Skip to main content
Sumo Logic

Anomalies Page

The Anomalies (Current) page graphically breaks down the last six hours of activity in your Sumo Logic account using Reports that you’ll define. To view this page, go to Manage Data > Anomalies.

At the top of the page you’ll find the Anomaly Reports Summary, which shows a consolidated view of all the individual Anomaly Reports. (Until you define one or more Reports, the Summary Report won’t contain much activity.) Select an Anomaly Report from the list to display information about Events.

Below the Summary you’ll see the selected Individual Report, which displays the Incidents pertaining to one particular Event in your deployment. Click an incident to drill down for more information, which is displayed in the EventPane below.

In the Individual Report section of the page, use the Anomaly Threshold slider to adjust the number of Incidents that are displayed. The lower the threshold, the more Incidents of an Event will be displayed. The higher the threshold, the fewer Incidents of an Event will be displayed.

At the top right of the page, the Incidents button opens a Search page and runs the query _index=sumologic_anomaly_events to display the latest incidents in the Messages tab.


  1. Anomaly Reports Summary.
  2. Individual Report.
  3. Event Pane.
  4. Anomaly Threshold.
  5. Incidents.
  6. Current. (The Anomalies page.)
  7. Snapshots.