DQL makeTimeSeries Table

[angelriosST]

I have this code using makeTimeseries, but I want each count value to be displayed in a different row so I can display it as a table or as a bar chart and not in an array in a single row.

fetch logs
| filter matchesPhrase(content, "is suspected as having")
| parse content, """DATA "Cluster member " DATA STRING:Server """
| makeTimeseries count=count(), by:{interval:10m}

[krzysztof_hoja · Accepted solution]

If it is enough to display in a table only intervals where there is data and skip intervals where there were not matching log lines, using summarize instead of makeTimeseries will do the job:

| summarize {count=count()}, by: {timestamp=bin(timestamp, 10m)}

Example result on my data looks like:

If you need all timestamps also these without matching records which you see as empty element in array, it is possible right only via some trick described here: https://community.dynatrace.com/t5/DQL/Add-the-interval-time-to-a-timeseries-array/m-p/233181/highli...
But we are already working on easy way of proper expanding timeseries produced by timeseries and makeTimeseries commands without loosing context of time for each element

Kris

[angelriosST]

Thank you very much for your help