Need alternative to spread in DQL to avoid value distribution across the entire timeframe

jeffrey_valerio — Wed, 17 Dec 2025 19:19:01 GMT

Hello, I need to know if it’s possible to use DQL to maintain some kind of counter.
My goal is to detect a condition only when the alert has occurred at least twice, so that a problem is raised only when it reaches that threshold.

Here is the logic I am currently using:

| fieldsAdd alerta = coalesce(
    // Scenario 1
    if(
      EquipoA != EquipoB
      and (EquipoA != dirCorreA or EquipoA != dirCorreB)
      and (EquipoB != dirCorreA or EquipoB != dirCorreB)
      and dirCorreA != dirCorreB,
      true
    ),

    // Scenario 2
    if(
      dirCorreA == "CRI400C "
      and EquipoB == "CRI400H"
      and trim(dirCorreB) != trim(_icadir),
      true
    ),

// Default
false
)

| filter alerta

| lookup [
    fetch `dt.entity.ibm_i:host`
    | fields id, name = entity.name
    | fieldsAdd equipo_join = upper(trim(name))
],
sourceField: EquipoA,
lookupField: equipo_join,
fields: { id }

| fieldsKeep _icadir, timeframe, id, _icanom, icanom,
dirCorreA, dirCorreB, alerta, EquipoA, EquipoB

|| makeTimeseries alert = countIf(alerta),
by: { _icadir, id, _icanom, icanom,
dirCorreA, dirCorreB, EquipoA, EquipoB },
spread: timeframe,

What I need now is a way to evaluate this series so that a problem is only triggered when alert occurs two or more times within the selected timeframe.

The issue is that, since we have to use spread, the value gets distributed across the entire timeframe. Is there any other way to do this?

topic Need alternative to spread in DQL to avoid value distribution across the entire timeframe in DQL

Need alternative to spread in DQL to avoid value distribution across the entire timeframe