08 Jul 2026
03:33 PM
- last edited on
09 Jul 2026
07:57 AM
by
MaciejNeumann
Hi,
Is there a way to create an anomaly detection alert with added details that may change during the alert condition? I want to have some values in the event/problem details and those values may change dy
For example, consider this DQL - just for an example, the details field is random and changes with each query.
timeseries avg(dt.host.cpu.load)
| fieldsAdd details=concat("app: ",toLong(round(random()*100)))
I want to have the details in the event description or event property.
Davis events emitted by such anomaly detector are not properly deduplicated, so problems will open and close continuously, likely due to the details changing with each DQL execution. The anomaly detector does not allow me to set any correlation tag in dt.event.correlation_tag .
CC @DavidBruendl
Featured Posts