topic Re: Looking for suggestions related to DQL in DQL

Looking for suggestions related to DQL

harry22 — Sun, 19 May 2024 15:20:49 GMT

Hi All,

I am looking for a way to find below details using DQL. Please suggest:

1. How to get the management zones of the open problems? I tried below but it did not work:

fetch events | filter event.kind == "DAVIS_PROBLEM" AND matchesValue(labels.management_zone, "NAME_HERE")

2. How to know what are the possible fields in a category(logs, events etc) and vice versa(eg. labels.alerting_profile will be under events?)

3. In labels.alerting_profile we have multiple elements stored inside it. How to get only those rows in result where labels.alerting_profile contains only the specified element and nothing else. I tried matchesValue, MatchesPhrase, matchesValue[element] etc however no luck.

Thanks in advance.

Re: Looking for suggestions related to DQL

FranciscoGarcia — Mon, 20 May 2024 11:35:38 GMT

Hi Harry. 3rd gen dashboards and DQL are not really meant to use management zones so it's a little more complicated than it should for now. In the future there will be better features (filters) for doing this...

In the meantimen the only way you can access the management zone is to do a lookup with the affected entities. Imagine you want to get services in the "Cloud: Google" MZ. Something like this might help:

fetch events | filter event.kind=="DAVIS_PROBLEM" | dedup display_id, sort:{timestamp desc} // Remove duplicates | filter contains(tostring(affected_entity_types), "dt.entity.service") | expand affected_entity_ids | filter contains(affected_entity_ids, "SERVICE") | lookup [fetch dt.entity.service], sourceField:affected_entity_ids, lookupField:id, fields:{managementZones} | filter contains(toString(managementZones), "Cloud: Google")

There are other options, you might want to use the alerting profile, the entity_tags field, etc...

2 - I feel autocomplete is your best bet. You can also do "fetch events" in a record list visualizations and look at the left part of the table (it has a list of all fields).

3- Probably becasue labels.alerting_profile is an array (you can see this in the raw visualization) and those are string functions. You can use tostring to turn it into a string.

fetch events | filter contains(toString(labels.alerting_profile), "Default")

or use something like arrayIndexOf

Re: Looking for suggestions related to DQL

harry22 — Tue, 21 May 2024 17:08:33 GMT

Hi Francisco,

Thank you for the details. It is helpful.

Regarding point 2 - How can we do vice versa? Eg. How would someone know that managementZone is under dt.events.service ? Is there a plan/possibility to extend a feature like describe to give more details about a field/category?

Thanks in advance.

Re: Looking for suggestions related to DQL

FranciscoGarcia — Tue, 21 May 2024 20:30:40 GMT

Mmmm...I don't think so. Not sure if it being planned...

There is a semantic dictionary where you might be able to search, but I realize it isn't exactly what you are asking for: https://docs.dynatrace.com/docs/platform/semantic-dictionary/model/dt-entities

Also, in the future I wonder if Davis Copilot might be able to help when it creates DQL queries from natural language....

Re: Looking for suggestions related to DQL

harry22 — Tue, 21 May 2024 20:55:00 GMT

Thank you, Francisco.

Framing a DQL would be really quick once we have access to create it using Davis Copilot.