---
title: Investigate Dashboard Anomalies
description: >-
  Automatically detect and group anomalies across a dashboard's graphs, identify
  the tags contributing to them, and delegate root cause analysis to Bits
  Investigation.
breadcrumbs: Docs > Dashboards > Graph Insights > Investigate Dashboard Anomalies
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Investigate Dashboard Anomalies

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Datadog detects anomalies across your dashboard's timeseries graphs, groups co-occurring anomalies into issues, and identifies the tags contributing most to each. From an anomaly, you can narrow down the cause on a single graph with [Watchdog Explains](https://docs.datadoghq.com/dashboards/graph_insights/watchdog_explains.md), or delegate root cause analysis to [Bits Investigation](https://docs.datadoghq.com/bits_ai/bits_investigation.md).

{% alert level="info" %}
Anomaly detection is available for [Timeseries widgets](https://docs.datadoghq.com/dashboards/widgets/timeseries.md) with Metrics data (`avg`, `sum`, `min`, and `max` aggregation). Widgets using functions such as `cumsum`, `anomalies`, or `outliers` are not eligible.
{% /alert %}

Detection runs when you open a dashboard, and issues appear within about 20 seconds. If Datadog detects no anomalies, the Investigate menu and the controls described on this page do not appear.

Datadog does not run anomaly detection on:

- Public (shared) dashboards, because there is no signed-in viewer who can act on a result
- Dashboards embedded in the mobile app
- Dashboards in TV mode
- Dashboards in print mode
- Dashboards where you turned off Auto-detect issues

## How Datadog detects anomalies{% #how-datadog-detects-anomalies %}

Datadog applies anomaly detection to the graphs on your dashboard by analyzing both the shape and value of the underlying timeseries. It identifies deviations from historical patterns, flagging spikes, dips, or gradual drifts that don't align with expected behavior.

To account for seasonality, the algorithm looks back up to three weeks. For example, if a spike appears on a Monday at 9:00 a.m., Datadog compares that datapoint against previous Mondays at the same hour. If similar patterns appear consistently, the spike is treated as **seasonal** and is not flagged as an anomaly. This helps reduce false positives so Datadog surfaces only unexpected deviations.

Anomalies can be sharp spikes or drops, but may also be subtler trends such as step changes or slope shifts.

## Find detected issues on a dashboard{% #find-detected-issues-on-a-dashboard %}

Click Investigate at the top of the dashboard to see the issues Datadog detected. Each issue names the metric that deviated and when it was detected. Expanding an issue also shows its influential tags and the Widget affected.

Selecting an issue scrolls the dashboard to the affected graph.

Anomalies occurring across several widgets at once are grouped into one issue, such as `Anomalies co-occur on 18 widgets`.

{% image
   source="https://docs.dd-static.net/images/dashboards/graph_insights/investigate_anomalies/investigate_menu.fd68627ef457bef021e54d09c14a93f8.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/dashboards/graph_insights/investigate_anomalies/investigate_menu.fd68627ef457bef021e54d09c14a93f8.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="The Investigate menu open on a dashboard, listing four detected issues with an Auto-detect issues toggle." /%}

## Review an anomaly{% #review-an-anomaly %}

Detected anomalies are highlighted in pink on the graph.

1. Hover over a highlighted region. A chip appears summarizing the anomaly and how far it deviates from the expected range, for example: `The spike is 70% higher than the expected range as inferred from the past 3 weeks of data.`

1. Click the chip to expand it. The expanded chip always contains:

   - **Influential tags**: the tags contributing most to the anomaly.
   - **Next steps**: suggested follow-up actions, such as viewing the affected service or creating a monitor.

Some anomalies also include a **Co-occurs with** section, listing other metrics that deviated over the same period.

{% image
   source="https://docs.dd-static.net/images/dashboards/graph_insights/investigate_anomalies/anomaly_chip.ba7752ac73555eb8c4b69d82c337da3f.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/dashboards/graph_insights/investigate_anomalies/anomaly_chip.ba7752ac73555eb8c4b69d82c337da3f.png?auto=format&fit=max&w=850&dpr=2 2x"
   alt="An expanded anomaly chip showing an influential tag, next steps, and the Investigate With AI button." /%}

## Analyze a single graph with Watchdog Explains{% #analyze-a-single-graph-with-watchdog-explains %}

To narrow an anomaly down to a specific tag, open the graph in fullscreen and click Findings. This panel is powered by Watchdog Explains.

Each finding names a tag that likely explains the anomaly. It also shows the graph before and after filtering that tag out, so you can confirm whether removing it flattens the spike.

For more information, see [Watchdog Explains](https://docs.datadoghq.com/dashboards/graph_insights/watchdog_explains.md).

## Investigate root cause with Bits Investigation{% #investigate-root-cause-with-bits-investigation %}

Click Investigate With AI from an expanded anomaly chip, from the Investigate menu, or from a Watchdog Explains finding. Datadog opens [Bits Investigation](https://docs.datadoghq.com/bits_ai/bits_investigation.md) in a new tab, where it analyzes the anomaly and reports a root cause, an impact assessment, and a timeline.

If related investigations already exist, the button reads See *N* Related Investigations, where *N* is the count. Click the button to open a filtered list of investigations. To open a single investigation, click Review Completed Investigation.

{% alert level="info" %}
The related-investigations count is scoped to the whole dashboard and time range, not to the anomaly you are viewing. A count of one can mean an investigation started from a different graph on the same dashboard.
{% /alert %}

Investigations started this way record Dashboard Anomaly as their source and carry a `dashboard_id` tag. Use the source or the tag to find an investigation later in the Bits Investigation list.

## Turn off anomaly detection{% #turn-off-anomaly-detection %}

To stop scanning a dashboard for anomalies, click Investigate and turn off Auto-detect issues.

This preference applies to one dashboard and is stored in your browser. Other viewers of the same dashboard still see anomalies unless they turn detection off themselves. The preference also does not carry over to a different browser or device.

To exclude a single widget from anomaly detection, edit the widget, expand Anomaly Detection, and select Hide. This setting is part of the widget definition, so it applies to everyone who views the dashboard.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Analyze a single anomaly with Watchdog Explains](https://docs.datadoghq.com/dashboards/graph_insights/watchdog_explains.md)
- [Learn how Bits Investigation analyzes root cause](https://docs.datadoghq.com/bits_ai/bits_investigation.md)