In the em_event table, can anyone explain how the Process Duration is calculated?

sivkr
Tera Contributor

2 hours ago


My assumption was that Process Duration represents the time difference between the Created and Processed fields, but that doesn’t seem to be correct.

I also checked the sa_performance_statistics table. It appears that events are grouped into buckets, and based on those bucket queries, they are processed to create actionable alerts. However, in our instance, the count_per_sec and avg_millisec columns in sa_performance_statistics are empty and not populated with any values.

My requirement is to create a dashboard showing:

  • Total events created
  • Total duration taken to process the events

We are displaying this report in 1-hour intervals, but the Process Duration we are assuming is not accurate.

Can anyone clarify:

  1. How is Process Duration actually calculated?
  2. How can we get values for count_per_sec and avg_millisec in the sa_performance_statistics table?
    Please find the attached screenshots.

    sivkr_0-1767356085335.pngsivkr_0-1767356407481.png

     

     
0 Helpfuls
  • 103 Views
1 REPLY 1

SIVASANKARIS
Tera Contributor

an hour ago

In Event Management, Process Duration represents the actual time the Event Management engine spends actively processing an event, and it is measured in milliseconds. It’s more of an internal execution time than an end-to-end timestamp difference.

What this duration includes is the work done by the EM engine itself, such as:

  • Event rule evaluation

  • Correlation logic

  • Alert creation or update

  • Deduplication checks

  • RCA and aggregation processing

Internally, ServiceNow calculates this as the difference between the processing start time and processing end time. These timestamps are runtime values used by the engine and are not exposed as fields on the em_event table.

That’s why you’ll notice:

  • Processed – Created does not match Process Duration

  • Two events created at the exact same time can still have very different process durations

In short, Process Duration reflects CPU execution time inside the EM engine, not wall-clock or end-to-end processing time,

Hope this clarifies how the field works internally, if this is helpful please mark it as helpful and accept the solution.

0 Helpfuls