--- sourceDocument: Australia Impact sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/impact Release : - australia ft:locale : - en-US ft:publication_title : - Australia Impact ft:clusterId : - ipact bundleId : - ipact --- # Anomaly insights # Anomaly insights {#ariaid-title1} * Release version: Australia * * Updated March 30, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Anomaly insights Anomaly Insights provides a visual analysis of performance data, highlighting anomalies within time series metrics. The x-axis displays time, and the y-axis shows metric values over a selected date range. Anomalies are marked as red points on the chart, indicating deviations based on specific detection algorithms. This feature helps you quickly identify unusual behavior in various system and application performance metrics. Show full answer Show less ## Key Features * **Anomaly Visualization:** Anomalies appear as red marks on charts, selectable for detailed inspection, particularly for semaphore and node memory max metrics with node metadata. * **Aggregation Levels:** Different metrics use appropriate aggregation levels and types to reflect accurate anomaly detection, varying between instance and node levels as needed. * **Roll-up Logic:** Metric values are aggregated at different granularities based on the selected date range, such as 1-minute, 10-minute, or hourly roll-ups, to balance detail and performance. * **Metric Specifics:** User Transaction Count, Server Response Time, SQL Response Time, and others have tailored aggregation and roll-up rules ensuring meaningful anomaly detection. * **Data Availability:** Anomaly data is retained and available for analysis up to 28 days from the current date. ## Practical Considerations for ServiceNow Customers * When analyzing node-level performance like semaphore and node memory, use a common 1-minute roll-up granularity on the x-axis to align default and anomaly charts. * Be aware that default charts and anomaly charts may show differing metric values due to different aggregation methods---especially at 10-minute roll-ups and for SQL Response Time metrics. * For date ranges greater than 7 days, metric aggregation shifts to coarser intervals (e.g., 10 minutes or 1 hour), which affects anomaly detection sensitivity and data comparison. * Node-level metrics aggregate anomalies at the instance level in anomaly charts, so metric values may differ from node-level default charts despite using the same aggregation type. * Select anomalous points on charts to view detailed metadata only if the point is identified as anomalous; normal data points do not provide this additional detail. ## Expected Outcomes With Anomaly Insights, ServiceNow customers gain the ability to: * Visually detect and investigate unusual performance patterns in system and application metrics. * Understand metric behavior over various time granularities for accurate trend analysis. * Correlate anomalies to specific nodes or instances with detailed metadata for targeted troubleshooting. * Make informed decisions based on reliable anomaly detection within a 28-day data window. The reference topic gives additional information for anomaly charts. ## Additional information for anomaly {#addl-inf-io-anomaly__section_htp_y2x_t3c} * In Anomaly charts, the x axis represents time series and the y-axis represents the actual metrics per date range you select. Anomalies are denoted by red color code on the chart. Each red point represents the occurrence of an anomaly in the data. The specific placement of the red mark depend on the criteria or algorithm used to detect anomalies. * In case of node level performance chart (like semaphore and node memory), you must select the common grain for x axis (1 minute roll up) if you must tally the data between default and anomaly tab. Performance chart is represented at the node level, however, anomalies are aggregated at an instance level. * The anomalous points are selectable for semaphore and Node Memory max metrics in Anomaly chart that will be enabled with node metadata beyond the normal range. You must select View detail for the same. This Information will not reflect for non-anomalous points. In case of 10-min grain data, the anomaly is calculated based on 15-min average data point. Therefore, this will list all nodes beyond the range in the last 15 minutes. {#addl-inf-io-anomaly__ul_qvy_y2x_t3c} ## Aggregation level of each metric {#addl-inf-io-anomaly__section_ght_cfx_t3c} {#addl-inf-io-anomaly__table_q2n_2fx_t3c__entry__5} | Metric Name | Aggregation Level Default Chart | Aggregation Level Anomaly Chart | Aggregation Type Default Chart | Aggregation Type Anomaly Chart | |-|-|-|-|-| | User Transaction Count | Instance | Instance | Sum | Sum | | Average Server Response Time | Instance | Instance | Weighted Average | Weighted Average | | SQL Response Time | Instance | Instance | Average | Weighted Average | | Semaphore Default Mean | Node | Instance | Max | Max | | Node Memory Max | Node | Instance | Max | Max | | Semaphore Default Queue Depth | Node | Instance | Max | Max | | Semaphore API Int In Use | Node | Instance | Max | Max | | Semaphore API Int Queue Depth | Node | Instance | Max | Max | | Semaphore AMB Send Queue Depth | Node | Instance | Max | Max | | Garbage Collection | Instance | Instance | Max | Max | | CPU Time | Instance | Instance | Sum | Sum | | Threads Running | Instance | Instance | Max | Max | | InnoDBrowLock | Instance | Instance | Max | Max | | Slow Queries | Instance | Instance | Max | Max | [ ] {#addl-inf-io-anomaly__table_q2n_2fx_t3c} ## Roll up logic {#addl-inf-io-anomaly__rollup_primary_metrics} User Transaction Count \| Average Server Response Time \| SQL Response Time : * When selected date range is less than or equal to 7 days, metric values are rolled up at the 1-minute level. * When selected date range is greater than 7 days but less than 30 days, metric values are rolled up at the 10-minute level. * When selected date range is greater than 30 days, metric values are rolled up at the 1-hour level. * Default chart metric values will not match with the anomaly chart metric values when data is rolled up at the 10-minute level, because the default chart