Davis alert for interface count changes per device (7-day comparison)

RaidanAlmaqtari — Wed, 17 Dec 2025 10:05:13 GMT

Hi everyone,
I’d like to create a Davis anomaly detection (DQL event) that triggers when the number of interfaces (ports) on a network device changes between two time periods (e.g., previous 7 days vs current 7 days).

My initial attempts used a traffic/discards metric and rolling sums, but that’s not ideal when I only need to know how many interfaces exist (or report data) in each period. I think the right approach is to count distinct interfaces per device per period and compare.

Does the DQL below look correct? Is there a simpler/better way?

Goal

Count distinct interfaces per device for last week and this week

Join the two results

Calculate the difference

Trigger a Davis event if the count changed (non-zero difference)

Thanks

timeseries sum(`com.dynatrace.extension.palo-alto.generic.if.in.discards.count`, default: 0),
by: { `dt.entity.network:interface`, `dt.entity.network:device` },
from: now() - 14d, to: now() -7d, interval: 1m
| fieldsAdd prev_roll = arrayMovingSum(`sum(\`com.dynatrace.extension.palo-alto.generic.if.in.discards.count\`, default:0)`, windowsize: 60)
| fieldsAdd aligned_key = toTimestamp(toLong(timeframe[start]) + 604800000.0)
// | fieldsKeep `dt.entity.network:interface`, `dt.entity.network:device`, aligned_key, prev_roll

| join [
timeseries sum(`com.dynatrace.extension.palo-alto.generic.if.in.discards.count`, default: 0),
by: { `dt.entity.network:interface`, `dt.entity.network:device` },
from: now() - 7d, to: now(), interval: 1m
| fieldsAdd curr_roll = arrayMovingSum(`sum(\`com.dynatrace.extension.palo-alto.generic.if.in.discards.count\`, default:0)`, windowsize: 60)

| fieldsAdd aligned_key = timeframe[start]
| fieldsKeep `dt.entity.network:interface`, `dt.entity.network:device`, aligned_key, curr_roll
], on: { `dt.entity.network:interface`, `dt.entity.network:device`,aligned_key}

Re: Davis alert for interface count changes per device (7-day comparison)

IzabelaRokita — Wed, 17 Dec 2025 10:04:29 GMT

Hey @RaidanAlmaqtari ,
I just wanted to check in and see if you still need help with this. If so, I’d be happy to look into it for you! 😊
Please let me know what works best for you.

topic Davis alert for interface count changes per device (7-day comparison) in DQL

Davis alert for interface count changes per device (7-day comparison)

Re: Davis alert for interface count changes per device (7-day comparison)