Current request count vs baseline

[OnkarShinde]

I am trying to create a DQL to measure the current request count as percentage of the baseline. I intend to use it in an SLO configuration.

I tried something like this:

timeseries { today=sum(dt.service.request.count),by: { dt.entity.service }, interval:1m}
| append [ timeseries {yesterday=sum(dt.service.request.count),by: { dt.entity.service }, shift:-24h, interval:1m} ]
| filter dt.entity.service=="SERVICE-ABC"
| fieldsAdd sli=((today[]/yesterday[])*(100))

But this gives me just one data point and not a time series.

I also looked into the documentation but can not find any details on how to achieve this.

[dannemca]

Good day, @OnkarShinde 

Try to replace the append by lookup instead.

timeseries { today=sum(dt.service.request.count),by: { dt.entity.service }, interval:1m}
| lookup [ timeseries {yesterday=sum(dt.service.request.count)
          ,by: { dt.entity.service }, shift:-24h, interval:1m} ] , sourceField:dt.entity.service, lookupField:dt.entity.service
| filter dt.entity.service=="SERVICE-ABC"
| fieldsAdd sli=((today[]/lookup.yesterday[])*(100))

Try and let us know.

[OnkarShinde]

I tried to use this in a notebook. But when I try to validate my anomaly detection settings with this query it is not working. The query below with join is working for me.

[t_pawlak]

Hi,
The issue is that append stacks rows from the subquery; it doesn’t place yesterday into the same record as today. So you end up dividing values that usually don’t coexist in one row, which effectively collapses to a single meaningful point (or mostly nulls). Use a join.
Try this:

timeseries today = sum(dt.service.request.count, default: 0),
         by: { dt.entity.service },
         interval: 1m
| filter dt.entity.service == "SERVICE-076EAECF9109883D"
| join on: { dt.entity.service, interval }, [
    timeseries yesterday = sum(dt.service.request.count, default: 0),
             by: { dt.entity.service },
             shift: -24h,
             interval: 1m
  ], fields: { yesterday }
| fieldsAdd sli = if(yesterday[] == 0, 0, else: (today[] / yesterday[]) * 100)

[OnkarShinde]

Should the last line be changed to?

fieldsAdd sli = if(yesterday[] == 0, 100, else: (today[] / yesterday[]) * 100)

If there were no requests yesterday why should the SLI be considered 0, I would rather consider them 100? The intent is to detect the drop in the requests, don't care if there is increase compared to yestertday