(
SELECT
upt_asset_id, upt_hostname, upt_time,
cpu_idle - LAG(cpu_idle) OVER (PARTITION BY upt_asset_id ORDER BY upt_time) AS cpu_idle,
cpu_total - LAG(cpu_total) OVER (PARTITION BY upt_asset_id ORDER BY upt_time) AS cpu_total
FROM upt_metrics u
WHERE u.cpu_idle is not NULL AND
u.upt_time >= (localtimestamp - INTERVAL '1' hour) AND u.upt_time < localtimestamp ),
cpu_percent AS
(
SELECT upt_asset_id, upt_time, upt_hostname, percnt_busy, max(percnt_busy) OVER (partition by upt_asset_id) as max_percnt
FROM (
SELECT upt_asset_id, upt_time, upt_hostname,
CAST(((cpu_total - cpu_idle)*100) AS DOUBLE)/CAST(cpu_total AS DOUBLE) as percnt_busy
FROM cpu_incremental) WHERE percnt_busy >= 75
)
SELECT
'high' as severity,
'High CPU Utilization' as description,
upt_asset_id as asset,
max(upt_time) as time,
'asset_id' as key,
upt_hostname as value,
max(percnt_busy) AS percnt_busy
FROM cpu_percent
WHERE percnt_busy=max_percnt
GROUP BY upt_asset_id, upt_hostname;