topic Re: Agentic AI cost limits and per-user consumption monitoring in AI

Agentic AI cost limits and per-user consumption monitoring

ChrysanthosK — Thu, 06 Aug 2026 13:06:50 GMT

Hello Dynatrace Community,

We are currently evaluating the governance and cost-control options available for Agentic AI under a Dynatrace Platform Subscription.

Dynatrace Support informed us that it is currently not possible to configure a hard consumption or cost limit that automatically stops or restricts Agentic AI executions once a predefined threshold has been reached.

Our understanding is that:

Budget Alerts and Cost Monitors provide notifications only.
Exceeding a configured budget does not stop Agentic AI usage.
Hard limits cannot currently be applied at account, environment, user-group, or individual-user level.
Access can be restricted through the ai:operator:execute IAM permission, but this controls whether a user can access Agentic AI and does not impose a usage or cost quota.

Our customer operates with a predefined annual Dynatrace budget and needs to prevent Agentic AI consumption from causing the annual DPS commitment to be exceeded.

We would therefore appreciate feedback from other customers and Dynatrace experts on the following:

Has anyone implemented a practical workaround to stop or restrict Agentic AI usage when a specific consumption threshold is reached?
Is there currently a way to identify the Agentic AI consumption generated by each individual user or user group?
Can Agentic AI executions be distinguished from manual actions performed through Notebooks, Dashboards, DQL, or other Dynatrace applications?
Are there audit records, APIs, billing exports, Account Management reports, or DQL-accessible data that show:
- the user who initiated the execution,
- the operation that was executed,
- the Dynatrace capability that was consumed,
- and the resulting DPS consumption or cost?
Can a Budget Alert or Cost Monitor notification be connected to a Workflow that automatically removes the ai:operator:execute permission from a user or group? If technically possible, would this be considered a supported or recommended approach?
How are other enterprise customers governing Agentic AI access and consumption to avoid unexpected on-demand charges?

We are particularly interested in real-world implementations, dashboards, APIs, automation approaches, or governance practices currently being used.

Thank you in advance

Re: Agentic AI cost limits and per-user consumption monitoring

p_devulapalli — Tue, 11 Aug 2026 06:21:26 GMT

@ChrysanthosK If you haven't already explored this, you can start by looking at the "Dynatrace Intelligence Feature Adoption" ready made dashboard which should already be available in your tenant . This can provide you some insights on the usage

https://docs.dynatrace.com/docs/shortlink/agentic-and-generative-ai-faq#copilot-monitor-adoption

Re: Agentic AI cost limits and per-user consumption monitoring

dylan_taelemans — Tue, 11 Aug 2026 08:37:16 GMT

Are there audit records, APIs, billing exports, Account Management reports, or DQL-accessible data that show:
the user who initiated the execution,
the operation that was executed,
the Dynatrace capability that was consumed,
and the resulting DPS consumption or cost?
Can a Budget Alert or Cost Monitor notification be connected to a Workflow that automatically removes the ai:operator:execute permission from a user or group? If technically possible, would this be considered a supported or recommended approach?

For the question, “Are there audit records, APIs, billing exports, Account Management reports, or DQL-accessible data that show:”, please see the attached 'DQL Usage Overview' Dashboard.

I didn’t create this dashboard from scratch myself—I found it in the Dynatrace Community some time ago. Unfortunately, I can’t remember the original post, but I’ve found the dashboard to be extremely useful.

Regarding your question, “Can a Budget Alert or Cost Monitor notification be connected to a Workflow that automatically …”, there are a few possible approaches, although they require some workarounds. The biggest limitation at the moment is that AI and DQL costs are not separated, which makes it difficult to trigger actions based specifically on DQL usage.

1. Prepare the query

First, we need to prepare the query that will be used to calculate the cost. (Play around with it a bit in a notebook)

Replace the following variables in the query:

$cost = Cost per GiB scanned
Example: $0.0035 per GiB scanned
$costAlert = The cost threshold at which you want to block users

fetch dt.system.events, from: now()@M, to:now()
| filter event.kind == "BILLING_USAGE_EVENT" and matchesPhrase(event.type, "Query")
AND isNotNull(user.email)
| fields query_start, event.type, query_id, user.email, billed_bytes
| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)
| summarize cost = round((sum(query_cost)), decimals:toLong(2)), count = count(), by:{user.email,event.type}
| summarize records = collectArray(record(cost, count, type=event.type)), total = sum(cost), by:{user.email}
| fieldsAdd totalCost =round(total, decimals:toLong(2)),
costAlert = if(total >= toLong($costAlert),1,else:0)
| sort totalCost desc
| filter costAlert=1

2. Triggering the workflow

We can then use this query in one of two ways:

Timed Workflow trigger:
Alternatively, we can create a Workflow with a scheduled/timed trigger that periodically runs the query and checks whether the threshold has been exceeded. I’ve included an example of this approach in the attachment.
Anomaly Detection app — recommended:
Use the query to create an event when the defined threshold is reached. This event can then be picked up by a Workflow trigger. This approach is recommended, although it requires a little more setup.

