Generating Problem with workflow action "Analyze with Davis"

[Akhil-Jayendran]

Hello Community,

I am currently exploring the workflow capabilities for Analyze with Davis. I’ve created a simple workflow that runs every day at 05:00 AM to check for specific errors in a particular log. If the error count is 1, it should create a problem. I added an action ‘Analyze with Davis’ included my dql and set the static threshould, workflow runs successfully not getting any problem/events out of this ? Does the ‘Analyze with Davis’ action in a workflow automatically create a problem like the Anomaly Detection app, or do we need to use JavaScript to create the problem ?

[Emm4nuel]

Hi Akhil,

Yes, you need to push the problem using a separate task. For instance, I have two executions—one without anomalies and another where the static threshold condition was exceeded.

Use values from the result JSON to define a condition in the next task. Based on that, I either send an alert to Slack or push a problem to the Problems API.

You’ll notice that the execution with an issue includes additional fields like raisedAlerts, numberOfViolations, etc., which help identify and handle the problem.

[Akhil-Jayendran]

Thanks @Emm4nuel  ,

I’ve added a JavaScript action, but unfortunately it’s not working. My JavaScript knowledge is a bit limited. I’ve attached the workflow JSON ,any chance to have look?

[Emm4nuel · Accepted solution]

You have a structure mistake in your output variable, I fixed it: Try with this code:

Please, let me know if it works for you.

import { eventsClient, EventIngestEventType } from "@dynatrace-sdk/client-classic-environment-v2";
import { execution } from "@dynatrace-sdk/automation-utils";

export default async function ({ executionId }) {
  // Step 1: Get workflow execution result
  const exe = await execution(executionId);
  const checkResult = await exe.result("check_logs");

  // Step 2: Inspect output structure
  // I made the change here!
  const output = checkResult?.result?.output[0];
  const dimensions = output?.dimensions || [];

  console.log("Full dimensions:", JSON.stringify(dimensions, null, 2));

  // Step 3: Extract potentialAlerts from dimensions
  const potentialAlertDim = dimensions.find(dim => dim.key === "potentialAlerts");
  console.log("Raw potentialAlertDim:", potentialAlertDim);

  const potentialAlerts = parseInt((potentialAlertDim?.value || "0").trim(), 10);
  console.log("Parsed potentialAlerts:", potentialAlerts);

  // Step 4: If alert count > 0, send a custom event
  if (potentialAlerts > 0) {
    const hostDimension = dimensions.find(dim => dim.key === "dt.entity.host");
    const hostId = hostDimension?.value;

    if (hostId) {
      console.log(`Raising event on host: ${hostId}`);

      await eventsClient.createEvent({
        body: {
          eventType: EventIngestEventType.CustomAnnotation,
          title: "⚠️ Predicted Disk Capacity Alert",
          description: "Disk issue detected based on timeseries analysis",
          entitySelector: `type(HOST),entityId("${hostId}")`,
          properties: {
            "dt.entity.host": hostId,
            severity: "warning"
          },
          source: "workflow-automation"
        }
      });
    } else {
      console.log("Host ID not found in dimensions.");
    }
  } else {
    console.log("No potential alerts found.");
  }
};

[Akhil-Jayendran]

Thank you so much  @Emm4nuel  , it worked like a charm.