---
type: api
title: Get anomaly detection job results for influencers
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-ml-get-influencers
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-ml-get-influencers
products:
  - Elasticsearch
---

# Get anomaly detection job results for influencers


Availability: 5.4+

## Paths

- `POST` (also `GET`) `/_ml/anomaly_detectors/{job_id}/results/influencers`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

#### Path Parameters

- `job_id` (string Id)
  Identifier for the anomaly detection job.

## Description

Influencers are the entities that have contributed to, or are to blame for,
the anomalies. Influencer results are available only if an
`influencer_field_name` is specified in the job configuration.

## Required authorization

* Cluster privileges: `monitor_ml`

## Query String Parameters

- `desc` (boolean · default: false)
  If true, the results are sorted in descending order.
- `end` (DateTime · default: -1)
  Returns influencers with timestamps earlier than this time.
The default value means it is unset and results are not limited to
specific timestamps.
- `exclude_interim` (boolean · default: false)
  If true, the output excludes interim results. By default, interim results
are included.
- `influencer_score` (number · default: 0)
  Returns influencers with anomaly scores greater than or equal to this
value.
- `from` (number · default: 0)
  Skips the specified number of influencers.
- `size` (number · default: 100)
  Specifies the maximum number of influencers to obtain.
- `sort` (string Field)
  Specifies the sort field for the requested influencers. By default, the
influencers are sorted by the `influencer_score` value.
- `start` (DateTime · default: -1)
  Returns influencers with timestamps after this time. The default value
means it is unset and results are not limited to specific timestamps.

## Request Body

`application/json`

- `page` ({} Page) — optional
  Configures pagination.
This parameter has the `from` and `size` properties.
  - `from` (number · default: 0) — optional
    Skips the specified number of items.
  - `size` (number · default: 10000) — optional
    Specifies the maximum number of items to obtain.

## Response

`application/json`

- `count` (number)
- `influencers` ([] Influencer)
  Array of influencer objects
  - `bucket_span` (DurationValueUnitSeconds)
    The length of the bucket in seconds. This value matches the bucket span that is specified in the job.
  - `influencer_score` (number)
    A normalized score between 0-100, which is based on the probability of the influencer in this bucket aggregated
across detectors. Unlike `initial_influencer_score`, this value is updated by a re-normalization process as new
data is analyzed.
  - `influencer_field_name` (string Field)
    The field name of the influencer.
  - `influencer_field_value` (string)
    The entity that influenced, contributed to, or was to blame for the anomaly.
  - `initial_influencer_score` (number)
    A normalized score between 0-100, which is based on the probability of the influencer aggregated across detectors.
This is the initial value that was calculated at the time the bucket was processed.
  - `is_interim` (boolean)
    If true, this is an interim result. In other words, the results are calculated based on partial input data.
  - `job_id` (string Id)
    Identifier for the anomaly detection job.
  - `probability` (number)
    The probability that the influencer has this behavior, in the range 0 to 1. This value can be held to a high
precision of over 300 decimal places, so the `influencer_score` is provided as a human-readable and friendly
interpretation of this value.
  - `result_type` (string)
    Internal. This value is always set to `influencer`.
  - `timestamp` (EpochTimeUnitMillis)
    The start time of the bucket for which these results were calculated.
  - `foo` (string)
    Additional influencer properties are added, depending on the fields being analyzed. For example, if it’s
analyzing `user_name` as an influencer, a field `user_name` is added to the result document. This
information enables you to filter the anomaly results more easily.
## Code Examples

#### Console

```console
POST _ml/anomaly_detectors/high_sum_total_sales/results/influencers?desc=true&sort="influencer_score"
```

#### JavaScript

```javascript
const response = await client.ml.getInfluencers({
  job_id: "high_sum_total_sales",
  desc: "true",
  sort: '"influencer_score"',
});
```

#### Python

```python
resp = client.ml.get_influencers(
    job_id="high_sum_total_sales",
    desc=True,
    sort="\"influencer_score\"",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/results/influencers?desc=true&sort=" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  influencer_score""
```

#### Java

```java
client.ml().getInfluencers(g -> g
    .desc(true)
    .jobId("high_sum_total_sales")
    .sort(""influencer_score"")
);
```

#### C#

```c#
var response = await client.MachineLearning
    .GetInfluencersAsync(jobId: "high_sum_total_sales", d1 => d1
        .Desc(true)
        .Sort("\"influencer_score\"")
    );
```

#### PHP

```php
$resp = $client->ml()->getInfluencers([
    "job_id" => "high_sum_total_sales",
    "desc" => "true",
    "sort" => "\"influencer_score\"",
]);
```

#### Ruby

```ruby
response = client.ml.get_influencers(
  job_id: "high_sum_total_sales",
  desc: "true",
  sort: "\"influencer_score\""
)
```