topic Re: makeTimeseries for error rate calculated from fetching spans in DQL

makeTimeseries for error rate calculated from fetching spans

virdavindersing — Tue, 10 Jun 2025 16:52:33 GMT

Below Is the query to fetch spans and calculate error rate

fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND matchesValue(k8s.namespace.name, $Tenant) AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api"))
| summarize all=count(), by:{dt.entity.kubernetes_cluster, start_time}
| join [fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api")) AND (http.response.status_code!=200 AND http.response.status_code!=201)
| summarize failed=count(), by:{dt.entity.kubernetes_cluster, start_time}
], kind:leftOuter, prefix:"http.", on:{dt.entity.kubernetes_cluster, start_time}
| fieldsAdd {errorrate = http.failed/all *100}
| fieldsRemove all, http.failed
// | makeTimeseries {avg(errorrate)}, by:{interval:10m}

but I am unable to create a timeseries for error rate from the above query.

please help

Re: makeTimeseries for error rate calculated from fetching spans

virdavindersing — Tue, 10 Jun 2025 18:23:57 GMT

changed the DQL to below, getting the trendline now but not sure how to handle null records

fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND matchesValue(k8s.namespace.name, $Tenant) AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api"))
| makeTimeseries all=count(), interval: 1m
| join [fetch spans
| filter matchesValue(entityAttr(dt.entity.kubernetes_cluster, "entity.name"), "fin-iac-rel-tnl-atm-pr") AND in(dt.entity.service, classicEntitySelector("""type("SERVICE"),fromRelationship.isServiceOf(type("CLOUD_APPLICATION"),tag("dashboard:atm"))""")) AND (matchesPhrase(endpoint.name, "/wasp/api")) AND (http.response.status_code!=200 AND http.response.status_code!=201)
| makeTimeseries failed=count(default: 0),interval: 1m
], kind:leftOuter, prefix:"http.", on:{interval, timeframe}
| fieldsAdd {errorrate = http.failed[]/all[] *100}
| fieldsRemove all, http.failed
| fieldsAdd rate = arrayAvg(errorrate)

Re: makeTimeseries for error rate calculated from fetching spans

krzysztof_hoja — Tue, 10 Jun 2025 18:44:47 GMT

It can be achieved with much simpler query:

and if you want to have breakdown by k8s cluster, just add:

Re: makeTimeseries for error rate calculated from fetching spans

virdavindersing — Wed, 11 Jun 2025 03:49:15 GMT

thanks for your reply

Re: makeTimeseries for error rate calculated from fetching spans

virdavindersing — Tue, 22 Jul 2025 04:26:07 GMT

can you please help why is this DQL not working

Re: makeTimeseries for error rate calculated from fetching spans

krzysztof_hoja — Tue, 22 Jul 2025 10:32:34 GMT

Spans table has "start_time" and "and_time" fields. You need to specify which you want to use as a time to aggregate. Something like in example below:

fetch spans | makeTimeseries count(), time:start_time

Re: makeTimeseries for error rate calculated from fetching spans

virdavindersing — Tue, 22 Jul 2025 13:15:02 GMT

thank you