topic Re: Issue with dt.host.availability in DQL

Issue with dt.host.availability

JoãoSilva — Tue, 25 Aug 2026 09:41:02 GMT

Can someone explain why does this DQL query return Host Unavailable for any host every 5 minutes?

If we change the interval to another value, it seems to return host_unavailable at multiples of that interval.

The condition appears to be true for roughly one minute within each interval.

timeseries values = avg(dt.host.availability, default: 0), by: { dt.entity.host, dt.entity.host_group }, filter: { matchesPhrase(entityName(dt.entity.host), "example") }, interval: 5m, from: -15m | fieldsAdd host_availability = arrayLast(values) | filter host_availability == 0 | summarize affected_items = count() | filter affected_items > 0 | fieldsAdd failed_condition = "HOST_UNAVAILABLE"

Re: Issue with dt.host.availability

michiel_otten — Tue, 25 Aug 2026 11:58:51 GMT

With missing data, the value is returned as null. It could be that the most recent minute has not been fully processed or ingested yet, which makes the last datapoint appear missing. Default: 0 would the put it as 0.

Using to: -1m could help here by excluding the most recent, potentially incomplete minute from the query.

Re: Issue with dt.host.availability

AntonioSousa — Thu, 27 Aug 2026 14:38:58 GMT

@michiel_otten ,
The issue, which we've replicated across several tenants is that it most of the times works, but sometimes it does not. Not all minutes behave similarly, and it seems it might have something to do with the interval value. The query above has the following behavior.

Minute 0: gives "Host Unavailable"
Minute 1: does not give "Host Unavailable"
Minute 2: does not give "Host Unavailable"
Minute 3: does not give "Host Unavailable"
Minute 4: does not give "Host Unavailable"
Minute 5: gives "Host Unavailable"
Minute 6: does not give "Host Unavailable"
...

Re: Issue with dt.host.availability

michiel_otten — Thu, 27 Aug 2026 14:55:14 GMT

this is because the Oneagent doesn’t send each minute. The data is null, because of the default 0, you are defaulting it to 0. Therefore it is “Host unavailable” 🙂

Re: Issue with dt.host.availability

AntonioSousa — Thu, 27 Aug 2026 15:36:37 GMT

@michiel_otten ,
Don't understand: "Oneagent doesn’t send each minute"
I have been keeping doing CTRL-F5, with different "interval" values, and it doesn't make any sense. Sometimes it gives “Host unavailable” with intervals of 1 and 3, and not with 2, 4 and 5; sometimes it does not; other times it's with 1 and 2. It's very easy to replicate.

Re: Issue with dt.host.availability

michiel_otten — Thu, 27 Aug 2026 17:51:11 GMT

perhaps I've misread but the interval is not so relevant for the question imo.
Independent of the interval, somethimes the last minute has not arrived yet, resulting in an null value. Therefore when defaulting to 0, the last minute will result in Host Unavailable.

You could fix this adding to: -1m in the query.

If I'm missing the point, I'm sorry.. 🙂