Anomaly insights

  • Release version: Australia
  • Updated March 30, 2026
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Anomaly insights

    Anomaly insights in ServiceNow provide visual anomaly detection on performance and transaction metrics over time. The anomaly charts plot time series data on the x-axis and metric values on the y-axis, highlighting anomalies with red points. These help identify unusual behavior in instance or node-level performance data to support proactive monitoring and troubleshooting.

    Show full answer Show less

    Key Features

    • Chart Axes and Anomalies: Time series on x-axis; actual metric values on y-axis; anomalies marked in red based on detection algorithms.
    • Node vs Instance Level Data: Performance charts are at node level; anomalies aggregated at instance level. For node-level metrics (e.g., semaphore, node memory), a 1-minute roll-up is needed to align default and anomaly charts.
    • Selectability: Anomalous points for semaphore and node memory max metrics are selectable to view detailed node metadata when values go beyond normal range.
    • Anomaly Calculation: For 10-minute grain data, anomalies are computed using a 15-minute moving average to capture nodes exceeding thresholds over the last 15 minutes.
    • Metric Aggregation and Roll-up: Different metrics have defined aggregation levels and types for default and anomaly charts, affecting how data is summarized and compared. For example:
      • User Transaction Count and Server Response Time values match at 1-minute aggregation, but SQL Response Time differs due to weighted average use in anomaly charts.
      • Roll-up intervals vary based on selected date ranges, ranging from 1-minute to 12-hour roll-ups depending on metric and time span.
    • Data Availability: Anomaly chart data is accessible for up to 28 days from the current date.
    • Metric Types Covered: Includes transaction counts, response times, semaphore metrics, garbage collection, CPU time, threads, slow queries, and other node and instance performance metrics.

    Practical Considerations for Customers

    • Ensure consistent time grain selection (especially 1-minute) when comparing anomaly charts with default performance charts to avoid discrepancies in metric values.
    • Understand that anomaly aggregations at the instance level may differ from node-level aggregations in default charts, particularly for node-specific metrics.
    • Use anomaly insights to detect and investigate performance deviations and bottlenecks by drilling down into anomaly details where available.
    • Plan monitoring and analysis within the 28-day anomaly data retention window to maximize insight utility.

    The reference topic gives additional information for anomaly charts.

    Additional information for anomaly

    • In Anomaly charts, the x axis represents time series and the y-axis represents the actual metrics per date range you select. Anomalies are denoted by red color code on the chart. Each red point represents the occurrence of an anomaly in the data. The specific placement of the red mark depend on the criteria or algorithm used to detect anomalies.
    • In case of node level performance chart (like semaphore and node memory), you must select the common grain for x axis (1 minute roll up) if you must tally the data between default and anomaly tab. Performance chart is represented at the node level, however, anomalies are aggregated at an instance level.
    • The anomalous points are selectable for semaphore and Node Memory max metrics in Anomaly chart that will be enabled with node metadata beyond the normal range. You must select View detail for the same. This Information will not reflect for non-anomalous points. In case of 10-min grain data, the anomaly is calculated based on 15-min average data point. Therefore, this will list all nodes beyond the range in the last 15 minutes.

    Aggregation level of each metric

    Metric Name Aggregation Level

    Default Chart

    		 Aggregation Level

    Anomaly Chart

    		 Aggregation Type

    Default Chart

    		 Aggregation Type

    Anomaly Chart
    User Transaction Count Instance Instance Sum Sum
    Average Server Response Time Instance Instance Weighted Average Weighted Average
    SQL Response Time Instance Instance Average Weighted Average
    Semaphore Default Mean Node Instance Max Max
    Node Memory Max Node Instance Max Max
    Semaphore Default Queue Depth Node Instance Max Max
    Semaphore API Int In Use Node Instance Max Max
    Semaphore API Int Queue Depth Node Instance Max Max
    Semaphore AMB Send Queue Depth Node Instance Max Max
    Garbage Collection Instance Instance Max Max
    CPU Time Instance Instance Sum Sum
    Threads Running Instance Instance Max Max
    InnoDBrowLock Instance Instance Max Max
    Slow Queries Instance Instance Max Max

    Roll up logic

    User Transaction Count | Average Server Response Time | SQL Response Time
    • When selected date range is less than or equal to 7 days, metric values are rolled up at the 1-minute level.
    • When selected date range is greater than 7 days but less than 30 days, metric values are rolled up at the 10-minute level.
    • When selected date range is greater than 30 days, metric values are rolled up at the 1-hour level.
    • Default chart metric values will not match with the anomaly chart metric values when data is rolled up at the 10-minute level, because the default chart uses a 10-minute metric value average whereas the anomaly chart uses a 15-minute moving average.
    • Default chart metric values will match with the anomaly chart metric values when aggregation is at the 1-minute level for User Transaction Count and Average Server Response Time. Values will not match for SQL Response Time because the default chart uses Average aggregation whereas the anomaly chart uses Weighted Average.
    • Anomaly chart data is available for a maximum of 28 days from the current date.
    Other metrics
    • When selected date range is less than or equal to 24 hours, metric values are rolled up at the 1-minute level.
    • When selected date range is greater than 1 day but less than 7 days, metric values are rolled up at the 5-minute level.
    • When selected date range is greater than 7 days but less than 30 days, metric values are rolled up at the 10-minute level.
    • When selected date range is greater than 30 days but less than 60 days, metric values are rolled up at the 1-hour level.
    • When selected date range is greater than 60 days but less than 90 days, metric values are rolled up at the 2-hour level.
    • When selected date range is greater than 90 days but less than 120 days, metric values are rolled up at the 4-hour level.
    • When selected date range is greater than 120 days but less than 150 days, metric values are rolled up at the 8-hour level.
    • When selected date range is greater than 150 days but less than 180 days, metric values are rolled up at the 12-hour level.
    • Default chart metric values will not match with anomaly chart metric values for node-level metrics, because the default chart aggregates at the node level whereas the anomaly chart aggregates at the instance level. Note that the aggregation type (Max) remains the same across both charts for these metrics.
    • Anomaly chart data is available for a maximum of 28 days from the current date.