Note: You can expand on this to automatically renew permissions on end of month or do anything else.

You’ll need to create a group with the required DQL and/or AI permissions. This will be the group that the workflow manages by automatically removing users from it when the defined threshold is reached.

Make sure that no other groups have these permissions, unless you specifically want to exclude those users from having their permissions removed. Users in those groups will still receive the warning email, but they won’t lose access.

Re: Agentic AI cost limits and per-user consumption monitoring

dylan_taelemans — Tue, 11 Aug 2026 08:31:34 GMT

My JSON file for the dashboard wouldn’t upload—it just kept loading without showing any error. So I’m trying it this way instead.

{"version":21,"variables":[{"version":2,"key":"cost","type":"text","visible":false,"editable":true,"defaultValue":"0.00234619141"},{"version":2,"key":"version","type":"csv","visible":false,"input":"2.0.0","multiple":false},{"version":2,"key":"costAlert","type":"text","visible":true,"editable":true,"defaultValue":"100"},{"version":2,"key":"decimalPlace","type":"csv","visible":true,"editable":true,"input":"0,1,2,3,4,5","multiple":false,"defaultValue":"5"},{"version":2,"key":"costAvgExecutionAlert","type":"text","visible":true,"editable":true,"defaultValue":"5"},{"version":2,"key":"limit","type":"text","visible":true,"editable":true,"defaultValue":"100"},{"version":2,"key":"DataType","type":"query","visible":true,"editable":true,"input":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\n| fields event.type\n| dedup event.type","multiple":true,"defaultValue":["3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*"]},{"version":2,"key":"user","type":"query","visible":true,"editable":true,"input":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\n| fields user.email\n| dedup user.email","multiple":true,"defaultValue":["3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*"]},{"version":2,"key":"tenant","type":"query","visible":false,"editable":true,"input":"fetch dt.system.events \n| fields dt.system.environment \n| limit 1\n","multiple":false}],"tiles":{"34":{"title":"Query Cost Per Day","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| makeTimeseries query_cost_sum = sum(query_cost), bins:1\n| fieldsAdd temp = if(isNull(query_cost_sum[]), toDouble(0), else:query_cost_sum[])\n| fieldsAdd `Cost` = arrayCumulativeSum(temp)\n| fieldsRemove temp","visualization":"barChart","visualizationSettings":{"dataMapping":{"displayedFields":["query_cost_sum","Cost"]},"chartSettings":{"truncationMode":"middle","legend":{"hidden":true},"xAxisLabel":"timeframe","xAxisScaling":"analyzedTimeframe","valueRepresentation":"relative","seriesOverrides":[{"seriesId":["Cost"],"override":{"geometry":"line"}}],"fieldMapping":{"leftAxisValues":["query_cost_sum","Cost"],"timestamp":"timeframe"}},"unitsOverrides":[{"identifier":"query_cost_sum","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851623134},{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851728698}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"36":{"title":"DQL Cost by Data Type Daily","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| makeTimeseries query_cost_sum = sum(billed_bytes/1024/1024/1024*toDouble($cost)), by:{event.type}, bins:1\n| fieldsAdd temp = if(isNull(query_cost_sum[]), toDouble(0), else:query_cost_sum[])\n| fieldsAdd `Cost` = arrayCumulativeSum(temp)\n| fieldsRemove temp","visualization":"lineChart","visualizationSettings":{"chartSettings":{"truncationMode":"middle","legend":{"hidden":true},"xAxisLabel":"timeframe","xAxisScaling":"analyzedTimeframe","valueRepresentation":"relative","seriesOverrides":[{"seriesId":["Events - Query","query_cost_sum"],"override":{"geometry":"bar"}},{"seriesId":["Log Management & Analytics - Query","query_cost_sum"],"override":{"geometry":"bar"}},{"seriesId":["Traces - Query","query_cost_sum"],"override":{"geometry":"bar"}},{"seriesId":["Events - Query","Cost"],"override":{"geometry":"line"}},{"seriesId":["Log Management & Analytics - Query","Cost"],"override":{"geometry":"line"}},{"seriesId":["Traces - Query","Cost"],"override":{"geometry":"line"}}],"fieldMapping":{"leftAxisValues":["query_cost_sum","Cost"],"timestamp":"timeframe"},"gapPolicy":"connect"},"dataMapping":{"displayedFields":["event.type","query_cost_sum","Cost"]},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"query_cost_sum","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851743891},{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851762216}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframe":{"from":"now()-7d","to":"now()"},"tileTimeframeEnabled":false}},"37":{"title":"DQL Cost by Data Type","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes\n| summarize bytes = sum(billed_bytes), by:{event.type}\n| summarize array = collectArray(record(`event.type`,bytes)),totalBytes=sum(bytes)\n| expand array\n| fieldsAdd query_totalCost = totalBytes/1024/1024/1024*toDouble($cost), query_cost = array[bytes]/1024/1024/1024*toDouble($cost)\n| fields array[event.type], alias:`Data Type`, round(query_cost, decimals:toLong($decimalPlace)), alias:`Cost`, percentage = (toDouble(query_cost/query_totalCost) * 100)\n| sort percentage desc\n","visualization":"pieChart","visualizationSettings":{"chartSettings":{"truncationMode":"middle","legend":{"hidden":true},"categoricalBarChartSettings":{"valueAxis":"Cost","valueAxisLabel":"Cost","categoryAxis":["Cost","Data Type"],"categoryAxisLabel":"Cost,Data Type"},"circleChartSettings":{"valueType":"relative"}},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851648864}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframe":{"from":"now()-7d","to":"now()"},"tileTimeframeEnabled":false}},"39":{"title":"Last Month","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| makeTimeseries monthly=sum(billed_bytes/1024/1024/1024), interval:31d\n| fieldsAdd lastmonth = arrayLast(monthly)","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"lastmonth","recordField":"lastmonth","prefixIcon":"","sparklineSettings":{"record":"monthly"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"lastmonth","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1718620268306}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframeEnabled":true,"tileTimeframe":{"from":"now()-30d","to":"now()"}}},"40":{"title":"Last 7d","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| makeTimeseries weekly=sum(billed_bytes/1024/1024/1024), interval:7d\n| fieldsAdd lastweek = arrayLast(weekly)","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"lastweek","recordField":"lastweek","prefixIcon":"","sparklineSettings":{"record":"weekly"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"lastweek","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1718620268306}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframeEnabled":true,"tileTimeframe":{"from":"now()-30d","to":"now()"}}},"42":{"title":"Last Month","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| makeTimeseries monthly=sum(query_cost), interval:31d\n| fieldsAdd lastmonth = round(arrayLast(monthly), decimals:toLong($decimalPlace))","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"lastmonth","recordField":"lastmonth","prefixIcon":"","sparklineSettings":{"record":"monthly"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"yesterday","unitCategory":"data","baseUnit":"byte","displayUnit":null,"decimals":1,"suffix":"","delimiter":true,"cascade":null,"added":1718620268306},{"identifier":"monthly","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851711067},{"identifier":"lastmonth","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851711442}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframeEnabled":true,"tileTimeframe":{"from":"now()-30d","to":"now()"}}},"43":{"title":"Last 7d","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| makeTimeseries weekly=sum(query_cost), interval:7d\n| fieldsAdd lastweek = round(arrayLast(weekly), decimals:toLong($decimalPlace))","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"lastweek","recordField":"lastweek","prefixIcon":"","sparklineSettings":{"record":"weekly"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"yesterday","unitCategory":"data","baseUnit":"byte","displayUnit":null,"decimals":1,"suffix":"","delimiter":true,"cascade":null,"added":1718620268306},{"identifier":"weekly","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851692166},{"identifier":"lastweek","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851692350}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframeEnabled":true,"tileTimeframe":{"from":"now()-30d","to":"now()"}}},"44":{"title":"Last 24h","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| makeTimeseries daily=sum(query_cost), interval:1d\n| fieldsAdd yesterday = round(arrayLast(daily), decimals:toLong($decimalPlace))","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"yesterday","recordField":"yesterday","prefixIcon":"","sparklineSettings":{"record":"daily"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"daily","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851664622},{"identifier":"yesterday","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851665033}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframeEnabled":true,"tileTimeframe":{"from":"now()-30d","to":"now()"}}},"46":{"title":"Traces - Cost by User","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND matchesPhrase(event.type,\"Traces - Query\")\nAND isNotNull(user.email)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| summarize cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), count = count(), by:{user.email,event.type}\n| sort cost desc\n// | fieldsAdd Cost = concat($currency,round(cost, decimals:toLong($decimalPlace))),costAlert = if(cost >= toLong($costAlert),1,else:0)\n| fields user.email, cost\n// | fields user.email, costAlert, alias:`Cost