---
sourceDocument: Zurich IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/it-operations-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# View anomaly alert metric data

# View anomaly alert metric data in Express List {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

View visualizations for anomaly alerts to investigate anomalies using metric data. You can view visualizations from the Express List preview panel or the alert record.

## Before you begin

Role required: evt_mgmt_operator, evt_mgmt_admin

## Procedure

1. Navigate to WorkspacesService Operations Workspace.
2. From the navigation bar, select the Express list icon: ![Express list icon]().
3. In the Active Alerts list, locate an anomaly alert.  
   Information in the Description column can help you determine which alerts are anomaly alerts. For example, an alert description might warn about values nearing or exceeding configured thresholds, or metrics above or below a defined boundary.
4. Choose where to view the anomaly chart.

   | Option | Procedure |
   | View the chart in the preview panel | 1. Select the check box for the anomaly alert. 2. In the preview panel, select the Info tab. A chart with a visual representation of the anomaly appears. {#view-alert-metric-display__ol_zjl_41m_33c} |
   | View the chart in the alert record | Select the number of the anomaly alert to open the alert record. The Overview tab opens by default. The anomaly chart is displayed. |
   |-|-|

   {#view-alert-metric-display__choicetable_kfx_rzl_33c}  
   Depending on how the metric anomaly is configured, one of two charts is displayed.
   * When the Metric Intelligence statistical model is used to detect anomalies, the anomaly alert chart is displayed with upper and lower bounds based on machine learning models.

     For more information, see [Understanding Metric Intelligence](https://www.servicenow.com/docs/es1f2QO71tWzgsYa~JITfw "Use Metric Intelligence to identify and prevent potential service outages. Metric Intelligence, based on historical metric data, indicates anomalous behavior of CIs which events might not capture. Anomaly alerts can be promoted to regular IT alerts and appear on the Service Operations Workspace and service health dashboard for preventive actions.").
   * When thresholds are configured by administrators, the static threshold metric anomaly alert chart shows anomalies defined using the configured thresholds.

   {#view-alert-metric-display__ul_a2b_jxz_wfc}  
   Note:  
   The raw data used for the metric chart is available only for seven days. If older alerts are selected and the raw data is no longer available, a chart isn't shown.

   For more information, see [Create metric rules](https://www.servicenow.com/docs/62c89eghQJC4I_Y7ICQhsw "Create a metric rule to determine the metric, the threshold values and ranges, and the severity level of generated events. You can add a filter that determines the Configuration Items (CI) types or resources for which you receive alerts. For example, you can configure a filter to receive alerts only for Windows servers.").
5. **Optional:** Review surrounding metric data by selecting the Open in Metric explorer icon (![Open in Metric explorer icon]()) in the information panel.  
   The Metric Explorer tab displays the time frame of the anomaly. For an open alert, the chart shows one hour before and after the last time of event generation. For a closed alert, the chart
   shows one hour before and after the first event that created an alert. If there's no data, the chart isn't displayed.

   For more information, see [Metric Explorer](https://www.servicenow.com/docs/lk5Do0Cvvo7Cbpb_aC9E_g "Metric Explorer provides an easy-to-navigate interface where service agents can view the health of a CI associated with an alert. Health details for a CI include various metric charts with control bounds, and aggregations in a time period.").

*[\>]: and then