# Get overall bucket results


**POST /_ml/anomaly_detectors/{job_id}/results/overall_buckets**

**All methods and paths for this operation:**

<div>
                      <span class="operation-verb get">GET</span>
                      <span class="operation-path">/_ml/anomaly_detectors/{job_id}/results/overall_buckets</span>
                      </div>
                    <div>
                      <span class="operation-verb post">POST</span>
                      <span class="operation-path">/_ml/anomaly_detectors/{job_id}/results/overall_buckets</span>
                      </div>
                    

Retrievs overall bucket results that summarize the bucket results of
multiple anomaly detection jobs.

The `overall_score` is calculated by combining the scores of all the
buckets within the overall bucket span. First, the maximum
`anomaly_score` per anomaly detection job in the overall bucket is
calculated. Then the `top_n` of those scores are averaged to result in
the `overall_score`. This means that you can fine-tune the
`overall_score` so that it is more or less sensitive to the number of
jobs that detect an anomaly at the same time. For example, if you set
`top_n` to `1`, the `overall_score` is the maximum bucket score in the
overall bucket. Alternatively, if you set `top_n` to the number of jobs,
the `overall_score` is high only when all jobs detect anomalies in that
overall bucket. If you set the `bucket_span` parameter (to a value
greater than its default), the `overall_score` is the maximum
`overall_score` of the overall buckets that have a span equal to the
jobs' largest bucket span.

## Required authorization

* Cluster privileges: `monitor_ml`



## Servers
- http://api.example.com: http://api.example.com ()


## Authentication methods
- Api key auth
- Basic auth
- Bearer auth


## Parameters

### Path parameters
- **job_id** (string)
  Identifier for the anomaly detection job. It can be a job identifier, a
  group name, a comma-separated list of jobs or groups, or a wildcard
  expression.

  You can summarize the bucket results for all anomaly detection jobs by
  using `_all` or by specifying `*` as the `<job_id>`.

### Query parameters
- **allow_no_match** (boolean)
  Specifies what to do when the request:

  1. Contains wildcard expressions and there are no jobs that match.
  2. Contains the `_all` string or no identifiers and there are no matches.
  3. Contains wildcard expressions and there are only partial matches.

  If `true`, the request returns an empty `jobs` array when there are no
  matches and the subset of results when there are partial matches. If this
  parameter is `false`, the request returns a `404` status code when there
  are no matches or only partial matches.
- **bucket_span** (string)
  The span of the overall buckets. Must be greater or equal to the largest
  bucket span of the specified anomaly detection jobs, which is the default
  value.

  By default, an overall bucket has a span equal to the largest bucket span
  of the specified anomaly detection jobs. To override that behavior, use
  the optional `bucket_span` parameter.
- **end** (string | number)
  Returns overall buckets with timestamps earlier than this time.
- **exclude_interim** (boolean)
  If `true`, the output excludes interim results.
- **overall_score** (number)
  Returns overall buckets with overall scores greater than or equal to this
  value.
- **start** (string | number)
  Returns overall buckets with timestamps after this time.
- **top_n** (number)
  The number of top anomaly detection job bucket scores to be used in the
  `overall_score` calculation.

### Body: application/json (object)

- **allow_no_match** (boolean)
  Refer to the description for the `allow_no_match` query parameter.
- **bucket_span** (string)
  Refer to the description for the `bucket_span` query parameter.
- **end** (string | number)
  Refer to the description for the `end` query parameter.
- **exclude_interim** (boolean)
  Refer to the description for the `exclude_interim` query parameter.
- **overall_score** (number)
  Refer to the description for the `overall_score` query parameter.
- **start** (string | number)
  Refer to the description for the `start` query parameter.
- **top_n** (number)
  Refer to the description for the `top_n` query parameter.


## Responses
### 200


#### Body: application/json (object)
- **count** (number)

- **overall_buckets** (array[object])
  Array of overall bucket objects


[Powered by Bump.sh](https://bump.sh)