topic Alert Creation in DQL

Alert Creation

Gib80 — Wed, 14 Jan 2026 15:21:32 GMT

Good Afternoon,

I have been trying to create an alert for when a rate = 0.00 for ALL service names I have, but I'm unclear how to complete it. Any advise would be appreciated. Below is what I have already (created using a log metric)

These are the servicenames for example PT01 and PT02

DQL IS:

timeseries zero = sum(log.risk, default:0.00), interval:1m, by: { servicename, rate }

| fieldsAdd tpsrate = toDoublesrate)
| filter rate == 0.00

Re: Alert Creation

t_pawlak — Wed, 14 Jan 2026 22:47:21 GMT

Hi,
I think, that the issue is that you are grouping by rate (by:{ servicename, rate }). That makes rate a dimension, so you can’t reliably evaluate “rate = 0” per service. Group only by servicename, calculate the series value, and filter the latest point.
Try this, if you want 0 un last 5 min, set interval 5min

timeseries rate = sum(log.risk, default:0), interval:1m, by:{servicename} | fieldsAdd last = arrayLast(rate) | filter last == 0

Or in the metric event, configure split by dimension: servicename, like this:

timeseries rate = sum(log.risk, default:0), interval:5m, by:{servicename} | fieldsAdd last = arrayLast(rate) | filter last == 0