Alert`,totalCostString, alias: `Total Cost($currency)`, records[type], alias:`Type1`, records[count], alias:`Query Count1`, concat($currency,records[cost]), alias:`Cost ($currency)1`\n| limit toLong($limit)","visualization":"pieChart","visualizationSettings":{"chartSettings":{"truncationMode":"middle","legend":{"hidden":true},"categoricalBarChartSettings":{"valueAxis":["cost"],"valueAxisLabel":"cost","categoryAxis":["user.email"],"categoryAxisLabel":"user.email"},"circleChartSettings":{"valueType":"relative","groupingThresholdType":"relative"}},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851794496}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}},"47":{"title":"Events - Cost by User","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND matchesPhrase(event.type,\"Events - Query\")\nAND isNotNull(user.email)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| summarize cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), count = count(), by:{user.email,event.type}\n| sort cost desc\n// | fieldsAdd Cost = concat($currency,round(cost, decimals:toLong($decimalPlace))),costAlert = if(cost >= toLong($costAlert),1,else:0)\n| fields user.email, cost\n// | fields user.email, costAlert, alias:`Cost Alert`,totalCostString, alias: `Total Cost($currency)`, records[type], alias:`Type1`, records[count], alias:`Query Count1`, concat($currency,records[cost]), alias:`Cost ($currency)1`\n| limit toLong($limit)","visualization":"pieChart","visualizationSettings":{"chartSettings":{"truncationMode":"middle","legend":{"hidden":true},"categoricalBarChartSettings":{"valueAxis":["cost"],"valueAxisLabel":"cost","categoryAxis":["user.email"],"categoryAxisLabel":"user.email"},"circleChartSettings":{"valueType":"relative","groupingThresholdType":"relative"}},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851785242}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}},"48":{"title":"Log Management & Analytics - Cost by User","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND matchesPhrase(event.type,\"Log Management & Analytics - Query\")\nAND isNotNull(user.email)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| summarize cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), count = count(), by:{user.email,event.type}\n| sort cost desc\n// | fieldsAdd Cost = concat($currency,round(cost, decimals:toLong($decimalPlace))),costAlert = if(cost >= toLong($costAlert),1,else:0)\n| fields user.email, cost\n// | fields user.email, costAlert, alias:`Cost Alert`,totalCostString, alias: `Total Cost($currency)`, records[type], alias:`Type1`, records[count], alias:`Query Count1`, concat($currency,records[cost]), alias:`Cost ($currency)1`\n| limit toLong($limit)","visualization":"pieChart","visualizationSettings":{"chartSettings":{"truncationMode":"middle","legend":{"hidden":true},"categoricalBarChartSettings":{"valueAxis":["cost"],"valueAxisLabel":"cost","categoryAxis":["user.email"],"categoryAxisLabel":"user.email"},"circleChartSettings":{"valueType":"relative","groupingThresholdType":"relative"}},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851775241}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}},"49":{"title":"Total Cost per User","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| summarize cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), count = count(), by:{user.email,event.type}\n| summarize records = collectArray(record(cost, count, type=event.type)), total = sum(cost), by:{user.email}\n| fieldsAdd totalCost =round(total, decimals:toLong($decimalPlace)),\ncostAlert = if(total >= toLong($costAlert),1,else:0)\n| sort totalCost desc\n| fields user.email, costAlert, alias:`Cost Alert`,totalCost, alias: `Total Cost`, records[0][type], alias:`Type1`, records[0][count], alias:`Query Count1`, records[0][cost], alias:`Cost 1`,\nrecords[1][type], alias:`Type2`, records[1][count], alias:`Query Count2`, records[1][cost], alias:`Cost 2`,\nrecords[2][type], alias:`Type3`, records[2][count], alias:`Query Count3`, records[2][cost], alias:`Cost 3`\n| limit toLong($limit)","visualization":"table","visualizationSettings":{"table":{"hiddenColumns":[["Cost Alert"]],"linewrapEnabled":true,"rowDensity":"comfortable","lineWrapIds":[["user.email"],["Total Cost(\"$\")"],["Type1"],["Query Count1"],["Cost (\"$\")1"],["Type2"],["Query Count2"],["Cost (\"$\")2"],["Type3"],["Query Count3"],["Cost (\"$\")3"]],"sortBy":{"columnId":"[\"Total Cost(\\\"$\\\")\"]","direction":"descending"},"columnWidths":{"[\"Cost Alert\"]":115.59375,"[\"user.email\"]":281.5694580078125,"[\"Type1\"]":126.72,"[\"Type2\"]":175.71,"[\"Total Cost(\\\"$\\\")\"]":136.8,"[\"Query Count1\"]":116.68,"[\"Cost (\\\"$\\\")1\"]":92.97915649414062,"[\"Query Count2\"]":86.6875,"[\"Cost (\\\"$\\\")2\"]":102.97917175292969,"[\"Query Count3\"]":91.70834350585938,"[\"Total Cost\"]":143.79}},"coloring":{"colorRules":[{"value":0,"comparator":"=","field":"Cost Alert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"}},{"value":1,"comparator":"=","field":"Cost