Abstract: Implementations identify anomalous events from indexed events. An example system receives s dimension(s) for events, a test start time and a test duration defining a test interval. The system may identify a set of events matching the dimension(s). The set includes events occurring within a test interval or within one of at least two reference intervals. The system generates, for the test interval and the reference intervals, an aggregate value for each unique combination of dimension values in the set of events. The system selects at least one of the unique combination of dimension values for anomaly detection based on a comparison of the aggregate values for the reference intervals and the test interval, and performs anomaly detection on a historical time series for the selected unique combination of dimension values. The system may report any of the selected unique combination of dimension values identified as an anomaly.