topic Re: Create Metric for DQL Query in Open Q&A

Create Metric for DQL Query

Vikas_g1997 — Wed, 05 Mar 2025 07:02:23 GMT

Hi Team,
We are looking to create a metric and configure an alert based on the count of logs generated from a specific source. The goal is to trigger an alert if the count value exceeds 500 or 1000.Could anyone suggest how we can set up this metric and configure the alert accordingly? Your assistance would be greatly appreciated.

| filter log.source =="/home/wtrovruns/bb/log/bb-ovo.log"
| summarize eventcount= count()

Re: Create Metric for DQL Query

moin_DT1 — Fri, 07 Mar 2025 12:30:49 GMT

Hi @Vikas_g1997
Try using Davis Anomaly Detector.

And there you have to use query with makeTimeseries command. And put 500 or 1000 in the threshold value.

I never created a Metric event like this, but try creating yourself.

Regards,

Moin

Re: Create Metric for DQL Query

marco_irmer — Thu, 06 Mar 2025 20:23:08 GMT

I believe the most straight-forward way to accomplish this would be to create a log metric to count these log entries. During the configuration, you will be asked to provide filter criteria which will ensure that only the relevant log entries are counted. Once the metric is created you will gain the ability to report and alert on the data just as you would with any other metric.

References:

Re: Create Metric for DQL Query

moin_DT1 — Mon, 17 Mar 2025 11:44:05 GMT

@marco_irmer Yes exactly, but i think he would like know, if using DQL its possible to create metric events?

Re: Create Metric for DQL Query

rguaram — Fri, 07 Mar 2025 16:59:28 GMT

Hello, how are you? I have achieved it with metric extraction

or also with workflow if the query is very complex

Re: Create Metric for DQL Query

StrangerThing — Fri, 07 Mar 2025 18:44:58 GMT

This is the way if you want to use DQL

Re: Create Metric for DQL Query

marco_irmer — Fri, 07 Mar 2025 18:56:01 GMT

DQL & Davis Anomaly detector can also be used on a log metric. The main difference in using a log metric lies in the fact that the logs do not need to be queried continuously, thus reducing query expenses. The other difference is that the log metric will benefit from the longer default data retention vs logs.

Re: Create Metric for DQL Query

StrangerThing — Fri, 07 Mar 2025 19:03:30 GMT

I agree and this is what I do in practice and would recommend to keep query costs down. He was just asking about creating the metric event with DQL