# Detect Synthetic Location Failures Using DQL for Alerting **URL:** \ **Category:** DQL\ **Tags:** dql, synthetic-monitoring\ **Created:** [February 17, 2025, 3:52pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298 "2025-02-17T15:52:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sivart\_89](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@sivart\_89](https://community.dynatrace.com/u/sivart_89)\ **Post date:** [February 17, 2025, 3:52pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298/1 "2025-02-17T15:52:53Z")
I’m trying to essentially replicate this type of built-in alert, to a dql and davis anomaly detector. What would the dql look like for a synthetic that runs every 5 minutes at 5 different locations where I want to alert if any single location fails 3 consecutive runs? ![sivart_89_0-1739807473699.png](https://global.discourse-cdn.com/dynatrace/original/3X/c/c/cce67d6a654a0b11d32916d82f656fd524ed3434.png) ---
**Author:** ![Eric\_Yu](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/eric_yu/32/20360_2.png) [@Eric\_Yu](https://community.dynatrace.com/u/Eric_Yu)\ **Post date:** [February 19, 2025, 3:18pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298/2 "2025-02-19T15:18:40Z")
You could try building a logic using the synthetic events table: ```python fetch dt.synthetic.events ``` There are a couple fields there, like the status code, location and synthetic id that can help create another event or make some kind of timeseries for what you’re looking for ![Eric_Yu_0-1739978205859.png](https://global.discourse-cdn.com/dynatrace/original/1X/849062e9f8289c71e9a30592a0b991619d0925cc.png) ---
**Author:** ![sivart\_89](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@sivart\_89](https://community.dynatrace.com/u/sivart_89)\ **Post date:** [February 19, 2025, 3:27pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298/3 "2025-02-19T15:27:40Z")
I had tried something like the below but it ended up alerting when there were 2 consecutive failures in 1 location when I want it to only alert when there are 3 consecutive failures (synthetic runs every 5 minutes) ```markup timeseries Synthetics = avg(dt.synthetic.browser.executions), by: {dt.entity.synthetic_test, dt.entity.synthetic_location, state, dt.source_entity}, interval: 1m | fieldsAdd syntheticName = entityName(dt.entity.synthetic_test) | fieldsAdd locationName = entityName(dt.entity.synthetic_location) | filter contains(syntheticName, "") | filter state == "FAIL" | fieldsAdd arrayWithFailureConditions = arrayMovingMax(Synthetics, 5) | fieldsRemove Synthetics | summarize TotalAvailability = sum(arrayWithFailureConditions[]), by: {timeframe, interval, syntheticName, dt.entity.synthetic_test} ``` ![sivart_89_0-1739978823371.png](https://global.discourse-cdn.com/dynatrace/original/2X/9/96ef6a2e726681d3e1d4c0eac3491cb928abeeff.png) ---
**Author:** ![Eric\_Yu](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/eric_yu/32/20360_2.png) [@Eric\_Yu](https://community.dynatrace.com/u/Eric_Yu)\ **Post date:** [February 20, 2025, 2:56pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298/4 "2025-02-20T14:56:54Z")
I think the way you did it is very clever, it should work. However, if I’m understanding what your query does correctly, I feel like you should modify it to arrayMovingSum instead of Max, use a 15 window and also split the summarization by location too. Maybe like this: Can you maybe show your resulting data? ```java .... | fieldsAdd arrayWithFailureConditions = arrayMovingSum(Synthetics, 15) | fieldsRemove Synthetics | summarize TotalAvailability = sum(arrayWithFailureConditions[]), by: {timeframe, interval, syntheticName, dt.entity.synthetic_test, locationName} ``` If you can also show your threshold and alerting condition that’d be helpful too. ---
**Author:** ![sivart\_89](https://avatars.discourse-cdn.com/v4/letter/s/848f3c/32.png) [@sivart\_89](https://community.dynatrace.com/u/sivart_89)\ **Post date:** [February 25, 2025, 12:38pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298/5 "2025-02-25T12:38:39Z")
Thank you for the input here. I tried out your query since it did seem to be showing me what I wanted. I can can see that the datapoint value will rise to 1 upon the first failure then 5 mins later it will rise to 2 because of there being 2 consecutive failures and so on. Everything looks good from what I can see but the alert never actually triggers even though the preview shows it should. Still looking into why this never actually triggers and creates a problem. Full dql here ```markup timeseries Synthetics = avg(dt.synthetic.browser.executions), by: {dt.entity.synthetic_test, dt.entity.synthetic_location, state, dt.source_entity}, interval: 1m | fieldsAdd syntheticName = entityName(dt.entity.synthetic_test) | fieldsAdd locationName = entityName(dt.entity.synthetic_location) | filter syntheticName == "Test Google" | filter state == "FAIL" | fieldsAdd arrayWithFailureConditions = arrayMovingSum(Synthetics, 15) | fieldsRemove Synthetics ``` ![sivart_89_0-1740486700453.png](https://global.discourse-cdn.com/dynatrace/original/3X/1/0/104a70aeea2c749e1dc3e0f3ab8226327a2ba711.png) This is defined in the detector. I kept the sliding window to 3 because in my mind it needs to be below 5 since the synthetic runs every 5 mins, if that is not accurate please let me know. Violating sample I left to 1 because as soon as we have above 2 failures then I want to alert (aka, on the 3rd consecutive failure) ![sivart_89_2-1740486953699.png](https://global.discourse-cdn.com/dynatrace/original/3X/c/f/cfa05ec3cc68f3008e27f5ffec3160a4e7328a90.png) ---
**Author:** ![izabelarokita](https://avatars.discourse-cdn.com/v4/letter/i/b487fb/32.png) [@izabelarokita](https://community.dynatrace.com/u/izabelarokita)\ **Post date:** [December 18, 2025, 12:33pm UTC](https://community.dynatrace.com/t/detect-synthetic-location-failures-using-dql-for-alerting/50298/6 "2025-12-18T12:33:56Z")
Hey [@sivart\_89](https://community.dynatrace.com/user/17361) , I just wanted to check in and see if you still need help with this. If so, I’d be happy to look into it for you! :blush: Please let me know what works best for you.