bugfix for anomaly scores logic due to usage of stddev_pop

Author: haritamar

macros/edr/data_monitoring/anomaly_detection/get_anomaly_scores_query.sql

@@ -190,7 +190,8 @@
                 metric_name,
                 case
                     when training_stddev is null then null
-                    when training_stddev = 0 then 0
+                    when training_set_size = 1 then null  -- Single value case - no historical context for anomaly detection
+                    when training_stddev = 0 then 0  -- Stationary data case - valid, all values are identical
                     else (metric_value - training_avg) / (training_stddev)
                 end as anomaly_score,
                 {{ test_configuration.anomaly_sensitivity }} as anomaly_score_threshold,
@@ -202,12 +203,12 @@
 
                 {% set limit_values =  elementary.get_limit_metric_values(test_configuration) %}
                 case
-                    when training_stddev is null then null
+                    when training_stddev is null or training_set_size = 1 then null
                     when {{ limit_values.min_metric_value }} > 0 or metric_name in {{ elementary.to_sql_list(elementary.get_negative_value_supported_metrics()) }} then {{ limit_values.min_metric_value }}
                     else 0
                 end as min_metric_value,
                 case 
-                    when training_stddev is null then null
+                    when training_stddev is null or training_set_size = 1 then null
                     else {{ limit_values.max_metric_value }}
                 end as max_metric_value,
                 training_avg,

macros/edr/data_monitoring/monitors/column_numeric_monitors.sql

@@ -35,6 +35,9 @@
 {%- endmacro %}
 
 {% macro dremio__standard_deviation(column_name) -%}
+    -- Dremio's stddev in window functions can raise division by zero with single values
+    -- stddev_pop returns 0 for single values instead of raising an error
+    -- We'll handle the single-value case in the anomaly detection logic using training_set_size
     stddev_pop(cast({{ column_name }} as {{ elementary.edr_type_float() }}))
 {%- endmacro %}
 

models/edr/data_monitoring/anomaly_detection/metrics_anomaly_score.sql

@@ -46,7 +46,8 @@ metrics_anomaly_score as (
         metric_name,
         case
             when training_stddev is null then null
-            when training_stddev = 0 then 0
+            when training_set_size = 1 then null  -- Single value case - no historical context for anomaly detection
+            when training_stddev = 0 then 0  -- Stationary data case - valid, all values are identical
             else (metric_value - training_avg) / (training_stddev)
         end as anomaly_score,
         metric_value as latest_metric_value,