topic Re: DQL to filter problem events by alerting profile in DQL

DQL to filter problem events by alerting profile

dneimke — Sun, 24 Dec 2023 03:17:33 GMT

I have a DQL query that returns a list of events for problem records which looks like this:

fetch events, from:now()-30d, to:now() | filter event.kind == "DAVIS_PROBLEM" | filter contains(event.name, "database connection")

The query returns records as expected, but now I want to modify the query to filter for just a single alerting profile.

I can see the alerting profiles are coming through in a field/property named labels.alerting_profile

How can I add a filter to my DQL query so that it returns just the alerting_profile records I want?

Re: DQL to filter problem events by alerting profile

Yosi_Neuman — Sun, 24 Dec 2023 07:24:25 GMT

Hi @dneimke

You can try:

| filter matchesValue(labels.alerting_profile,"<the AP you are looking for>")

HTH

Yos

Re: DQL to filter problem events by alerting profile

dneimke — Sun, 24 Dec 2023 08:15:20 GMT

Thanks @Yosi_Neuman, that worked!

As a follow up... do you know if it's possible to declare and use variables in grail queries? Similar to using the let statement in kusto queries.

For example, something like this psuedo-code:

// declare a variable let p = "my_alerting_profile_name" fetch events, from:now()-30d, to:now() ... omitted for brevity | filter matchesValue(profile, $p) // <-- use the variable here

Note: I'm using these queries in a Notebook

Re: DQL to filter problem events by alerting profile

AntonPineiro — Sun, 24 Dec 2023 12:20:10 GMT

Hi,

I am not sure but maybe this works for you.

Best regards

Re: DQL to filter problem events by alerting profile

Yosi_Neuman — Sun, 24 Dec 2023 12:24:56 GMT

Hi @dneimke

Ammm found variables only for dashboards 🙄

Don't know how to add variables to notebook 🤔

Yos