In the em_event table, can anyone explain how the Process Duration is calculated?

[sivkr]

My assumption was that Process Duration represents the time difference between the Created and Processed fields, but that doesn’t seem to be correct.

I also checked the sa_performance_statistics table. It appears that events are grouped into buckets, and based on those bucket queries, they are processed to create actionable alerts. However, in our instance, the count_per_sec and avg_millisec columns in sa_performance_statistics are empty and not populated with any values.

My requirement is to create a dashboard showing:

• Total events created
• Total duration taken to process the events

We are displaying this report in 1-hour intervals, but the Process Duration we are assuming is not accurate.

Can anyone clarify:

1. How is Process Duration actually calculated?
2. How can we get values for count_per_sec and avg_millisec in the sa_performance_statistics table?
   
   Please find the attached screenshots.
   
   

[SIVASANKARIS]

In Event Management, Process Duration represents the actual time the Event Management engine spends actively processing an event, and it is measured in milliseconds. It’s more of an internal execution time than an end-to-end timestamp difference.

What this duration includes is the work done by the EM engine itself, such as:

• Event rule evaluation

• Correlation logic

• Alert creation or update

• Deduplication checks

• RCA and aggregation processing

Internally, ServiceNow calculates this as the difference between the processing start time and processing end time. These timestamps are runtime values used by the engine and are not exposed as fields on the em_event table.

That’s why you’ll notice:

• Processed – Created does not match Process Duration

• Two events created at the exact same time can still have very different process durations

In short, Process Duration reflects CPU execution time inside the EM engine, not wall-clock or end-to-end processing time,

Hope this clarifies how the field works internally, if this is helpful please mark it as helpful and accept the solution.

[sivkr]

Hi @SIVASANKARIS 

Thanks for the detailed clarification on how Process Duration works internally. That really helps!

I have a couple of follow-up questions:

Do you have any insights on how the avg_millisec and count_per_sec columns in the sa_performance_statistics table are populated?

Are these values calculated automatically by the Event Management engine, or do we need to enable/configure something on our end to start seeing data in these fields?
My requirement is to prepare a data visualization report that shows:

Total number of events received in the em_event table per day
Display this in 1-hour intervals for the entire day
Include the total time taken to process these events
Is there any recommended approach or best practice to achieve this? For example, can we leverage any existing tables or metrics in Event Management to calculate the processing time accurately for these hourly buckets?

Any inputs or guidance on these points would be greatly appreciated!