(

 SELECT

      upt_asset_id, upt_hostname, upt_time, 

      cpu_idle -  LAG(cpu_idle) OVER (PARTITION BY upt_asset_id ORDER BY upt_time) AS cpu_idle,  

      cpu_total - LAG(cpu_total) OVER (PARTITION BY upt_asset_id ORDER BY upt_time) AS cpu_total

    FROM upt_metrics u

    WHERE u.cpu_idle is not NULL AND

    u.upt_time >= (localtimestamp - INTERVAL '1' hour) AND u.upt_time < localtimestamp ),

cpu_percent AS

( 

  SELECT upt_asset_id, upt_time, upt_hostname, percnt_busy, max(percnt_busy) OVER (partition by upt_asset_id) as max_percnt

FROM (

  SELECT upt_asset_id, upt_time, upt_hostname,

     CAST(((cpu_total - cpu_idle)*100) AS DOUBLE)/CAST(cpu_total AS DOUBLE) as percnt_busy

   FROM cpu_incremental) WHERE percnt_busy >= 75

) 

SELECT 

    'high' as severity,

    'High CPU Utilization' as description,

    upt_asset_id as asset,

    max(upt_time) as time,

    'asset_id' as key,

    upt_hostname as value,

    max(percnt_busy) AS percnt_busy

FROM cpu_percent

WHERE percnt_busy=max_percnt

GROUP BY upt_asset_id, upt_hostname;