https://community.dynatrace.com/t5/DQL/Using-multiple-timeframes-in-a-single-query-with-lookups/m-p/220291#M185 <P>Hi&nbsp;<a href="https://community.dynatrace.com/t5/user/viewprofilepage/user-id/55118">@PiotrG</a>&nbsp;</P> <P>I have just tried it out by executing following query:</P> <LI-CODE lang="markup">fetch dt.entity.host, from:now() -15m | fieldsAdd key = 1 | lookup [fetch events, from:now()-180m, to:now()-175m | fieldsAdd key=1 | sort timestamp asc | fields timestamp,key], sourceField:key, lookupField:key, prefix:"withTF." | lookup [fetch events | fieldsAdd key=1 | sort timestamp asc | fields timestamp,key], sourceField:key, lookupField:key, prefix:"withoutTF." | fields from= now()-15m, withTF.timestamp, withoutTF.timestamp</LI-CODE> <P>If you don't specify the TF in the lookup, then the TF is inherited from the original query.</P> <P>Best,<BR />Sini</P> Wed, 09 Aug 2023 14:00:23 GMT sinisa_zubic 2023-08-09T14:00:23Z https://community.dynatrace.com/t5/DQL/Using-multiple-timeframes-in-a-single-query-with-lookups/m-p/220287#M184 <DIV class="p-rich_text_section">Hey!</DIV> <PRE class="c-mrkdwn__pre" data-stringify-type="pre">fetch dt.entity.host, from: now()-15m //1 [...] | lookup [ fetch events, from: now()-3h //2 ...] | lookup [ timeframe, //3 ...] [rest of the main host query]</PRE> <DIV class="p-rich_text_section">I'm wondering about the timeframes that would be used in this query.<BR />1 is clear, I'm sure it will use last 15 minutes.<BR />2 also seems clear, if it's alright to alter the timeframe within a lookup command<BR />3 I'm not sure about, if no timeframe is provided in a lookup query does it inherit timeframe from the original query or will it use last set timeframe or is the behaviour completely different?<BR />Thanks!</DIV> Thu, 10 Aug 2023 08:05:21 GMT https://community.dynatrace.com/t5/DQL/Using-multiple-timeframes-in-a-single-query-with-lookups/m-p/220287#M184 PiotrG 2023-08-10T08:05:21Z https://community.dynatrace.com/t5/DQL/Using-multiple-timeframes-in-a-single-query-with-lookups/m-p/220291#M185 <P>Hi&nbsp;<a href="https://community.dynatrace.com/t5/user/viewprofilepage/user-id/55118">@PiotrG</a>&nbsp;</P> <P>I have just tried it out by executing following query:</P> <LI-CODE lang="markup">fetch dt.entity.host, from:now() -15m | fieldsAdd key = 1 | lookup [fetch events, from:now()-180m, to:now()-175m | fieldsAdd key=1 | sort timestamp asc | fields timestamp,key], sourceField:key, lookupField:key, prefix:"withTF." | lookup [fetch events | fieldsAdd key=1 | sort timestamp asc | fields timestamp,key], sourceField:key, lookupField:key, prefix:"withoutTF." | fields from= now()-15m, withTF.timestamp, withoutTF.timestamp</LI-CODE> <P>If you don't specify the TF in the lookup, then the TF is inherited from the original query.</P> <P>Best,<BR />Sini</P> Wed, 09 Aug 2023 14:00:23 GMT https://community.dynatrace.com/t5/DQL/Using-multiple-timeframes-in-a-single-query-with-lookups/m-p/220291#M185 sinisa_zubic 2023-08-09T14:00:23Z