# Fetch active problems

**URL:** <https://community.dynatrace.com/t/fetch-active-problems/40019>\
**Category:** DQL\
**Tags:** dql\
**Created:** [June 1, 2023, 6:51am UTC](https://community.dynatrace.com/t/fetch-active-problems/40019 "2023-06-01T06:51:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![educampver](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/educampver/32/29917_2.png) [@educampver](https://community.dynatrace.com/u/educampver)\
**Post date:** [June 1, 2023, 6:51am UTC](https://community.dynatrace.com/t/fetch-active-problems/40019/1 "2023-06-01T06:51:42Z")

</div>

Hi,

I am trying to make a query that would fetch currently active problems, but I’m struggling with handling multiple of the same&nbsp;`display_id`.&nbsp;The filters I think will be good enough for me would look like this:  
`| filter event.kind == "DAVIS_PROBLEM" and event.status == "ACTIVE"`. However, now I need a way to fetch only the latest update of a given problem (to my understanding, the same problem id multiple times means the problem got updated and I only want to consider the problem from the latest snapshot). Thanks in advance!

---

<div class="post-metadata">

**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\
**Post date:** [June 1, 2023, 7:58am UTC](https://community.dynatrace.com/t/fetch-active-problems/40019/2 "2023-06-01T07:58:51Z")

</div>

Hi Edu,

One way of achieving this would be following

- fetch all problems
- sort them by the timestamp
- summarize them by display\_id and select the first status. because in the previous step the records are sorted by timestamp, you will get after the summarize the latest problem status
- then you just filter for active problems

And here you have the query

```markup
fetch events
| filter event.kind == "DAVIS_PROBLEM"
| sort timestamp desc
| summarize affected_entities= first(affected_entity_ids),event.status=first(event.status), by:display_id
| filter event.status != "CLOSED"

```

Also please have a look at following help page where there are further DQL davis examples:&nbsp;[Dynatrace Intelligence DQL examples — Dynatrace Docs](https://www.dynatrace.com/support/help/shortlink/davis-dql-examples)

Best,  
Sini

---

<div class="post-metadata">

**Author:** ![AK](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/ak/32/164_2.png) [@AK](https://community.dynatrace.com/u/AK)\
**Post date:** [February 3, 2024, 3:46pm UTC](https://community.dynatrace.com/t/fetch-active-problems/40019/3 "2024-02-03T15:46:14Z")

</div>

[@sinisa\_zubic](https://community.dynatrace.com/user/38283),

We are using similar query to fetch the problems which are open for more than 15 days.

However, what we are observing is, it is not matching with the count on problem card page.

As per more information received from support, **fetch events** &nbsp;is fetching the events associated with problem not actual number of problem and problem may have multiple events.

Is it possible to get actual count of problem or if that is not possible, how can we modify above query to match it to actual problem number on problem card page?

Regards,

AK

---

<div class="post-metadata">

**Author:** ![DantePaoloni](https://avatars.discourse-cdn.com/v4/letter/d/b38774/32.png) [@DantePaoloni](https://community.dynatrace.com/u/DantePaoloni)\
**Post date:** [February 3, 2024, 9:52pm UTC](https://community.dynatrace.com/t/fetch-active-problems/40019/4 "2024-02-03T21:52:38Z")

</div>

You should keep only those events where&nbsp; **display\_id** &nbsp;is not null.&nbsp; As you notice if you don’t do this, you will fetch all the events in the tenant.

Cheers.

---

<div class="post-metadata">

**Author:** ![sinisa\_zubic](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/sinisa_zubic/32/32498_2.png) [@sinisa\_zubic](https://community.dynatrace.com/u/sinisa_zubic)\
**Post date:** [February 5, 2024, 1:45pm UTC](https://community.dynatrace.com/t/fetch-active-problems/40019/5 "2024-02-05T13:45:39Z")

</div>

Don’t know the details of the conversation you had with support, but with adding

```markup
| filter event.kind == "DAVIS_PROBLEM"

```

to the query, you filter only on problems and not the events related to the problems.

My response from 1st June is already a bit outdated. Since then additional fields have been added to Grail ([which are also documented in the release notes](https://docs.dynatrace.com/docs/shortlink/release-notes-saas-sprint-274#fixed-data-types-of-grail-fields-for-davis-event-and-davis-problem-events)) and should also be in the query:&nbsp;problem.dt.davis.is\_duplicate,&nbsp; problem.maintenance.is\_under\_maintenance .

following query should give you a much more accurate result.

```markup
fetch events, from:now()-370m
| filter dt.system.bucket == "default_davis_events"
| filter event.kind == "DAVIS_PROBLEM"
| summarize {problem=takeMax(record(timestamp,resolved_problem_duration,dt.davis.is_duplicate,event.status,maintenance.is_under_maintenance,dt.davis.is_frequent_event, event.start)) }, by:{display_id}
| fieldsFlatten problem
| filter problem.event.status != "CLOSED"
| filter problem.dt.davis.is_duplicate == false and problem.maintenance.is_under_maintenance == false

```

And to filter on those events, which are longer open than 15 days just add to the query this:

```markup
| filter problem.event.start < now() - 15d

```

Best,  
Sini