topic Re: alerting site wise in Alerting

Close problem only when {dims:units} is 0

O11y_Noob — Thu, 18 Dec 2025 10:32:56 GMT

timeseries v = avg(unexpecteddowntime), by: {site, unit}
| summarize {
site_series = avg(v[]), 
units = collectDistinct(unit) 
}, by: {site, timeframe, interval} 
| filter arrayMax(site_series) > 30 
| fieldsAdd units_str = toString(units)

Using this in Davis Anomaly Detector for creating alerts site wise, and having {dims:units} in the description but the problem is closing and opening a new instance whenever there is change in the {dims:units}. I only want to close the alert {dims:units} is 0

Re: alerting site wise

t_pawlak — Mon, 17 Nov 2025 10:01:17 GMT

Hi,
If you are using this query, and in the Davis Anomaly metric event you’re using something like {dims:units} in the description. In Dynatrace, whenever a dimension (anything referenced via {dims:...}) changes, Davis treats it as a new problem instance.
So when the list of units changes even slightly: Old problem is closed and New problem is opened

That’s why you see constant open/close cycles.

If I correctly understand, you want to open one problem per site.

So, do not use {dims:units} anywhere (especially in description).
That makes units part of the problem key.

Use units only as a field, not a dimension.

Drive open/close behaviour via DQL:

Alert only when units_count > 0
Problem auto-closes when units_count = 0

Try this:

timeseries v = avg(unexpecteddowntime), by: {site, unit} | summarize { site_series = avg(v[]), units = collectDistinct(unit), units_count = countDistinct(unit) }, by: {site, timeframe, interval} | filter arrayMax(site_series) > 30 | filter units_count > 0 | fieldsAdd units_str = toString(units)

units_count > 0 → only then the metric event is evaluated as violating

When units_count becomes 0, the violation stops → Davis will close the problem

Then in metric event use site as a dimension, like this:

Site: {dims:site} Affected units: {fields.units_str}

Re: alerting site wise

O11y_Noob — Mon, 17 Nov 2025 11:11:19 GMT

the filter that you see in the problem is not part of my query but its getting added and the reffered fields.unit_Str is not getting the field value referred , could you pls help here @t_pawlak

Re: alerting site wise

patryk_ozimek2 — Tue, 18 Nov 2025 06:37:38 GMT

Hi,

I don't see such thing as "fields" in the doc (https://docs.dynatrace.com/docs/shortlink/anomaly-detection-configuration#event-template) - I also tried to use it in my Davis Anomaly Detector but results were the same like for @O11y_Noob

Can you please give the source from which you got this info?

Best Regards,
Patryk

Re: alerting site wise

t_pawlak — Tue, 18 Nov 2025 08:28:16 GMT

Hi,
It looks like the additional filter (...) you see in the problem view is not coming from your DQL. Davis automatically adds a filter for the concrete time-series that triggered the event (based on the dimensions/placeholders used in the metric event).

Also, my previous suggestion with {fields.units_str} was misleading – fields.* placeholders are not supported in the event template, which is why you don’t see the value there.

In practice this means that if you reference units / units_str in the title/description, Davis will “pin” the problem to that exact value and will open/close a new problem every time the list of units changes. To have one problem per site, keep units only inside DQL (for filtering/logic) and use only {dims:site} (and standard placeholders like {value}) in the event template.

Re: alerting site wise

O11y_Noob — Tue, 18 Nov 2025 09:56:40 GMT

the team wants to see the unit names in the problem ticket , how can i include it in the problem ?