Anomaly detection

Beta

This feature is in Beta.

This page describes what anomaly detection is, what it monitors, and how to use it.

important

Anomaly detection uses default storage.

What is anomaly detection?

Using anomaly detection, you can easily monitor the data quality of all of the tables in a schema. Databricks leverages data intelligence to automatically assess data quality, specifically evaluating the completeness and freshness of each table. Data owners have access to the logging table, which allows them to quickly identify and resolve anomalies across the entire metastore. Results at the catalog, schema, and table level are available in the Catalog Explorer or Governance Hub (Private Preview).

Requirements

• Unity Catalog enabled workspace.
• Existing users need serverless compute enabled. For instructions, see Connect to serverless compute.
• To enable anomaly detection on a schema, you must have MANAGE SCHEMA or MANAGE CATALOG privileges on the catalog schema.

How does anomaly detection work?

Databricks creates a background job that monitors tables for freshness and completeness. Databricks uses intelligent scanning to determine when to scan tables.

Intelligent scanning automatically aligns scan frequency with the table update cadence, ensuring that insights stay up to date without manual scheduling. The system prioritizes high-impact tables, as determined by popularity and downstream usage, while scanning less critical tables less frequently or skipping them altogether.

Freshness refers to how recently a table has been updated. Data quality monitoring analyzes the history of commits to a table and builds a per-table model to predict the time of the next commit. If a commit is unusually late, the table is marked as stale.

Completeness refers to the number of rows expected to be written to the table in the last 24 hours. Data quality monitoring analyzes the historical row count, and based on this data, predicts a range of expected number of rows. If the number of rows committed over the last 24 hours is less than the lower bound of this range, a table is marked as incomplete.

note

Event freshness, which is based on event time columns and ingestion latency, was available only to users of the data quality monitoring beta version. In the current version, event freshness is not supported.

Anomaly detection does not modify any tables it monitors, nor does it add overhead to any jobs that populate these tables.

Enable anomaly detection on a schema

To enable anomaly detection on a schema, navigate to the schema in Unity Catalog.

1. On the schema page, click the Details tab.

   

2. Click Enable. In the Data Quality Monitoring dialog, click Save.

3. A scan is initiated. Databricks automatically scans each table at the same frequency it’s updated, providing up-to-date insights without requiring manual configuration for each table. For schemas enabled prior to September 24, 2025, Databricks ran the monitor on historical data ("backtesting") for the first scan, to check the quality of your tables as if data quality monitoring had been enabled on your schema two weeks ago.

4. When the scan is complete, detected quality issues are logged in the output system table with insights populated in the UI. For details, see Review anomaly detection logged results. You can access the UI at any time by clicking See results next to the Data Quality Monitoring toggle.

Disable anomaly detection

To disable anomaly detection:

1. Click the pencil icon.

   

2. In the Data Quality Monitoring dialog, click the toggle.

   important

   When you disable anomaly detection, the anomaly detection job and all anomaly detection tables and information are deleted. This action cannot be undone.

   

3. Click Save.

Data quality monitoring UI

important

On October 7, 2025, Databricks released a new version of data quality monitoring. Schemas enabled for data quality monitoring on or after that date have a new results UI.

For information about the new UI, see View data quality monitoring results in the UI.

For information about the legacy UI, see Data quality dashboard (legacy).

Databricks recommends that you enable the new version for all of your existing schemas. The legacy dashboard from the beta version will no longer be updated.

To enable the new version, use the Data Quality Monitoring toggle to disable the feature, and then toggle again to re-enable it.

View data quality monitoring results in the UI

After you enable data quality monitoring on a schema, you can open the results page by clicking See results. You can also access results from all schemas that have monitoring enabled in Catalog Explorer.

The results UI contains catalog and schema dropdowns. When you select a catalog, the schema dropdown is populated with schemas in that catalog that have data quality monitoring enabled.

• If you have MANAGE or SELECT privileges on the catalog, you can view incidents at the catalog level.
• To view incidents for a specific schema, you must also have MANAGE or SELECT privileges on that schema. Selecting a schema then shows incidents for just that schema.

The UI has two main sections:

1. Summary section: Shows overall data quality for the selected scope, including the percentage of healthy tables and the percentage of schemas/tables currently monitored.
2. Incident section: Lists incidents across all monitored tables in the selected scope. You can filter for incidents on important tables determined using downstream impact analysis.

Each incident record includes the following details:

• Reason: Whether the table is unhealthy due to freshness or completeness.
• Since: The timestamp when the first incident was detected.
• Impact: A qualitative measure of downstream impact (High, Medium, or Low), based on the number of downstream tables and queries affected.
• Root cause: Information about upstream jobs contributing to the issue (see Review anomaly detection logged results for details).
• Review: A link to the table quality page where you can view historical trends and visualizations explaining why an anomaly was detected.

