# DQL TimeSeries

**URL:** <https://community.dynatrace.com/t/dql-timeseries/48138>\
**Category:** DQL\
**Tags:** dql, logs\
**Created:** [October 4, 2024, 8:13am UTC](https://community.dynatrace.com/t/dql-timeseries/48138 "2024-10-04T08:13:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gib80](https://avatars.discourse-cdn.com/v4/letter/g/91b2a8/32.png) [@Gib80](https://community.dynatrace.com/u/Gib80)\
**Post date:** [October 4, 2024, 8:13am UTC](https://community.dynatrace.com/t/dql-timeseries/48138/1 "2024-10-04T08:13:49Z")

</div>

Hi All,

I have created a timeseries DQL for a dashboard and I have got so far and I’m now stuck.&nbsp; It produces a line chart for me, but I need the CountofRecords to be one value per 30 min interval (see attached image).

timeseries interval:30m, Requests = sum(log.application),by: {event.original, application}  
| parse event.original, “”“LD '@mt”:’ LD:mt ‘,’ “”"  
| filter matchesPhrase(application, “API”)  
| filter matchesPhrase(mt, “Get request received”)  
| fieldsAdd CountofRecords=arraymovingSum(Requests, 30)

Any help would be appreciated.

 ![Untitled picture.png](https://global.discourse-cdn.com/dynatrace/original/3X/7/f/7f5f6f2e96bc2279c1ed9da2f971928129de0d80.png)

---

<div class="post-metadata">

**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\
**Post date:** [October 4, 2024, 8:24am UTC](https://community.dynatrace.com/t/dql-timeseries/48138/2 "2024-10-04T08:24:36Z")

</div>

Hi&nbsp;[@Gib80](https://community.dynatrace.com/user/76420)

How about this query:

```markup
timeseries interval:30m, Requests = sum(log.application),by: {event.original, application}, filter: matchesPhrase(application, "API")
| parse event.original, """LD '@mt":' LD:mt ',' """
| filter matchesPhrase(mt, "Get request received")
| summarize 
    CountofRecords = sum(Requests[])
    interval = takeAny(interval),
    timeframe = takeAny(timeframe)
| fieldsAdd CountofRecordsMoving=arraymovingSum(CountofRecords, 30)

```

I am not sure why you are using the arrayMovingSum function

Best,  
Sini

---

<div class="post-metadata">

**Author:** ![Gib80](https://avatars.discourse-cdn.com/v4/letter/g/91b2a8/32.png) [@Gib80](https://community.dynatrace.com/u/Gib80)\
**Post date:** [October 4, 2024, 8:35am UTC](https://community.dynatrace.com/t/dql-timeseries/48138/3 "2024-10-04T08:35:05Z")

</div>

Perfect, that worked brilliantly! Thank you.