topic Re: DQL makeTimeSeries Table in DQL

DQL makeTimeSeries Table

angelriosST — Tue, 07 May 2024 12:49:31 GMT

I have this code using makeTimeseries, but I want each count value to be displayed in a different row so I can display it as a table or as a bar chart and not in an array in a single row.

fetch logs
| filter matchesPhrase(content, "is suspected as having")
| parse content, """DATA "Cluster member " DATA STRING:Server """
| makeTimeseries count=count(), by:{interval:10m}

Re: DQL makeTimeSeries Table

krzysztof_hoja — Mon, 06 May 2024 17:57:31 GMT

If it is enough to display in a table only intervals where there is data and skip intervals where there were not matching log lines, using summarize instead of makeTimeseries will do the job:

| summarize {count=count()}, by: {timestamp=bin(timestamp, 10m)}

Example result on my data looks like:

If you need all timestamps also these without matching records which you see as empty element in array, it is possible right only via some trick described here: https://community.dynatrace.com/t5/DQL/Add-the-interval-time-to-a-timeseries-array/m-p/233181/highlight/true#M490
But we are already working on easy way of proper expanding timeseries produced by timeseries and makeTimeseries commands without loosing context of time for each element

Kris

Re: DQL makeTimeSeries Table

angelriosST — Mon, 06 May 2024 18:23:04 GMT

Thank you very much for your help