topic Re: Improving Dynatrace Alert Speed: From Log Arrival to Notification in Alerting

Improving Dynatrace Alert Speed: From Log Arrival to Notification

AK — Tue, 10 Mar 2026 14:17:01 GMT

Hi Folks,

I have a Davis Anomaly Detection rule configured on SNMP logs, with a workflow in place to forward notifications.

Issue:

When a log matches the Davis Anomaly Detection rule, a problem isn’t created for about 4-5 minutes.
As a result, the notification reaches the relevant team roughly 5 minutes after the log arrives.

Observed timeline example:

Log arrival in Dynatrace: 06:36:31
Event analysis start: 06:36
Problem created/delivered: 06:39
Workflow execution completed: 06:40 (the workflow typically takes 30–50 seconds)

Is there a way to reduce the end-to-end delay to 1–2 minutes?

Regards,
AK

Re: Improving Dynatrace Alert Speed: From Log Arrival to Notification

p_devulapalli — Fri, 06 Feb 2026 02:38:08 GMT

@AK The delay looks to be during event analysis , are you using the log events or Davis anomaly detection app rule?

Re: Improving Dynatrace Alert Speed: From Log Arrival to Notification

AK — Fri, 06 Feb 2026 10:13:23 GMT

@p_devulapalliI'm pulling logs and creating a time series to trigger alerts—here's the example query I'm using in Davis Anomaly Detection.

fetch logs | filter matchesValue (log.source, "trap") and matchesValue (trapoid, "Critical") | makeTimeseries count(), by:{Device, Message, device.address, dt.source_entity,trapoid},interval:1m

Re: Improving Dynatrace Alert Speed: From Log Arrival to Notification

p_devulapalli — Mon, 09 Feb 2026 02:09:17 GMT

@AK Do you have any of the below set to longer duration which can impact the time the problem is generated

Re: Improving Dynatrace Alert Speed: From Log Arrival to Notification

AK — Wed, 18 Feb 2026 06:44:24 GMT

@p_devulapalli Thanks for looking into this. I had been using Davis Anomaly Detection, but after switching to the Davis included in the open pipeline, the delay dropped dramatically to about one to two minutes. Attached is a screenshot of the configuration.

Thanks again for your helpful insights and assistance.

Regards,
AK