> ## Documentation Index
> Fetch the complete documentation index at: https://docs.honeycomb.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Investigate an Error Rate Anomaly

> Use Anomaly Detection and Canvas together to move from an error rate anomaly to a likely cause.

export const HnyIcon = ({alias, path, size = 16, iconColor}) => {
  const iconMap = {
    "home": "house.svg",
    "marker": "caretFilledDown.svg",
    "show-marker-options": "chatTextLeft.svg",
    "download": "arrowLineDown.svg",
    "trace-waterfall": "trace.svg",
    "show-query-details": "listDashes.svg",
    "table": "table.svg",
    "log-lines": "logLines.svg",
    "chart": "chartLine.svg",
    "show-settings": "gear.svg",
    "add": "plus.svg",
    "remove": "delete.svg",
    "persist": "caretDown.svg",
    "close": "close.svg",
    "copy": "copy.svg",
    "zoom-in": "magnifyingGlassPlus.svg",
    "zoom-out": "magnifyingGlassMinus.svg",
    "color-assignment": "drop.svg",
    "drag": "dots-six-vertical.svg",
    "drawer": "drawer.svg",
    "show-actions": "dotsThree.svg",
    "edit": "pencil.svg",
    "delete": "trash.svg",
    "move": "arrowsOutCardinal.svg",
    "show-legend": "circleInfo.svg",
    "usage-ok": "usageGood.svg",
    "usage-warning": "usageWarning.svg",
    "usage-danger": "usageDanger.svg",
    "open-query-builder": "query.svg",
    "home-menu": "house.svg",
    "query-menu": "query.svg",
    "boards-menu": "board.svg",
    "triggers-menu": "bell.svg",
    "slos-menu": "handshake.svg",
    "service-map-menu": "serviceMap.svg",
    "history-menu": "clockCounterClockwise.svg",
    "manage-data-menu": "cube.svg",
    "usage-menu": "usageGood.svg",
    "canvas-menu": "sparkle.svg",
    "anomalies-menu": "anomalies.svg",
    "show-details": "dotsThreeVertical.svg",
    "resize-handle": "board-panel-resize-handle.png",
    "standard-dataset": "cube.svg",
    "trace-dataset": "cubeChat.svg",
    "all-datasets": "linkedSquares.svg",
    "share": "arrowBentRight.svg",
    "run-in-query-builder": "arrowSquareUpRight.svg",
    "link": "link.svg",
    "text": "text.svg",
    "receive": "arrowLineDown.svg",
    "process": "lightning.svg",
    "sample": "drop.svg",
    "send": "arrowLineUp.svg",
    "submit": "arrowUp.svg",
    "canvas-menu": "sparkle.svg",
    "canvas": "sparkle.svg",
    "chat-about-this-page": "sparkle.svg",
    "private": "lockKey.svg",
    "shared": "people.svg",
    "expand": "caretDown.svg",
    "previous": "caretLeft.svg",
    "next": "caretRight.svg",
    "expand-chat": "caretLeft.svg",
    "minimize-chat": "caretRight.svg",
    "open-in-canvas": "arrowSquareUpRight.svg",
    "send-test": "EnvelopeSimple.svg"
  };
  const iconBasePath = "/_assets/icons/";
  const iconPath = path || (alias ? `${iconBasePath}${iconMap[alias]}` : undefined);
  return <span className="hny-icon" style={{
    display: "inline-block",
    width: `${size}px`,
    height: `${size}px`,
    maskImage: `url(${iconPath})`,
    maskSize: "contain",
    maskRepeat: "no-repeat",
    maskPosition: "center",
    WebkitMaskImage: `url(${iconPath})`,
    WebkitMaskSize: "contain",
    WebkitMaskRepeat: "no-repeat",
    WebkitMaskPosition: "center",
    backgroundColor: iconColor || "var(--hny-icon-color)",
    verticalAlign: "middle"
  }} />;
};

<Badge className="hny-badge-beta">Beta</Badge>

When Anomaly Detection flags a service as **Anomalous** on its Error Rate signal, the immediate question is whether the deviation reflects a real problem and how far it has spread.
This workflow takes you from the alert to a confirmed cause, using the chart, the anomaly history, and a Canvas investigation together.

## Investigate the anomaly

<Steps titleSize="h3">
  <Step title="Open the anomaly">
    Open the anomaly and start an investigation:

    1. Select **Anomalies** (<HnyIcon alias="anomalies-menu" />) from the navigation menu.
    2. Find the service showing as **Anomalous**.
    3. Select **Investigate** (or **View Investigation** if a Canvas investigation is already underway).
  </Step>

  <Step title="Compare the chart against the typical range">
    On the service's **Error Rate** view, locate the shaded typical range band on the chart.
    Compare the current value against that band, and note whether the deviation is a single spike or a sustained shift.
  </Step>

  <Step title="Review the anomaly history">
    In the **Anomalies** section of the service's detail page, review anomalies detected in the current time range.
    Select a wider time range, such as **30 days**, to see whether this is a recurring pattern for the service or a first occurrence.
  </Step>

  <Step title="Check the Canvas investigation">
    If auto-investigate is turned on for the service, open the Canvas investigation that started automatically and review its likely cause.
    If a Slack channel is configured as a recipient, check that channel too since Canvas joins the thread with its findings.

    If auto-investigate isn't turned on, select **Run Query** from the chart to open the underlying query in Query Builder, then run BubbleUp against the anomalous period.
  </Step>
</Steps>

## Make the call

With the chart, history, and investigation findings in hand, you have what you need to decide how to respond:

* If the deviation is sustained, affects a large share of traffic, or matches a known incident pattern, escalate to the configured recipients and continue the investigation in Canvas or Query Builder.
* If the deviation is a brief spike, isolated to a small slice of traffic, or explained by a known deploy or maintenance window, you can close the investigation with confidence rather than escalating further.