxDB 3.5 is now available for both Core and Enterprise, introducing custom plugin repository support, enhanced operational visibility with queryable CLI parameters and manual node management, stronger security controls, and general performance improvements.

InfluxDB 3 Explorer 1.3 brings powerful new capabilities including Dashboards (beta) for saving and organizing your favorite queries, and cache querying for instant access to Last Value and Distinct Value caches—making Explorer a more comprehensive workspace for time series monitoring and analysis.

For more information, check out:

InfluxDB Docker latest tag changing to InfluxDB 3 Core

On November 3, 2025, the latest tag for InfluxDB Docker images will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments.

If using Docker to install and run InfluxDB, the latest tag will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments. For example, if using Docker to run InfluxDB v2, replace the latest version tag with a specific version tag in your Docker pull command–for example:

docker pull influxdb:2