Alert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"}}]},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"Total Cost(\"$\")","unitCategory":"unspecified","baseUnit":"none","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174772197},{"identifier":"Total Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356955882},{"identifier":"Cost 1","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356956059},{"identifier":"Cost 2","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356956215},{"identifier":"Cost 3","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356956801}]},"querySettings":{"maxResultRecords":100000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"52":{"title":"Cost by App","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp, query_string\n| fieldsAdd gb = billed_bytes/1024/1024/1024\n| fieldsAdd query_cost = gb*toDouble($cost) \n| join [\n fetch dt.system.query_executions\n | filter isNotNull(user.email) \n AND not(in(bucket, \"default_davis_events\",\"dt_system_metrics\",\"default_davis_k8s_ops_events\",\"default_davis_custom_events\",\"default_security_custom_events\",\"default_security_events\",\"default_synthetic_events\",\"default_synthetic_detailed_events\",\"default_selfmon_events\")) \n AND isNotNull(bucket)\n AND bucket != \"\"\n AND status == \"SUCCEEDED\"\n AND scanned_bytes > 0\n AND (isNotNull(client.application_context) or isNotNull(client.internal_service_context))\n and isNotNull(query_id)\n | parse client.source,\"LD:link ('?'|EOS)\"\n | fieldsAdd client.source = client.source\n // AND isNotNull(client.source)\n],\n on: query_id,\n prefix: \"executiondata.\",\n kind:inner\n| fieldsAdd app = if(isNotNull(executiondata.client.application_context)\n ,executiondata.client.application_context\n ,else:executiondata.client.internal_service_context), function = executiondata.client.function_context, link = executiondata.link, source = executiondata.client.source\n| summarize Cost = round((sum(query_cost)), decimals:toLong($decimalPlace)),GiB = round(sum(gb), decimals:toLong($decimalPlace)), executions=count(), by:{app, function, link, source}\n| sort Cost desc\n| fieldsAdd costAlert = if(Cost >= toDouble($costAlert), 1, else:0)\n| fieldsAdd url = if(app == \"dynatrace.davis.anomalydetection\", concat(\"[\",app,\"](https://{environmentid}.apps.dynatrace.com/ui/apps/dynatrace.davis.anomalydetection/intent/open_anomaly_detector_schema#%7B%22dt.settings.object_id%22%3A%22\",source,\"%22%2C%22dt.settings.schema_id%22%3A%22builtin%3Adavis.anomaly-detectors%22%7D)\"),else:concat(\"[\",app,\"]\",\"(\",link,\")\"))\n\n// | fieldsAdd url = concat(\"[\",executiondata.client.source,\"](https://{environmentid}.apps.dynatrace.com/ui/apps/dynatrace.davis.anomalydetection/intent/open_anomaly_detector_schema#%7B%22dt.settings.object_id%22%3A%22\",executiondata.client.source,\"%22%2C%22dt.settings.schema_id%22%3A%22builtin%3Adavis.anomaly-detectors%22%7D)\")\n| fields app, url, costAlert, Cost, GiB, executions\n| filter GiB > 0\n| limit toLong($limit)","visualization":"table","visualizationSettings":{"table":{"columnOrder":["[\"app\"]","[\"url\"]","[\"costAlert\"]","[\"Cost\"]","[\"GiB\"]","[\"executions\"]"],"columnTypeOverrides":[{"id":504448.8999999999,"fields":["url"],"value":"markdown"}],"hiddenColumns":[["costAlert"]],"columnWidths":{"[\"App\"]":350.125,"[\"Gigabyte\"]":84.8125,"[\"costAlert\"]":67.4375,"[\"url\"]":240,"[\"executiondata.client.source\"]":1393,"[\"Cost\"]":81,"[\"app\"]":221}},"coloring":{"colorRules":[{"value":0,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"}},{"value":1,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"}}]},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"GiB","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174508912},{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356576504}]},"querySettings":{"maxResultRecords":100000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"53":{"title":"Cost by Dashboard/Notebook","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp, query_string\n| fieldsAdd gb = billed_bytes/1024/1024/1024\n| fieldsAdd query_cost = gb*toDouble($cost) \n| lookup [\n fetch dt.system.query_executions\n | filter isNotNull(user.email) \n AND not(in(bucket, \"default_davis_events\",\"dt_system_metrics\",\"default_davis_k8s_ops_events\",\"default_davis_custom_events\",\"default_security_custom_events\",\"default_security_events\",\"default_synthetic_events\",\"default_synthetic_detailed_events\",\"default_selfmon_events\")) \n AND isNotNull(bucket)\n AND bucket != \"\"\n AND status == \"SUCCEEDED\"\n AND scanned_bytes > 0\n AND isNotNull(client.application_context) AND isNotNull(client.source)\n AND in(client.application_context,\"dynatrace.notebooks\",\"dynatrace.dashboards\")\n],\n sourceField: query_id,\n lookupField: query_id,\n prefix: \"executiondata.