Converting splunk query to DQL timeseries

esm9374_hca — Mon, 09 Sep 2024 14:34:42 GMT

I am in process of rebuilding all of our Splunk Dashboards over to Dynatrace Dashboards. A lot of our Dashboards are asking us for the latest value. Below is the splunk query.

| mstats latest(vault.token.count.by_auth.value) as count where `vault_telemetry` AND cluster=* AND namespace IN ("*") by cluster,namespace,auth_method span=10m
| stats sum(count) as count by _time,auth_method
| eventstats latest(_time) as latesttime
| where _time == latesttime
| stats max(count) as count by auth_method

Maybe I am approaching this issue wrong but I would think you would need to do a time series for and some how pull the latest value in like an array and then do something with it to make this happen. Any advice would greatly be apperciated.

Re: Converting splunk query to DQL timeseries

Fin_Ubels — Mon, 09 Sep 2024 23:11:56 GMT

Hey esm, if you want to pull the latest value from a timeseries you could do something like:

timeseries count = count(dt.host.availability) | fields count = arrayLast(count)

This would return 1 field called count containing the latest value. For more information regarding available array functions including examples you can find them here: https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/functions/array-functions

topic Re: Converting splunk query to DQL timeseries in DQL

Converting splunk query to DQL timeseries

Re: Converting splunk query to DQL timeseries