topic Re: Current request count vs baseline in DQL

Current request count vs baseline

OnkarShinde — Wed, 18 Feb 2026 07:16:31 GMT

I am trying to create a DQL to measure the current request count as percentage of the baseline. I intend to use it in an SLO configuration.

I tried something like this:

timeseries { today=sum(dt.service.request.count),by: { dt.entity.service }, interval:1m}
| append [ timeseries {yesterday=sum(dt.service.request.count),by: { dt.entity.service }, shift:-24h, interval:1m} ]
| filter dt.entity.service=="SERVICE-ABC"
| fieldsAdd sli=((today[]/yesterday[])*(100))

But this gives me just one data point and not a time series.

I also looked into the documentation but can not find any details on how to achieve this.

Re: Current request count vs baseline

dannemca — Mon, 16 Feb 2026 18:30:46 GMT

Good day, @OnkarShinde

Try to replace the append by lookup instead.

timeseries { today=sum(dt.service.request.count),by: { dt.entity.service }, interval:1m} | lookup [ timeseries {yesterday=sum(dt.service.request.count) ,by: { dt.entity.service }, shift:-24h, interval:1m} ] , sourceField:dt.entity.service, lookupField:dt.entity.service | filter dt.entity.service=="SERVICE-ABC" | fieldsAdd sli=((today[]/lookup.yesterday[])*(100))

Try and let us know.

Re: Current request count vs baseline

t_pawlak — Tue, 17 Feb 2026 12:59:28 GMT

Hi,
The issue is that append stacks rows from the subquery; it doesn’t place yesterday into the same record as today. So you end up dividing values that usually don’t coexist in one row, which effectively collapses to a single meaningful point (or mostly nulls). Use a join.
Try this:

timeseries today = sum(dt.service.request.count, default: 0), by: { dt.entity.service }, interval: 1m | filter dt.entity.service == "SERVICE-076EAECF9109883D" | join on: { dt.entity.service, interval }, [ timeseries yesterday = sum(dt.service.request.count, default: 0), by: { dt.entity.service }, shift: -24h, interval: 1m ], fields: { yesterday } | fieldsAdd sli = if(yesterday[] == 0, 0, else: (today[] / yesterday[]) * 100)

Re: Current request count vs baseline

OnkarShinde — Wed, 25 Feb 2026 12:19:22 GMT

Should the last line be changed to?

fieldsAdd sli = if(yesterday[] == 0, 100, else: (today[] / yesterday[]) * 100)

If there were no requests yesterday why should the SLI be considered 0, I would rather consider them 100? The intent is to detect the drop in the requests, don't care if there is increase compared to yestertday

Re: Current request count vs baseline

OnkarShinde — Wed, 25 Feb 2026 15:20:54 GMT

I tried to use this in a notebook. But when I try to validate my anomaly detection settings with this query it is not working. The query below with join is working for me.