A telecom feed shows two spikes. One matches a logged congestion incident and the neighboring links moved with it. The other is a single probe that jumped to an impossible reading while every neighbor stayed flat. Which handling fits the evidence?
Select an answer to reveal the explanation.
Short Explanation
A storm that hits the whole block belongs in the log, and a pen slip on one gauge does not. Keep the congestion spike that neighbors and the incident log both support, and repair the impossible lone probe before you train. Deleting every spike, or keeping every spike, throws away that distinction.
Full Explanation
An extreme value stays when independent evidence says the event happened, and it is set aside when the evidence says the sensor failed. The congestion spike matches the incident log and the neighboring links moved with it, so it is a real extreme the model should be allowed to see. The other spike is physically implausible and every neighbor stayed flat, so it is a bad probe reading rather than a network event. Deleting both throws away a documented incident along with the bad probe. Keeping both teaches the model that an impossible lone reading is a real event. Keeping the impossible reading and dropping the logged incident reverses the evidence, discarding the corroborated event and preserving the failure. Exam caveat: rarity alone is not a reason to delete; the split is corroboration versus a reading the sensor could not honestly have produced. Operational check: join each spike to the incident log and to the neighboring links before anything is removed, and keep the spike that those sources support.