Documentation

anomalydetection.mad() function

anomalydetection.mad() is a user-contributed function maintained by the package author.

anomalydetection.mad() uses the median absolute deviation (MAD) algorithm to detect anomalies in a data set.

Input data requires _time and _value columns. Output data is grouped by _time and includes the following columns of interest:

  • _value: difference between of the original _value from the computed MAD divided by the median difference.
  • MAD: median absolute deviation of the group.
  • level: anomaly indicator set to either anomaly or normal.
Function type signature
(<-table: stream[B], ?threshold: A) => stream[{C with level: string, _value_diff_med: D, _value_diff: D, _value: D}] where A: Comparable + Equatable, B: Record, D: Comparable + Divisible + Equatable

For more information, see Function type signatures.

Parameters

threshold

Deviation threshold for anomalies.

table

Input data. Default is piped-forward data (<-).

Examples

Use the MAD algorithm to detect anomalies

import "contrib/anaisdg/anomalydetection"
import "sampledata"

sampledata.float()
    |> anomalydetection.mad(threshold: 1.0)

View example input and output


Was this page helpful?

Thank you for your feedback!


New in InfluxDB 3.6

Key enhancements in InfluxDB 3.6 and the InfluxDB 3 Explorer 1.4.

See the Blog Post

InfluxDB 3.6 is now available for both Core and Enterprise. This release introduces the 1.4 update to InfluxDB 3 Explorer, featuring the beta launch of Ask AI, along with new capabilities for simple startup and expanded functionality in the Processing Engine.

For more information, check out:

InfluxDB Docker latest tag changing to InfluxDB 3 Core

On February 3, 2026, the latest tag for InfluxDB Docker images will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments.

If using Docker to install and run InfluxDB, the latest tag will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments. For example, if using Docker to run InfluxDB v2, replace the latest version tag with a specific version tag in your Docker pull command–for example:

docker pull influxdb:2