For each of a plurality of time intervals over which metric data is collected from periodic polling of a network of devices, a determination is made of whether metric data of the time interval satisfies a criterion for normal data values defined for a metric corresponding to the metric data. The metric data is marked as anomaly data, in response to determining that the metric data does not satisfy the criterion defined for the metric corresponding to the metric data of the time interval. The metric data is marked as normal data, in response to determining that the metric data satisfies the criterion defined for the metric corresponding to the metric data of the time interval. The metric data marked as normal data is stored in a first database, and the metric data marked as anomaly data and corresponding time intervals in a second database.