Table quality details

The Table Quality Details UI allows you to dive deeper into trends and understand why anomalies were detected for specific tables in your schema. You can access this view in several ways:

• From the Results UI (new experience), by clicking on the review link in the incidents list.
• From the Monitoring Dashboard (legacy Lakeview dashboard), by clicking on the table name in the Quality Overview tab.
• From the UC Table viewer, by visiting the Quality tab on the table page.

All options take you to the same Table Quality Details view for the selected table.

Given a table, the UI shows summaries from each quality check for the table, with graphs of predicted and observed values at each evaluation timestamp. The graphs plot results from the last 1 week of data.

If the table failed the quality checks, the UI also displays any upstream jobs that were identified as the root cause.

Set up alerts

To configure a Databricks SQL alert on the output results table, see Set up alerts based on anomaly detection.

Limitations

Anomaly detection does not support the following:

• Views or materialized views.
• The determination of completeness does not take into account metrics such as the fraction of nulls, zero values, or NaN.

Data quality dashboard (legacy)

note

The data quality monitoring dashboard was available only to legacy users. In the current version, use View data quality monitoring results in the UI.

The first data quality monitor run creates a dashboard to summarize results and trends derived from the logging table. The dashboard is automatically populated with insights for the scanned schema. A single dashboard is created per workspace at this path: /Shared/Databricks Quality Monitoring/Data Quality Monitoring.

Quality overview

The Quality Overview tab shows a summary of the latest quality status of tables in your schema based on the most recent evaluation.

To get started, you must enter the logging table for the schema you want to analyze to populate the dashboard.

The top section of the dashboard shows an overview of the results of the scan.

Below the summary is a table listing quality incidents by impact. Any identified root causes are displayed in the root_cause_analysis column.

Below the quality incident table is a table of identified static tables that have not been updated in a long time.

Set parameters for freshness and completeness evaluation (legacy)

note

Starting from July 21, 2025, configuration of the job parameters is not supported for new customers. If you need to configure the job settings, contact Databricks.

To edit the parameters that control the job, such as how often the job runs or the name of the logged results table, you must edit the job parameters on the Tasks tab of the job page.

The following sections describe specific settings. For information about how to set task parameters, see Configure task parameters.

Schedule and notifications (legacy)

To customize the schedule for the job, or to set up notifications, use the Schedules & Triggers settings on the jobs page. See Automating jobs with schedules and triggers.

Name of logging table (legacy)

To change the name of the logging table, or save the table in a different schema, edit the job task parameter logging_table_name and specify the desired name. To save the logging table in a different schema, specify the full 3-level name.

Customize freshness and completeness evaluations (legacy)

All of the parameters in this section are optional. By default, anomaly detection determines thresholds based on an analysis of the table's history.

These parameters are fields inside the task parameter metric_configs. The format of metric_configs is a JSON string with the following default values:

JSON

[
  {
    "disable_check": false,
    "tables_to_skip": null,
    "tables_to_scan": null,
    "table_threshold_overrides": null,
    "table_latency_threshold_overrides": null,
    "static_table_threshold_override": null,
    "event_timestamp_col_names": null,
    "metric_type": "FreshnessConfig"
  },
  {
    "disable_check": true,
    "tables_to_skip": null,
    "tables_to_scan": null,
    "table_threshold_overrides": null,
    "metric_type": "CompletenessConfig"
  }
]

The following parameters can be used for both freshness and completeness evaluations.

Field name	Description	Example
tables_to_scan	Only the specified tables are scanned.	["table_to_scan", "another_table_to_scan"]
tables_to_skip	The specified tables are skipped during the scan.	["table_to_skip"]
disable_check	Scan is not run. Use this parameter if you want to disable only the freshness scan or only the completeness scan.	true, false

The following parameters apply only to the freshness evaluation:

Field name	Description	Example
event_timestamp_col_names	List of timestamp columns tables in your schema might have. If a table has one of these columns, it is marked Unhealthy if the maximum value of this column is exceeded. Using this parameter might increase evaluation time and cost.	["timestamp", "date"]
table_threshold_overrides	A dictionary consisting of table names and thresholds (in seconds) that specify the maximum interval since the last table update before marking a table as Unhealthy.	{"table_0": 86400}
table_latency_threshold_overrides	A dictionary consisting of table names and latency thresholds (in seconds) that specify the maximum interval since the last timestamp in the table before marking a table as Unhealthy.	{"table_1": 3600}
static_table_threshold_override	Amount of time (in seconds) before a table is considered as a static table (that is, one that is no longer updated).	2592000

The following parameter applies only to the completeness evaluation:

Field name	Description	Example
table_threshold_overrides	A dictionary consisting of table names and row volume thresholds (specified as integers). If the number of rows added to a table over the previous 24 hours is less than the specified threshold, the table is marked Unhealthy.	{"table_0": 1000}