[ML] Improve results view for population analysis

[elasticmachine]

Original comment by @sophiec20:

Consider how we can improve the context given to help explain the results from a population analysis.

Current Anomaly Explorer charts plot a metric against time. For a population analysis, the unusual entity often does not contain a timeline of data, which means the plot can be quite sparse. We also click through from these charts to the Single Metric Viewer for which the same issue exists.

Once we provide a job creation wizard for a population analysis, this requirement will become more pronounced.

---

Phase 1 (Updates to the existing interface)

• Show data gaps for charts with sparse data
• Filtering: The ability to filter e.g. by influencer would allow the anomaly explorer to focus on a single entity, thus allowing to use all the features of the existing interface of the anomaly explorer to investigate a single entity of a population. See also [ML] Add filtering to Explorer Dashboard #18262 The structure of the anomaly explorer is already similar to the discover feature of Kibana. By further aligning the design and features, we can improve the usability for users who come from Kibana: Kibana's "Discover" has a top bar for search+filtering, a sidebar for fields and a main view for the histogram and table for individual results. The anomaly explorer also has a top bar (At the moment only used to display the job selector dropdown), a sidebar (top influencers) and a main view (swimlanes and anomaly table). The top bar can be extended to allows filters (e.g. filter by a given influencer). Similar to how Kibana's "Discover" offers the ability in the sidebar to "add" a field, the top influencer sidebar could be used to allow the selection of influencers as filters. Mockups will follow.
• View by detector: Currently the UI is optimized towards creating multiple jobs with each one detector. Having an option to view the swimlanes split by detector would allow to create single jobs with multiple detectors more effectively, this would be esp. useful for population analysis to cross-reference the influence of detector on anomalies detected for an entity. [ML] End-user can view Anomaly Explorer swimlane by detector #18045
• Enhance Swimlane Drill-Down: At the moment we're able to select single cells in the swimlanes. These act as a filter for the anomaly charts and table. However, one might also be interested in ranges of cells. This would allow a more fine grained comparison of entities: For example, selecting two cells vertically across two swimlanes would pull up two anomaly charts for just that selection. An additional feature could be to allow to select the label of a swimlane to focus on a whole single swimlane.
• Custom Links for population analysis: For population analysis with a lot of entities with sparse data, the default "View Results" link which links to the single metric viewer isn't always very useful. Jobs create via the population wizard could feature a different set of links which better suit the use case of population analysis.
• Improve sampling for population chart: The sampling used to plot the background population sometimes does not show many dots around the population typical (see [ML] Extend population preview chart to show actual and typical value #67569 (comment)). For anomalies where the actual is unusually low, this can lead to confusion as to why the anomaly plotted on the chart is unusual with respect to the typical values for the population.

---

Phase 2 (More influental UI changes/additions)

• Multi-Dimensional Data Exploration: (bs-bingo alert :)) Provide an alternative view in addition to the swimlanes view. The main swimlane would stay to be able to select and drill-down on a given time range. However the current view with grouped swimlanes could be switched to an alternative possibly based on the small-multiples-prototype (LINK REDACTED). This would open the usage of the anomaly explorer to other use cases, where the primary interest is not the distribution of anomalies over time, but the distribution across multiple other dimensions, e.g. this would allow to compare the distribution of anomalies across multiple detectors (like distinct_count(url) and count).
• Anomaly Charts/Table Revamp: Think of a way to combine the anomaly charts and table. At the moment the two apply the same drill-down information but are shown on top of each other with the charts often in the way of quickly getting to the table. It's also hard to cross-identify data points in charts and table. Also, the charts are limited to 6. One possible approach: Each chart could be part of a table row. Additionally, allow grouping of the table across different columns (similar to how we already offer the grouping of time with the interval dropdown), so for example, anomalies could be grouped by influencer or population field.