Quiver offers the ability to detect anomalies (or periods of interest) by evaluating time series data against user-defined conditions using the time series search card. This card outputs an event set containing one event for each time interval where the specified conditions are met. This event set can be visualized as an events plot or analyzed further in Quiver. The time series search logic can also be used in time series alerting to save identified events as objects in the Ontology.
This example explores how to use the time series search card to detect periods of extreme temperature for airports in New York City, New York.
The first step is to add time series data to your analysis; in this example, temperature data for John F. Kennedy JFK and LaGuardia LGA airports. Follow the instructions in the documentation on how to add time series data to a Quiver analysis for more information.
Assume that a temperature drop below 20 degrees Fahrenheit at the JFK airport is considered an extreme event. To find periods where this temperature drop occurred, you can add a time series search card to analysis with the following configuration:
JFK Temperature
plot as the Source Time Series for the threshold condition.<
and the threshold value to 20
.Quiver enables you to easily compare time series by using one time series as a threshold; for instance, you may want to find periods where the temperature at LGA is higher than the temperature at JFK. To find these periods, add a time series search card to your analysis and set the threshold condition's operand type to Time series
. Then, configure the time series search card as follows:
LGA Temperature
plot as the Source Time Series for the threshold condition.>
.JFK Temperature
plot as the Numeric Time Series used as the threshold.Quiver also provides the ability to compare a source time series against a bounded time series and find periods where the source time series is outside the bounds of the bounded time series. This enables Bollinger bands analysis, in which you can detect when a time series differs from the rolling average by a certain number of standard deviations. For example, you might want to detect when the temperature at JFK is more than 2 standard deviations away from the 30 day rolling average. To achieve this, follow the steps below:
JFK Temperature
, the multiple (number of standard deviations) to 2
, and the window size to 30 days
.Bounded
.JFK Temperature
plot as the source Time series and the Bollinger bands card created in the first step as the Bounded time series.If you need to perform more complex searches than are possible with the other search types, you can use a custom formula search. For example, you may want to detect when the temperature at JFK is more than 1 degree Fahrenheit above the temperature at LGA. This can be achieved with a formula search, which allows you to reference any time series plots or parameters in your analysis. To run this search, follow these steps:
Formula
.JFK Temperature
and LGA Temperature
plots. If you enter $
in the conditions text box, you will be shown a list of available time series and parameters in your analysis. Select the JFK Temperature
and LGA Temperature
plots, which are substituted for their identifiers $B
and $E
, respectively. You can then write the formula as $B > $E + 1
and Apply the formula to run the search.You can also use Quiver to find periods of interest across multiple time series; for example, you might want to detect when the temperature at any weather station in New York is above 80 degrees Fahrenheit. Quiver has a built-in way to do this using the Multi
time series search which performs a search across each row of a transform table (limited to 1,000 rows) and returns one event for each time interval that satisfies the specified conditions. To detect when the temperature at any weather station in New York is above 80 degrees Fahrenheit, follow these steps:
@
in the conditions text box, you will be shown a list of available properties. Select the Temperature
property, which is substituted for its identifier @tdp_temp
. Then, write the formula as @tdp_temp > 80
and Apply the formula to run the search.The events identified through the time series search can be saved as objects in the Ontology using time series alerting. This allows you to track and monitor specific conditions of interest across your time series data. You can create an Automation from your time series search logic by clicking the Add automation button in the Automations section of the time series search card editor.
There are some restrictions on creating an Automation from a time series search in Quiver:
Multi
time series search to an Automation.For more information on the requirements for creating time series alerts and how to use them, see time series alerting.