Converting splunk query to DQL timeseries

[esm9374_hca]

I am in process of rebuilding all of our Splunk Dashboards over to Dynatrace Dashboards. A lot of our Dashboards are asking us for the latest value. Below is the splunk query. 

| mstats latest(vault.token.count.by_auth.value) as count where `vault_telemetry` AND cluster=* AND namespace IN ("*") by cluster,namespace,auth_method span=10m
| stats sum(count) as count by _time,auth_method
| eventstats latest(_time) as latesttime
| where _time == latesttime
| stats max(count) as count by auth_method

Maybe I am approaching this issue wrong but I would think you would need to do a time series for and some how pull the latest value in like an array and then do something with it to make this happen. Any advice would greatly be apperciated.

[Fin_Ubels]

Hey esm, if you want to pull the latest value from a timeseries you could do something like:

timeseries count = count(dt.host.availability)
| fields count = arrayLast(count)

 This would return 1 field called count containing the latest value. For more information regarding available array functions including examples you can find them here: https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/functions/array-functions