\",\n executionOrder:leftFirst\n| sort timestamp desc\n| parse executiondata.client.source,\"LD '/ui/' LD:type '/' LD:id\"\n// //| parse client.application_context,\"'dynatrace.' LD:type 's'\"\n| filter isNotNull(id)\n// //| fieldsAdd length = stringLength(client.application_context)\n| fieldsAdd link = concat(\"[\",executiondata.client.application_context,\"]\",\"(https://{environmentid}.apps.dynatrace.com/ui/apps/\",executiondata.client.application_context,\"/\",type,\"/\",id,\")\")\n// // | fieldsRemove scanned_bytes\n| summarize Cost = round((sum(query_cost)), decimals:toLong($decimalPlace)),GiB = round(sum(gb), decimals:toLong($decimalPlace)), by:{executiondata.client.application_context, id, link}\n| fieldsAdd costAlert = if(Cost >= toDouble($costAlert), 1, else:0)\n| filterOut Cost <= 0\n| sort Cost desc\n| fields id, link, costAlert, Cost, GiB\n| limit toLong($limit)","visualization":"table","visualizationSettings":{"table":{"hiddenColumns":[["costAlert"]],"lineWrapIds":[["id"],["link"]],"sortBy":[{"columnId":"[\"id\"]","direction":"ascending"}],"columnWidths":{"[\"id\"]":282,"[\"Cost\"]":85},"columnTypeOverrides":[{"id":185949.1000000015,"fields":["link"],"value":"markdown"}]},"coloring":{"colorRules":[{"value":0,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"}},{"value":1,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"}}]},"unitsOverrides":[{"identifier":"GiB","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174421522},{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759357024938}]},"querySettings":{"maxResultRecords":100000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"54":{"title":"Cost by Bucket","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp, query_string\n| fieldsAdd gb = billed_bytes/1024/1024/1024\n| fieldsAdd query_cost = gb*toDouble($cost) \n| lookup [\n fetch dt.system.query_executions\n | filter isNotNull(user.email) \n and not(in(bucket, \"default_davis_events\",\"dt_system_metrics\",\"default_davis_k8s_ops_events\",\"default_davis_custom_events\",\"default_security_custom_events\",\"default_security_events\",\"default_synthetic_events\",\"default_synthetic_detailed_events\",\"default_selfmon_events\")) \n and isNotNull(bucket)\n and bucket != \"\"\n and status == \"SUCCEEDED\"\n and scanned_bytes > 0\n],\n sourceField: query_id,\n lookupField: query_id,\n prefix: \"executiondata.\",\n executionOrder:leftFirst\n| sort timestamp desc\n| summarize Cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), GiB = round(sum(gb), decimals:toLong($decimalPlace)),executions = count(), by: {bucket = executiondata.bucket}\n| sort Cost desc\n| fieldsAdd costAlert = if(Cost >= toDouble($costAlert), 1, else:0)\n| fields bucket, costAlert, Cost, GiB, executions\n| filter GiB > 0\n| limit toLong($limit)\n","visualization":"table","visualizationSettings":{"table":{"hiddenColumns":[["costAlert"]],"columnWidths":{"[\"Gigabyte\"]":172.8125,"[\"Cost\"]":122.20442199707031}},"coloring":{"colorRules":[{"value":0,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"}},{"value":1,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"}}]},"unitsOverrides":[{"identifier":"GiB","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174457736},{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759357017269}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"56":{"title":"AVG Cost & GB per Execution (Optimization Opportunity)","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes\n| fieldsAdd gb = billed_bytes/1024/1024/1024\n| fieldsAdd query_cost = gb*toDouble($cost)\n| summarize cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), count = count(), gb = sum(gb), by:{user.email} \n| fieldsAdd costPerExecutionAvg = cost/count, gbPerExecutionAvg = gb/count\n| sort costPerExecutionAvg desc\n| fieldsAdd costAvgPerExecution = if(costPerExecutionAvg >= toDouble($costAvgExecutionAlert), 1, else:0)\n| fields user.email, costAvgPerExecution, cost = round(costPerExecutionAvg,decimals:toLong($decimalPlace)), GiB = round(gbPerExecutionAvg, decimals:toLong($decimalPlace))\n| filter GiB > 0\n| limit toLong($limit)","visualization":"table","visualizationSettings":{"table":{"hiddenColumns":[["costAvgPerExecution"]],"columnWidths":{"[\"user.email\"]":208.25,"[\"costAvgPerExecution\"]":124.47917175292969}},"coloring":{"colorRules":[{"value":0,"comparator":"≥","field":"costAvgPerExecution","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"}},{"value":1,"comparator":"≥","field":"costAvgPerExecution","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"}}]},"unitsOverrides":[{"identifier":"GiB","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174587669},{"identifier":"cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356542938}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"57":{"title":"Un-optimized DQL","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp, query_string\n| fieldsAdd gb = billed_bytes/1024/1024/1024\n| fieldsAdd query_cost = gb*toDouble($cost) \n| lookup [\n fetch dt.system.query_executions\n | filter isNotNull(user.email) \n and