topic Re: Appending makeTimeSeries in DQL

Appending makeTimeSeries

wmisenhe — Wed, 30 Oct 2024 14:30:54 GMT

I have a query used to show open/resolved problems with a makeTimeseries. I would like to have a comparison of the same information, just a week ago, for trending reasons. Would there be a way to do this? Switching to timeseries? Timeseries has a shift command that may be useful

| sort event.status desc

Re: Appending makeTimeSeries

p_devulapalli — Thu, 31 Oct 2024 00:30:36 GMT

Hi @wmisenhe , try the dt.davis.problems.snapshots if you are after a longer trend analysis of problems , here is an example

fetch dt.davis.problems.snapshots, from:now() - 14d | filter isnotnull(display_id) | filter isFalseOrNull(dt.davis.is_duplicate) | dedup display_id | fieldsAdd day = bin(timestamp, 24h) | summarize by:{day, event.status}, count = count()

Re: Appending makeTimeSeries

Fin_Ubels — Thu, 31 Oct 2024 01:21:43 GMT

Hey @wmisenhe

You can append a new query of the same data but with a different timeframe. Then within that appended query you can override the timeframe to be the one from the original query. This will allow you to layer 2 timeseries of different timeframes on top of each other. The last thing to do is to change the graph settings to use the timeframes from the data and not the queries as seen below.

fetch dt.davis.problems | filter isnotnull(display_id) | filter isFalseOrNull(dt.davis.is_duplicate) | dedup display_id | makeTimeseries count = count(), spread: timeframe(from: event.start, to: coalesce(event.end, now())), interval:1h | append [ fetch dt.davis.problems, from:now()-60d, to:now()-30d | filter isnotnull(display_id) | filter isFalseOrNull(dt.davis.is_duplicate) | dedup display_id | makeTimeseries countPrev = count(), spread: timeframe(from: event.start, to: coalesce(event.end, now())), interval:1h | fieldsAdd timeframe = timeframe(from:now()-30d, to:now()) ]

Hope this helps!

Re: Appending makeTimeSeries

m3tomlins — Wed, 07 May 2025 20:22:15 GMT

Sorry to resurrect an old solution - but I'm curious why we don't just have a "shift:" parameter on makeTimeSeries command in DQL?
😊

Re: Appending makeTimeSeries

Fin_Ubels — Wed, 07 May 2025 23:41:29 GMT

I'm not 100% sure but I imagine it is because with the timeseries command you are fetching new records so at that point you can manipulate the timeframe fully and so we can shift. Whereas with makeTimeseries you are turning already fetched records into a timeseries, so the timeframe has already been set at the point where you made your initial fetch.

If I fetch logs between 5am and 6am then my logs will look something like:

timestamp: 2025/05/08 0500, content: some log
timestamp: 2025/05/08 0530, content: some log
timestamp: 2025/05/08 0600, content: some log

Now if I run makeTimeseries using these fetched logs, the timeframe is set by the above logs. Yes you can change that timeframe in the makeTimeseries command but if the logs don't fall within, then we're making a timeseries on nothing. I can't really think of a scenario where I'd want shift within makeTimeseries but if you have one I'd be interested in hearing it!

Re: Appending makeTimeSeries

MikeDouglas — Fri, 07 Nov 2025 16:58:08 GMT

For what it's worth, I just ran into this problem and wanted to create a timeshift against log data for comparison purposes while using the maketimeseries command. I do think this has value.