Creating a MTTD tile in DT dashboard

[sarfarazx01a]

Hi All,

I'm working on a tile for Mean Time To Detect (MTTD) to detect the problem when it occurs first. I wrote a DQL query, but I think the query is not giving the correct results. Can anyone please assist me on this.

fetch events
| filter event.kind == "DAVIS_PROBLEM"
| fieldsAdd time
| fieldsAdd detection_time = toDuration(timestamp - event.start)
//| summarize mean_detection_time = avg(detection_time)

[p_devulapalli]

@sarfarazx01a Depending on your definition of MTTD you can use something like below to calculate MTTD for each of the problems . 

fetch events
| filter event.status_transition == "CREATED" AND event.kind == "DAVIS_PROBLEM"
| fieldsAdd `PRB_MTTD` = timestamp - event.start

[sarfarazx01a]

Hi @p_devulapalli ,

Thank you for the query, but the query doesn't give the correct MTTD. In my environment, a problem detected at 19:30 and it gave a MTTD as 9.06 min but the problem started analysis at 19:27 so the MTTD would be 3 min, am i correct with the below scenario?
Kindly suggest

19:27 Analysis timeframe start. Davis evaluates performance across timeframe (for example, 3 of 5 minutes show anomalous performance). No event reported at this time.

19:39 Earliest event in analysis timeframe reported, backdated to analysis timeframe start. Problem is in processing state awaiting completion of topology analysis. Problem is raised and pushed to Dynatrace web UI and Problems API.

19:39 Davis completes processing of the problem. Alerts are delivered via alerting profiles.
Thanks,
Sarfaraz

[t_pawlak]

Hi @sarfarazx01a 

Yes — based on how Dynatrace works internally, your 3-minute interpretation is conceptually correct, but from a DQL perspective the platform only exposes the analysis window start and the problem creation time.

So in practice, the only universally reliable MTTD you can calculate in DQL is:

MTTD = problem creation time – analysis start time

Try this:

fetch events
| filter event.kind == "DAVIS_PROBLEM"
| filter event.status_transition == "CREATED"
| fields
    problem_id = event.id,
    problem_created = timestamp,
    analysis_start = event.start
| fieldsAdd
    MTTD = problem_created - analysis_start
| summarize
    avg_MTTD = avg(MTTD),
    min_MTTD = min(MTTD),
    max_MTTD = max(MTTD)