not(in(bucket, \"default_davis_events\",\"dt_system_metrics\",\"default_davis_k8s_ops_events\",\"default_davis_custom_events\",\"default_security_custom_events\",\"default_security_events\",\"default_synthetic_events\",\"default_synthetic_detailed_events\",\"default_selfmon_events\")) \n and isNotNull(bucket)\n and bucket != \"\"\n and status == \"SUCCEEDED\"\n and scanned_bytes > 0\n and isNotNull(query_string)\n | filterOut (contains(query_string, \"filter\") AND matchesRegex(query_string,\"\\\\\\\\w+\\\\\\\\s*==\\\\\\\\s*\\\\\\\"*\\\\\\\"\"))\n OR not(contains(query,\"scanLimitGBytes:-1\")) \n OR contains(query_string,\"filterOut\")\n OR contains(query_string,\"from:\")\n OR contains(query_string, \"samplingRatio\")\n OR contains(query_string, \"experimentalFieldsSummary\")\n OR contains(query_string, \"limit\")\n],\n sourceField: query_id,\n lookupField: query_id,\n prefix: \"executiondata.\",\n executionOrder:leftFirst\n| sort timestamp desc\n| summarize Cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), GiB = round(sum(gb), decimals:toLong($decimalPlace)),executions = count(), by: {query = executiondata.query_string}\n| filter isNotNull(query)\n| sort Cost desc\n| fieldsAdd costAlert = if(Cost >= toDouble($costAlert), 1, else:0)\n| fields query, costAlert, Cost, GiB, executions\n| filter GiB > 0\n| limit toLong($limit)","visualization":"table","visualizationSettings":{"table":{"hiddenColumns":[["costAlert"]],"lineWrapIds":[["query"]],"sortBy":[{"columnId":"[\"Cost\"]","direction":"descending"}],"columnWidths":{"[\"query\"]":343,"[\"Gigabyte\"]":104,"[\"costAlert\"]":104}},"coloring":{"colorRules":[{"value":0,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"}},{"value":1,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"}}]},"autoSelectVisualization":false,"unitsOverrides":[{"identifier":"GiB","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174566848},{"identifier":"Cost","unitCategory":"currency","baseUnit":"usd","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759356555871}]},"querySettings":{"maxResultRecords":100000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"58":{"title":"Most Expensive Queries","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp, query_string, client.application_context, client.source\n| fieldsAdd gb = billed_bytes/1024/1024/1024\n| fieldsAdd query_cost = gb*toDouble($cost) \n| lookup [\n fetch dt.system.query_executions\n | filter isNotNull(user.email) \n and not(in(bucket, \"default_davis_events\",\"dt_system_metrics\",\"default_davis_k8s_ops_events\",\"default_davis_custom_events\",\"default_security_custom_events\",\"default_security_events\",\"default_synthetic_events\",\"default_synthetic_detailed_events\",\"default_selfmon_events\")) \n and isNotNull(bucket)\n and bucket != \"\"\n and status == \"SUCCEEDED\"\n and scanned_bytes > 0\n and isNotNull(query_string)\n and query_string != \"\"\n],\n sourceField: query_id,\n lookupField: query_id,\n prefix: \"executiondata.\",\n executionOrder:leftFirst\n| parse client.source,\"LD '/ui/' LD:type '/' LD:id\"\n| fieldsAdd link = concat(\"[\",client.application_context,\"]\",\"(https://{environmentid}.apps.dynatrace.com/ui/apps/\",client.application_context,\"/\",type,\"/\",id,\")\") \n| sort timestamp desc\n| summarize Cost = round((sum(query_cost)), decimals:toLong($decimalPlace)), GiB = round(sum(gb), decimals:toLong($decimalPlace)),executions = count(), by: {query = executiondata.query_string, link}\n| sort Cost desc\n| fieldsAdd costAlert = if(Cost >= toDouble($costAlert), 1, else:0)\n| fields query, costAlert, Cost, GiB, executions, link\n| filter GiB > 0\n| limit toLong($limit)","visualization":"table","visualizationSettings":{"table":{"hiddenColumns":[["costAlert"]],"lineWrapIds":[["query"]],"sortBy":[{"columnId":"[\"client.application_context\"]","direction":"ascending"}],"columnTypeOverrides":[{"id":465735,"fields":["link"],"value":"markdown","disableRemoval":false}],"columnWidths":{"[\"Cost\"]":47.7}},"coloring":{"colorRules":[{"value":0,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-ideal-default, #2f6863)"},"metadata":{"applyTo":"row"},"type":"long"},{"value":1,"comparator":"=","field":"costAlert","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-status-critical-default, #c4233b)"},"metadata":{"applyTo":"row"},"type":"long"}]},"unitsOverrides":[{"identifier":"GiB","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1738174544061}]},"querySettings":{"maxResultRecords":100000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"davisVisualization":{"isAvailable":true}}},"60":{"type":"markdown","content":"DQL Usage Overview version: *$version*"},"61":{"title":"Last 24h","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| makeTimeseries daily=sum(billed_bytes/1024/1024/1024), interval:1d\n| fieldsAdd yesterday = arrayLast(daily)","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"yesterday","recordField":"yesterday","prefixIcon":"","sparklineSettings":{"record":"daily"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"yesterday","unitCategory":"data","baseUnit":"gibibyte","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1718620268306}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframeEnabled":true,"tileTimeframe":{"from":"now()-30d","to":"now()"}}},"62":{"title":"DQL Cost","type":"data","query":"fetch dt.system.events\n| filter event.kind == \"BILLING_USAGE_EVENT\" and matchesPhrase(event.type, \"Query\")\nAND isNotNull(user.email)\nAND in(event.type,$DataType)\nand in(user.email,$user)\n| fields query_start, event.type, query_id, user.email, billed_bytes, timestamp\n| fieldsAdd query_cost = billed_bytes/1024/1024/1024*toDouble($cost)\n| makeTimeseries cost = sum(query_cost)\n| fieldsAdd totalCost = round(arraySum(cost),decimals:toLong($decimalPlace))","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"totalCost","recordField":"totalCost","prefixIcon":"","sparklineSettings":{"record":"cost"},"trend":{"isVisible":true}},"unitsOverrides":[{"identifier":"yesterday","unitCategory":"data","baseUnit":"byte","displayUnit":null,"decimals":1,"suffix":"","delimiter":true,"cascade":null,"added":1718620268306},{"identifier":"cost","unitCategory":"currency","baseUnit":"eur","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851609664},{"identifier":"totalCost","unitCategory":"currency","baseUnit":"eur","displayUnit":null,"decimals":2,"suffix":"","delimiter":false,"cascade":null,"added":1759851638123}]},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":100,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}},"timeframe":{"tileTimeframe":{"from":"now()-30d","to":"now()"},"tileTimeframeEnabled":false}},"63":{"title":"","type":"data","query":"data record(text=\"Optimization Opportunity\")","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"text","recordField":"text","isIconVisible":true,"prefixIcon":"DqlSignetIcon","colorThresholdTarget":"background","trend":{"isVisible":false}},"coloring":{"colorRules":[{"value":"Optimization Opportunity","comparator":"≥","field":"text","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-categorical-color-09-default, #649438)"}}]},"autoSelectVisualization":false},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}},"64":{"title":"","type":"data","query":"data record(text=\"Deep-Dive\")","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"text","recordField":"text","isIconVisible":true,"prefixIcon":"DqlSignetIcon","colorThresholdTarget":"background","trend":{"isVisible":false}},"coloring":{"colorRules":[{"value":"Deep-Dive","comparator":"≥","field":"text","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-categorical-color-11-default, #627cfe)"}}]},"autoSelectVisualization":false},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}},"65":{"title":"","type":"data","query":"data record(text=\"User Analysis\")","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"text","recordField":"text","isIconVisible":true,"prefixIcon":"DqlSignetIcon","colorThresholdTarget":"background","trend":{"isVisible":false}},"coloring":{"colorRules":[{"value":"User Analysis","comparator":"≥","field":"text","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-loglevel-alert-default, #c73d84)"}}]},"autoSelectVisualization":false},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}},"66":{"title":"","type":"data","query":"data record(text=\"Daily/Weekly/Monthly (Usage (GiB) and Costs)\")","visualization":"singleValue","visualizationSettings":{"singleValue":{"labelMode":"none","label":"text","recordField":"text","isIconVisible":true,"prefixIcon":"DqlSignetIcon","colorThresholdTarget":"background","trend":{"isVisible":false}},"coloring":{"colorRules":[{"value":"Daily/Weekly/Monthly (Usage (GiB) and Costs)","comparator":"≥","field":"text","colorMode":"custom-color","customColor":{"Default":"var(--dt-colors-charts-categorical-color-07-default, #438fb1)"}}]},"autoSelectVisualization":false},"querySettings":{"maxResultRecords":1000,"defaultScanLimitGbytes":500,"maxResultMegaBytes":1,"defaultSamplingRatio":10,"enableSampling":false},"davis":{"enabled":false,"davisVisualization":{"isAvailable":true}}}},"layouts":{"34":{"x":5,"y":0,"w":7,"h":4},"36":{"x":5,"y":4,"w":7,"h":3},"37":{"x":0,"y":4,"w":5,"h":3},"39":{"x":20,"y":1,"w":4,"h":3},"40":{"x":16,"y":1,"w":4,"h":3},"42":{"x":20,"y":4,"w":4,"h":3},"43":{"x":16,"y":4,"w":4,"h":3},"44":{"x":12,"y":4,"w":4,"h":3},"46":{"x":0,"y":16,"w":6,"h":4},"47":{"x":0,"y":12,"w":6,"h":4},"48":{"x":0,"y":8,"w":6,"h":4},"49":{"x":6,"y":8,"w":18,"h":12},"52":{"x":16,"y":21,"w":8,"h":6},"53":{"x":0,"y":21,"w":8,"h":6},"54":{"x":8,"y":21,"w":8,"h":6},"56":{"x":16,"y":28,"w":8,"h":6},"57":{"x":8,"y":28,"w":8,"h":6},"58":{"x":0,"y":28,"w":8,"h":6},"60":{"x":0,"y":34,"w":9,"h":1},"61":{"x":12,"y":1,"w":4,"h":3},"62":{"x":0,"y":0,"w":5,"h":4},"63":{"x":0,"y":27,"w":24,"h":1},"64":{"x":0,"y":20,"w":24,"h":1},"65":{"x":0,"y":7,"w":24,"h":1},"66":{"x":12,"y":0,"w":12,"h":1}},"importedWithCode":false,"settings":{},"annotations":[]}