Anomaly Threshold (Z Score) Calculator

Work out anomaly threshold (z score) instantly with clear inputs, formula shown and shareable results.

About Anomaly Threshold (Z Score) Calculator

A z-score threshold flags any observation more than z standard deviations from the baseline mean. Under a normal distribution the two-sided tail probability is 2(1 - Phi(z)), which is 0.27 percent at z = 3. Multiply that by observations per day and you get the alert volume you have implicitly signed up for — at 100,000 observations, z = 3 still produces about 270 false pages a day.

Formula

z-score thresholds

upper = mean + z x sd; lower = mean - z x sd; false positive rate = 2 x (1 - Phi(z))

Worked example

With the default values below, Anomaly Threshold (Z Score) Calculator returns Upper anomaly threshold of 325.000. Change any input above and every figure here is recalculated in your browser.

Inputs used

Baseline mean: 220
Baseline standard deviationminimum 0: 35
z thresholdaccepts 0.5–8: 3
Observations per dayminimum 1: 100,000

Results

Upper anomaly threshold: 325.000
Lower anomaly threshold: 115.000
Expected false alerts per day: 269.99
Two-sided tail probability: 0.00269993

Step by step

1Values used
2z-score thresholds
3Upper anomaly threshold= 325.000
4Lower anomaly threshold= 115.000
5Expected false alerts per day= 269.99
6Two-sided tail probability= 0.00269993

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, fees or charges or compounding frequency into account.
Figures are rounded for display to 8 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why do I get so many alerts at z = 3?

Because the tail probability is multiplied by your observation count. High-volume metrics need z of 4 or 5, or aggregation into windows, to keep alert volume manageable.

What if the metric is not normally distributed?

Use robust statistics such as median and median absolute deviation, or empirical percentiles. Latency and traffic metrics are right-skewed and z-scores overflag their upper tail.