DQL - Extract value from a metric dimension and convert it to a timeseries metric

[36Krazyfists]

For the life of me, I cannot imagine why whomever created the F5 Extension in Dynatrace set the state metrics (for things like Pool State, Pool Member State, etc...) to always be 1 and to have the actual availability state set as a dimension...

Like, why??  The availability state is a number (1 is up, 2 is yellow, 3 is red, and 4 is blue).  Why wouldn't they just return that number as the state metric?  That would be soooo much easier.

Anyways, rant over.

I need to extract the actual availability state number from the pool_member.availstate dimension of the com.dynatrace.extension.f5.bigip.pool_member.state metric so that I can create a Davis Anomaly Detector on it.

Here's the DQL I have so far, but I don't know how to get the availstate dimension out as a metric (I've tried makeTimeSeries but that requires an array of values from the dimension as well as matching start/stop timestamps.

timeseries status=max(com.dynatrace.extension.f5.bigip.pool_member.state), by:{pool_member.name, pool_member.availstate, pool_member.enablestate, pool.name, device.name, device.address}, filter:{pool_member.enablestate == "enabled(1)"}
| lookup [fetch `dt.entity.f5:pool` | fieldsAdd tags | fieldsRename pool.entity_id = id], lookupField:entity.name, sourceField:pool.name
| filter matchesValue(lookup.tags, "Alerting - F5 Pool Member Availability:True")
| fieldsAdd availstate = parse(pool_member.availstate, """LD '(' INTEGER:availstate ')' EOF """)

Is this possible?  We basically want to setup a DAD to alert when the pool member availstate is greater than 1 for a while basically.

[marco_irmer · Accepted solution]

Instead of splitting by pool_member.availstate, you can filter upfront to only include data points for "unhealthy" values where the dimension value is unequal to "green(1)". Combine this with the 'default:0' parameter to create a situation where you'll get a value of '0' for healthy and '1' for unhealthy. You would also ditch the last line where the availstate is being parsed, since that info is no longer needed.

The new DQL would look something like this (formatted for ease of reading):

timeseries unhealthy=max(com.dynatrace.extension.f5.bigip.pool_member.state, 
                          filter: pool_member.availstate != "green(1)", 
                          default: 0), 
           by:{
                pool_member.name,  
                pool_member.enablestate, 
                pool.name, device.name, 
                device.address
              }, 
           filter:{ pool_member.enablestate == "enabled(1)" }
| lookup [fetch `dt.entity.f5:pool` 
          | fieldsAdd tags 
          | fieldsRename pool.entity_id = id],
          lookupField:entity.name, 
          sourceField:pool.name
| filter matchesValue(lookup.tags, "Alerting - F5 Pool Member Availability:True")

I hope that helps 🙂

[36Krazyfists]

Ooh, this looks promising.

And yeah, I did discover how the metric is expected to be used based on looking at the Metric Event rule that is created when installing the extension, but I still like your version better and I still do not understand why they hard-coded the actual metric to always be 1 instead of just having the metric be the availability state value... 

Anyways, thanks and I'll give your idea a try and respond back.