topic Re: Returns Entity Name | Events in Open Q&A

Extract the name of the entities impacted or related to the event

RPbiaggio — Wed, 06 Mar 2024 15:33:58 GMT

Guys, is it possible to extract the name of the entities impacted or related to the event?

fetch events, from:now()-6h | filter dt.system.bucket == "default_davis_events" | filter event.kind == "DAVIS_PROBLEM" | summarize {problem = takeMax(record(timestamp, event.id, event.start, event.status, entity_tags,affected_entity_types,affected_entity.id,affected_entity.name) )}, by:{{display_id,alias:Problem}, {event.start, alias:Inicio},{event.name, alias:Titulo},maintenance.is_under_maintenance, affected_entity.id, affected_entity.name} | fieldsFlatten problem | expand environment = problem.entity_tags | fieldsAdd environment = (environment=="env:PRD") | expand entidade.afetada = problem.affected_entity_types | fieldsAdd entidade.afetada = in(entidade.afetada, { "dt.entity.host", "dt.entity.hypervisor", "dt_entity.cloud_application", "dt.entity.kubernetes_cluster", "dt.entity.kubernetes_node", "dt.entity.process_group_instance", "dt.entity.cloud_application_namespace", "dt.entity.custom_device" }) | filter environment == true and maintenance.is_under_maintenance == false | filter problem.event.status == "ACTIVE" and entidade.afetada == true

When I pass the field, it returns null.

Re: Returns Entity Name | Events

Pawel_Zalewski — Sun, 14 Jan 2024 10:00:30 GMT

Hi,

So I would change

affected_entity.id

affected_entity_ids

And about entityName please look on this thread https://community.dynatrace.com/t5/DQL/Get-Host-Name-in-Open-Events/m-p/230190

Mr. sinisa_zubic explain there "Since affected_entity_ids are stored in an array, we have to expand it and find to every affected entity ID the entity name. "

Re: Returns Entity Name | Events

RPbiaggio — Sun, 14 Jan 2024 16:03:30 GMT

@Pawel_Zalewski Thanks for the answer. Should this DQL also work for CUSTOM_DEVICE? It's the only one that I can't extract the name from.

Re: Returns Entity Name | Events

Pawel_Zalewski — Sun, 14 Jan 2024 20:36:33 GMT

I think its depends on what variables your script send to Dynatrace and you need to capture them somehow via DQL but overall it's shouldn't. But I'm not really sure about that.