Adding a filter in timeseries gives strange effect, is it a bug or is it a feature?

[henk_stobbe]

Good morning,

Look at below example:

        timeseries {
        new = sum(dt.process.network.sessions.new),
       {reset = sum(dt.process.network.sessions.reset), filter: dt.entity.host=="HOST-XYX"},
       {timeout = sum(dt.process.network.sessions.timeout), default:0}
       },
       by:{dt.entity.host}

==> the filter gets places on new reset and timeout

In this example:

        timeseries {
        new = sum(dt.process.network.sessions.new),
       {reset = sum(dt.process.network.sessions.reset), filter: dt.entity.host=="HOST-XYX"},
       {timeout = sum(dt.process.network.sessions.timeout), filter: dt.entity.host=="HOST-ABC"}
       },
       by:{dt.entity.host}

==> the filters are "and" so you get no results

So is DQL right or wrong?

KR Henk

[GerardJ]

Hi @henk_stobbe 
This could be caused by the default union parameter value when combining multiple timeseries :

DQL Metric commands — Dynatrace Docs

[krzysztof_hoja · Accepted solution]

The correct syntax looks like this and every thing works even if there is no common subset between data for 2 timeseries. Please use filter: clause inside regular brackets (not curly).

re: second query. Syntax is incorrect. This query should not even execute:

[henk_stobbe]

Hello,

This is why I like the community so much (-; 

As a remark, you really need to drop the BY:

An you can now use things like:

        | fieldsAdd x = arrayAvg(r1) - arrayAvg(r2)
        | fieldsKeep x

This is what my customer liked to see. Thanks!

KR Henk

[henk_stobbe]

one more addon, if you want to keep timeseries:

| fieldsAdd x = timeout[] + new[]
| fieldsKeep timeframe,interval,x

Have fun!