topic How to record the result from a DQL query and modify the output in Automations

How to record the result from a DQL query and modify the output

Kaladhar — Wed, 07 May 2025 07:04:55 GMT

Hello Everyone,

I am trying to record content from the result/output of the previous DQL query so that I can modify the output.

Example:

DQL query:

timeseries { count(`metric-A`), value.A = avg(`metric-A`, scalar: true) }, by: { message_vpn_name, client_user_name }, filter: { NOT matchesValue(client_user_name, "X=xyz.abc") AND NOT matchesValue(client_user_name, "*12345*") }

Sample Output in table format:

VPN client_user_name

EFGHI def-sit.com

JIKOL def-int.com

etc.....

Now I want to record this output and then remove everything from '-' in the output (ex: -sit.com, -int.com, etc).

I tried using "data record(content" metric command and then string function "replaceString" to modify the output which is not working.

Please suggest the right the metric command and string function or for loop if possible.

Thanks,

Re: How to record the result from a DQL query and modify the output

ChristopherHejl — Wed, 07 May 2025 08:09:55 GMT

ReplaceString requires an exact string. You can either try to make a pattern and use replacePattern or split the string based on the "-".
One example I came up with (using cpu metric as an example)
client_user_name_adjusted field will have the value of any "k8s.node.name" which comes before the first "-":

timeseries { avg(dt.host.cpu.user), value.A = avg(dt.host.cpu.user, scalar: true) }, by: { k8s.node.name, host.name } | fieldsAdd client_user_name_adjusted = splitString(k8s.node.name, "-")[0]

Re: How to record the result from a DQL query and modify the output

Kaladhar — Wed, 07 May 2025 11:27:42 GMT

This looks great. Thanks for the quick response.

I just want to update that another string function substring(xyz_abc_123, from: 0, to: 3) does the work for me.