topic Re: Metric Events Query Failed - missing alerts in DQL

Metric Events Query Failed - missing alerts

Vijayt — Tue, 31 Mar 2026 13:24:29 GMT

i am configuring Warning alerts for OS mount points only not application mount points.

Configured it using DSQL with filtering disk names /, /opt, /var but i am getting metric event QUERY_FAILED.

builtin:host.disk.usedPct:filter(and(
or(or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/opt~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/var~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/root~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/home~")"))),
or(in("dt.entity.disk",entitySelector("type(disk),entityName.equals(~"/tmp~")")))),
or(in("dt.entity.host",entitySelector("type(host),networkZone(~"nw-2105~")")),
or(in("dt.entity.host",entitySelector("type(host),tag(~"team:Linux11~")")))))
:splitBy("dt.entity.host","dt.entity.disk")

Tagged those disks and with tag DSQL still the same Query_FAILED

i could not configure metric key based one as entity filer only for server not for disks

How to solve this issue

Re: Metric Events Query Failed - missing alerts

AntonPineiro — Tue, 31 Mar 2026 13:38:48 GMT

Hi,

For alerting about mount points, maybe you use Filesystem monitoring extension.

Best regards

Re: Metric Events Query Failed - missing alerts

t_pawlak — Tue, 31 Mar 2026 14:45:02 GMT

Hi,

QUERY_FAILED usually means the issue is with the metric selector itself, not with disk alerting.

In your case, the selector is overly complex and has incorrect or(...) nesting. Also make sure you're using proper entity selector syntax (type("DISK"), type("HOST")).

:Start with a single mount point (e.g. /) and validate it in Data Explorer (Advanced mode). Then gradually add more (/opt, /var, etc.), then use it in a metric event.

Something like this:

builtin:host.disk.usedPct :filter( and( in("dt.entity.disk",entitySelector("type(\"DISK\"),entityName.equals(\"/\")")), in("dt.entity.host",entitySelector("type(\"HOST\"),tag(\"team:Linux11\")")) ) ) :splitBy("dt.entity.host","dt.entity.disk")

If your goal is to alert on specific mount points (e.g. only /, /var), a better approach would be what @AntonPineiro suggested, using the Filesystem Monitoring extension. It natively supports mount point checks and allows alerting per path, without the need for complex selectors.