uses a 10-minute metric value average whereas the anomaly chart uses a 15-minute moving average. * Default chart metric values will match with the anomaly chart metric values when aggregation is at the 1-minute level for User Transaction Count and Average Server Response Time. Values will not match for SQL Response Time because the default chart uses Average aggregation whereas the anomaly chart uses Weighted Average. * Anomaly chart data is available for a maximum of 28 days from the current date. {#addl-inf-io-anomaly__ul_lwl_hrx_t3c} Other metrics : * When selected date range is less than or equal to 24 hours, metric values are rolled up at the 1-minute level. * When selected date range is greater than 1 day but less than 7 days, metric values are rolled up at the 5-minute level. * When selected date range is greater than 7 days but less than 30 days, metric values are rolled up at the 10-minute level. * When selected date range is greater than 30 days but less than 60 days, metric values are rolled up at the 1-hour level. * When selected date range is greater than 60 days but less than 90 days, metric values are rolled up at the 2-hour level. * When selected date range is greater than 90 days but less than 120 days, metric values are rolled up at the 4-hour level. * When selected date range is greater than 120 days but less than 150 days, metric values are rolled up at the 8-hour level. * When selected date range is greater than 150 days but less than 180 days, metric values are rolled up at the 12-hour level. * Default chart metric values will not match with anomaly chart metric values for node-level metrics, because the default chart aggregates at the node level whereas the anomaly chart aggregates at the instance level. Note that the aggregation type (Max) remains the same across both charts for these metrics. * Anomaly chart data is available for a maximum of 28 days from the current date. {#addl-inf-io-anomaly__ul_xnm_3rx_t3c} **Related reference** * [Feature availability based on package](https://servicenow-prod.fluidtopics.net/P9qjLGc3vCF_cOO3tzGPpA "The table outlines the access permissions for Performance Analytics features across production and sub production instances.") * [Auriga Intelligent Alert report](https://servicenow-prod.fluidtopics.net/nQSJ7KPMZhRA30JC0WUapA "Auriga Intelligent Alert is an advanced multivariate machine learning (ML) model that learns from historical issues on your instance to provide real-time insight. Auriga monitors your performance metrics to deliver notifications of noteworthy events or deviations from anticipated data patterns.") * [Transaction or response metrics](https://servicenow-prod.fluidtopics.net/zO1ipLkzD4Ui4sKzEQk4bg "The metrics provide a performance snapshot of classic UI transactions within the ServiceNow AI Platform.") * [Database performance metrics](https://servicenow-prod.fluidtopics.net/BR2AN_h8wOEd8ZtqZdLf4A "The metrics provide the database performance snapshot within the ServiceNow AI Platform.") * [Semaphores performance metrics](https://servicenow-prod.fluidtopics.net/Kk9mReT78mDBECtqFl7MWQ "The metrics provide the key performance indicators calculated at the instance level for the selected duration.") * [Event queues performance metrics](https://servicenow-prod.fluidtopics.net/gJEASVHBrJdFQHIBS8345w "The metrics provide the event performance snapshot within the ServiceNow AI Platform.") * [ECC Queue performance metrics](https://servicenow-prod.fluidtopics.net/RGxMtNOGgtVY6Q5itGNFaQ "The metrics provide the ECC Queue performance snapshot within the ServiceNow AI Platform.") * [Email performance metrics](https://servicenow-prod.fluidtopics.net/bogAIEvZQM6EVgHuNANWkw "The metrics provide the Email performance snapshot within the ServiceNow AI Platform.") * [Scheduler performance metrics](https://servicenow-prod.fluidtopics.net/mUgSGAMhziXWPxkMp4ZZJQ "The metrics provide the Schedulers performance snapshot within the ServiceNow AI Platform.") * [Job details performance metrics](https://servicenow-prod.fluidtopics.net/zU5pCERdUDwYINhrEtEmVw "The metrics provide the job details performance snapshot within the ServiceNow AI Platform.") * [Node health performance metrics](https://servicenow-prod.fluidtopics.net/Ym_5QZb7HaUEXusPO0FNVA "The metrics provide the node health performance snapshot within the ServiceNow AI Platform.") * [Host health performance metrics](https://servicenow-prod.fluidtopics.net/BPg~fi7mWtO2QDvoJtmlbw "The metrics provide the host health performance snapshot within the ServiceNow AI Platform.") * [Standby replication Lag](https://servicenow-prod.fluidtopics.net/~bnGXSPhIInh_QygPmu8lA "A read replica is a copy of the primary DB that reflects changes to the primary in almost real time, in normal circumstances. The lag represents the database server of the instance that is behind in seconds.") * [Pool Replication Lag](https://servicenow-prod.fluidtopics.net/GZt7jzZ4mbs0axGHLTG75w "Pool replication lag is the number of seconds that a Standby database or a read replica database lags behind the primary database.") * [Chat details performance metrics](https://servicenow-prod.fluidtopics.net/3ITlZgnjjx7hFU0jPdggHA "For the operations team to get the insights of current load across main components of AWA channel infrastructure like queues and agents, and to monitor load during events of chat spikes.") * [Cluster details performance metrics](https://servicenow-prod.fluidtopics.net/gCpPJvTx4G~JcYX9~VAIVA "The metrics provide the cluster details and Encryption status snapshot within the ServiceNow AI Platform.") * [Load balancer performance metrics](https://servicenow-prod.fluidtopics.net/U6~7lb0jujHirGTJlHHmZA "The metrics provide the load balancer performance snapshot within the ServiceNow AI Platform.") * [User information metrics](https://servicenow-prod.fluidtopics.net/tzinVKez9tWy7F1KJoK7mg "The metrics provide the user information performance snapshot within the ServiceNow AI Platform.") * [Instance Data Replication](https://servicenow-prod.fluidtopics.net/ScxZA~8x58vIrm57FTmurg "The Instance Data Replication (IDR) copies data updates from one instance, called the producer instance, to one or more other instances called the consumer instances.")