How to query which alerting profiles are associated with a Dynatrace entity?

[satish_a_prasad]

Hopefully this feature is hiding somewhere 🙂

we have a tenant with a gazillion hosts and services. i need to quickly inventory which alerting profiles are mapped to specific hosts or services. I'm hoping i don't have to sit and open every single alerting profile to determine whether my specific host/service is mapped into it.

I know one workaround is that if a Problem was recently detected on that host/service, then the Problems view has an "alerting profile" column to help with the mapping.
But what if it's a super healthy host/service that hasn't seen any problems recently?

[p_devulapalli]

@satish_a_prasad From what I understand alerting profiles in Dynatrace are associated with events and not the entities. They are set to filter and manage problem notifications and are applied at the problem level, not at the individual entity level.

So, the alerting profiles may not actually show up against hosts or services unless we have some smart tagging configured to set alert profile name as a tag on the entity or use the tag set on the entity as a alert profile name as a reference

[michiel_otten]

This is correct.  Alerting profiles relate to events. Therefore you can start with querying the events related to an alerting profile.  When doing this via DQL (fetch events), you can add the affected entities. Now you have the entities. This should enable you to match each alerting profile to entities.

[t_pawlak]

Hi,
Here’s how I approached it.

I checked which fields are available on DAVIS_PROBLEM events to see how I could link problems to an alerting profile and the impacted entities:

fetch events
| filter event.kind == "DAVIS_PROBLEM"
| limit 1

From this inspection I noticed the label labels.alerting_profile.

So as @michiel_otten and @p_devulapalli  wrote, I mapping alerting profile with entities and counted problems:

fetch events
| filter event.kind == "DAVIS_PROBLEM" AND event.status_transition == "CREATED"
| fieldsAdd ap = coalesce(
    labels.alerting_profile,
    labels.alertingProfile,
    labels.alertingprofile
)
| filter isNotNull(ap)
| expand ae = affectedEntities
| summarize problems = count(), by: {
  alerting_profile = ap,
  entityType = ae.entityType,
  entityId   = ae.entityId,
  entityName = ae.displayName
}
| sort alerting_profile asc, problems desc

If you don’t want the results aggregated, just remove the summarize step and keep the expanded rows.