Add note to prevent using multiple time functions in a single ML job

[sodhikirti07]

Description

The Security ML team during testing of one of our Anomaly detection job found out that using both time_of_week and time_of_day functions within a single job config is not ideal. This is because time_of_week uses a different time format, modeling time as epoch seconds modulo the number of seconds in a week. To prevent confusion and save time, it’s recommended to add a note advising against this, either at the beginning of the page or within the time_of_week section.

We can add something similar to below:

Since time_of_day and time_of_week use different time formats, we recommend against using them together in a single Anomaly Detection job.

Related Issue:

• https://github.com/elastic/security-ml/issues/699

[jmikell821]

Hi @szabosteve -- can you take a look at this issue? Let me know if we need to do anything on the Security side.