Techniques are described for an anomaly detection service for metric data collected by a data monitoring service of a service provider network. The anomaly detection service provides various graphical user interfaces (GUIs), public application programming interfaces (APIs), and other interfaces that enable users to specify metric data of interest to the user and for which the user desires the service to detect occurrences of anomalies. The selected metric data generally can correspond to any type of time series data collected by the data monitoring service and to which a user has access. Example types of metric data that can be monitored by an anomaly detection service include, but are not limited to, operational data generated by various components of a computer system, business data generated by various types of applications, and the like.