DQL through API

[jmonroy]

Hello, Dynatrace Community!

I am trying to execute the following DQL (Dynatrace Query Language) query to retrieve user session data via the Dynatrace API:

sql

Copiar

select * FROM usersession WHERE osFamily="Linux" and browserMajorVersion="Chrome 138" and screenOrientation="LANDSCAPE" and displayResolution="FHD"

Is it possible to execute this query directly through the Dynatrace API? If yes, could you please guide me on how to structure the API call properly, and whether any specific headers or parameters are needed to run DQL queries?

Thank you in advance for your help!

[jmonroy]

Is it possible to execute this query directly through the Dynatrace API? Additionally, can the query be executed for a specific time range, or should it return data for the whole day?

[deni · Accepted solution]

Hi @jmonroy, 
You can use this:

curl -X 'GET' \  'https://{environmentid}.live.dynatrace.com/api/v1/userSessionQueryLanguage/table?query=select%20%2A%20FROM%20usersession%20WHERE%20osFamily%3D%22Linux%22%20and%20browserMajorVersion%3D%22Chrome%20138%22%20and%20screenOrientation%3D%22LANDSCAPE%22%20and%20displayResolution%3D%22FHD%22&addDeepLinkFields=false&explain=false' \  -H 'accept: application/json' \  -H 'