Extract the total time that CPU was in saturation for Data Explorer

Taz — Mon, 01 Dec 2025 11:01:52 GMT

I am using the built in:

builtin:host.cpu.usage:splitBy("dt.entity.host"):sort(value(auto,descending)):limit(20) which give me when the CPU goes to 100% but I want to know the duration of the event.

Re: Data Explorer I want to extract the total time that CPU was in saturation

p_devulapalli — Thu, 02 Oct 2025 00:04:21 GMT

@Taz Not sure you would be able to query the duration of event from Data explorer , but should be easy with Notebooks if you are on SaaS

fetch dt.davis.problems | filter host.name == array("XYZ") | filter event.name == "CPU saturation" | fields host.name, event.name, resolved_problem_duration, display_id

Re: Data Explorer I want to extract the total time that CPU was in saturation

t_pawlak — Fri, 10 Oct 2025 10:12:37 GMT

If you start directly from the metric builtin:host.cpu.usage, you can’t really get the duration of an episode (bursts > X%) in Data Explorer. Data Explorer evaluates values at individual time points, not continuous segments where a condition is true.

As @p_devulapalli write you have two practical approaches:
Active (how long it has been open so far):

fetch dt.davis.problems | filter event.kind == "DAVIS_PROBLEM" | filter event.status == "ACTIVE" | filter event.name == "CPU saturation" | fields host.name, display_id, event.status, open_problem_duration

Closed (how long they lasted):

fetch dt.davis.problems | filter event.kind == "DAVIS_PROBLEM" | filter event.status == "CLOSED" | filter event.name == "CPU saturation" | fields host.name, display_id, event.status, resolved_problem_duration

2) Metric events / alerts

Create a Metric event (for example: “CPU > 95% for ≥ 5 minutes”), and then query it later in Notebooks via dt.davis.events. Events have start and end times, so you can easily calculate each episode’s duration or total time within a window.

Why not just Data Explorer?

Because a selector like:

builtin:host.cpu.usage:splitBy("dt.entity.host")

will only show values, but it won’t “stitch” consecutive points above a threshold into a single episode, nor return its length. For this type of analysis you need Problems/Events in DQL (or Notebooks), where you already have duration fields or can calculate now() - start_time for active problems.

topic Extract the total time that CPU was in saturation for Data Explorer in Dashboarding

Extract the total time that CPU was in saturation for Data Explorer

Re: Data Explorer I want to extract the total time that CPU was in saturation

Re: Data Explorer I want to extract the total time that CPU was in saturation

2) Metric events / alerts

Why not just Data Explorer?