topic add a timeseries field in DQL

add a timeseries field

Anonymous — Wed, 16 Jul 2025 08:21:46 GMT

Hi,

Here is a simple dql example to ilustrate my issue

timeseries test=avg(dt.host.cpu.usage), by:{dt.entity.host}
| fieldsadd cpu_state=if(arrayAvg(test)>7,1,else:0)

I would like to see history of cpu_state, but I always have one value (may be due to the arrayAvg). How can I see cpu state as a graph and see the value evolution?

Regards,

Marc

Re: add a timeseries field

GerardJ — Wed, 16 Jul 2025 08:52:57 GMT

Hi @Anonymous
I don't really understand what you want to do, could you elaborate a bit more on your use case and what you want to achieve?

Re: add a timeseries field

Anonymous — Wed, 16 Jul 2025 09:43:01 GMT

Hi Gerard,
Of course
If I just create this dql
timeseries test=avg(dt.host.cpu.usage), by:{dt.entity.host}
I get a graph of cpu usage evolution for each host based on the time windows I have selected in the dashboard.
Suppose now that I want to create a new field named status on cpu usage wher rule is the following
if cpu_usage is above 7 then state = 1

if cpu_usage is below 7 then state =0

I would like to display state graph based on the time windows I have selected in the dashboard.
How can I do that?

Re: add a timeseries field

GerardJ — Wed, 16 Jul 2025 12:07:38 GMT

Ok I got it
So what you want is something like that :

here I use an iterative expression to compare each timeserie array value to the treshold
I choose to display it as a table for clarity but you can also use this state array in a graph

There are other possibilities, for display purposes for example i'd rather use the thresholds which have the advantage of being visual while preserving the true cpu values on the graph.