Anomaly insights

  • Release version: Australia
  • Updated March 30, 2026
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Anomaly insights

    Anomaly Insights provides a visual analysis of performance data, highlighting anomalies within time series metrics. The x-axis displays time, and the y-axis shows metric values over a selected date range. Anomalies are marked as red points on the chart, indicating deviations based on specific detection algorithms. This feature helps you quickly identify unusual behavior in various system and application performance metrics.

    Show full answer Show less

    Key Features

    • Anomaly Visualization: Anomalies appear as red marks on charts, selectable for detailed inspection, particularly for semaphore and node memory max metrics with node metadata.
    • Aggregation Levels: Different metrics use appropriate aggregation levels and types to reflect accurate anomaly detection, varying between instance and node levels as needed.
    • Roll-up Logic: Metric values are aggregated at different granularities based on the selected date range, such as 1-minute, 10-minute, or hourly roll-ups, to balance detail and performance.
    • Metric Specifics: User Transaction Count, Server Response Time, SQL Response Time, and others have tailored aggregation and roll-up rules ensuring meaningful anomaly detection.
    • Data Availability: Anomaly data is retained and available for analysis up to 28 days from the current date.

    Practical Considerations for ServiceNow Customers

    • When analyzing node-level performance like semaphore and node memory, use a common 1-minute roll-up granularity on the x-axis to align default and anomaly charts.
    • Be aware that default charts and anomaly charts may show differing metric values due to different aggregation methods—especially at 10-minute roll-ups and for SQL Response Time metrics.
    • For date ranges greater than 7 days, metric aggregation shifts to coarser intervals (e.g., 10 minutes or 1 hour), which affects anomaly detection sensitivity and data comparison.
    • Node-level metrics aggregate anomalies at the instance level in anomaly charts, so metric values may differ from node-level default charts despite using the same aggregation type.
    • Select anomalous points on charts to view detailed metadata only if the point is identified as anomalous; normal data points do not provide this additional detail.

    Expected Outcomes

    With Anomaly Insights, ServiceNow customers gain the ability to:

    • Visually detect and investigate unusual performance patterns in system and application metrics.
    • Understand metric behavior over various time granularities for accurate trend analysis.
    • Correlate anomalies to specific nodes or instances with detailed metadata for targeted troubleshooting.
    • Make informed decisions based on reliable anomaly detection within a 28-day data window.

    The reference topic gives additional information for anomaly charts.

    Additional information for anomaly

    • In Anomaly charts, the x axis represents time series and the y-axis represents the actual metrics per date range you select. Anomalies are denoted by red color code on the chart. Each red point represents the occurrence of an anomaly in the data. The specific placement of the red mark depend on the criteria or algorithm used to detect anomalies.
    • In case of node level performance chart (like semaphore and node memory), you must select the common grain for x axis (1 minute roll up) if you must tally the data between default and anomaly tab. Performance chart is represented at the node level, however, anomalies are aggregated at an instance level.
    • The anomalous points are selectable for semaphore and Node Memory max metrics in Anomaly chart that will be enabled with node metadata beyond the normal range. You must select View detail for the same. This Information will not reflect for non-anomalous points. In case of 10-min grain data, the anomaly is calculated based on 15-min average data point. Therefore, this will list all nodes beyond the range in the last 15 minutes.

    Aggregation level of each metric

    Metric Name Aggregation Level

    Default Chart

    		 Aggregation Level

    Anomaly Chart

    		 Aggregation Type

    Default Chart

    		 Aggregation Type

    Anomaly Chart
    User Transaction Count Instance Instance Sum Sum
    Average Server Response Time Instance Instance Weighted Average Weighted Average
    SQL Response Time Instance Instance Average Weighted Average
    Semaphore Default Mean Node Instance Max Max
    Node Memory Max Node Instance Max Max
    Semaphore Default Queue Depth Node Instance Max Max
    Semaphore API Int In Use Node Instance Max Max
    Semaphore API Int Queue Depth Node Instance Max Max
    Semaphore AMB Send Queue Depth Node Instance Max Max
    Garbage Collection Instance Instance Max Max
    CPU Time Instance Instance Sum Sum
    Threads Running Instance Instance Max Max
    InnoDBrowLock Instance Instance Max Max
    Slow Queries Instance Instance Max Max

    Roll up logic

    User Transaction Count | Average Server Response Time | SQL Response Time
    • When selected date range is less than or equal to 7 days, metric values are rolled up at the 1-minute level.
    • When selected date range is greater than 7 days but less than 30 days, metric values are rolled up at the 10-minute level.
    • When selected date range is greater than 30 days, metric values are rolled up at the 1-hour level.
    • Default chart metric values will not match with the anomaly chart metric values when data is rolled up at the 10-minute level, because the default chart uses a 10-minute metric value average whereas the anomaly chart uses a 15-minute moving average.
    • Default chart metric values will match with the anomaly chart metric values when aggregation is at the 1-minute level for User Transaction Count and Average Server Response Time. Values will not match for SQL Response Time because the default chart uses Average aggregation whereas the anomaly chart uses Weighted Average.
    • Anomaly chart data is available for a maximum of 28 days from the current date.
    Other metrics
    • When selected date range is less than or equal to 24 hours, metric values are rolled up at the 1-minute level.
    • When selected date range is greater than 1 day but less than 7 days, metric values are rolled up at the 5-minute level.
    • When selected date range is greater than 7 days but less than 30 days, metric values are rolled up at the 10-minute level.
    • When selected date range is greater than 30 days but less than 60 days, metric values are rolled up at the 1-hour level.
    • When selected date range is greater than 60 days but less than 90 days, metric values are rolled up at the 2-hour level.
    • When selected date range is greater than 90 days but less than 120 days, metric values are rolled up at the 4-hour level.
    • When selected date range is greater than 120 days but less than 150 days, metric values are rolled up at the 8-hour level.
    • When selected date range is greater than 150 days but less than 180 days, metric values are rolled up at the 12-hour level.
    • Default chart metric values will not match with anomaly chart metric values for node-level metrics, because the default chart aggregates at the node level whereas the anomaly chart aggregates at the instance level. Note that the aggregation type (Max) remains the same across both charts for these metrics.
    • Anomaly chart data is available for a maximum of 28 days from the current date.