cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

DQL makeTimeSeries Table

angelriosST
Frequent Guest

I have this code using makeTimeseries, but I want each count value to be displayed in a different row so I can display it as a table or as a bar chart and not in an array in a single row.

fetch logs
| filter matchesPhrase(content, "is suspected as having")
| parse content, """DATA "Cluster member " DATA STRING:Server """
| makeTimeseries count=count(), by:{interval:10m}

angelriosST_0-1714765967990.png

 

2 REPLIES 2

krzysztof_hoja
Dynatrace Champion
Dynatrace Champion

If it is enough to display in a table only intervals where there is data and skip intervals where there were not matching log lines, using summarize instead of makeTimeseries will do the job:

| summarize {count=count()}, by: {timestamp=bin(timestamp, 10m)}

Example result on my data looks like:

krzysztof_hoja_0-1715017912142.png


If you need all timestamps also these without matching records which you see as empty element in array, it is possible right only via some trick described here: https://community.dynatrace.com/t5/DQL/Add-the-interval-time-to-a-timeseries-array/m-p/233181/highli...
But we are already working on easy way of proper expanding timeseries produced by timeseries and makeTimeseries commands without loosing context of time for each element

 

Kris

 

Thank you very much for your help

Featured Posts