topic Re: Join DQL fields in DQL

Join DQL fields

Pablo2 — Tue, 03 Jun 2025 15:06:15 GMT

I have the following DQL with which I get information about the hosts and the activity of their services.

timeseries avg(dt.osservice.availability)
by: { host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name}
filter: { NOT matchesValue(dt.osservice.status, { “active”, “running” }) }

I want to get out what OS the host listed in my DQL has.

I've tried something like this but it doesn't match it, any solution?

timeseries avg(dt.osservice.availability)
by: { host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name, osType}
filter: { NOT matchesValue(dt.osservice.status, { “active”, “running” }) }
| expand host.name
| lookup [fetch dt.entity.host], sourceField:host.name, lookupField:osType

Re: Join DQL fields

StrangerThing — Tue, 03 Jun 2025 16:42:32 GMT

Try this:

timeseries avg(dt.osservice.availability), by: { host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name, osType}, filter: { NOT in(dt.osservice.status, array("active", "running")) } | expand host.name | lookup [fetch dt.entity.host], sourceField:host.name, lookupField:entity.name, fields:{osType}

Re: Join DQL fields

marco_irmer — Tue, 03 Jun 2025 22:09:04 GMT

Another way to accomplish this would be to add the dt.entity.host dimension to the timeseries query, and then use the entityAttr() function to retrieve the osType field value.

The query looks like this:

timeseries avg(dt.osservice.availability), by: { dt.entity.host, host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name, osType}, filter: { NOT in(dt.osservice.status, array("active", "running")) } | fieldsAdd entityAttr(dt.entity.host,"osType")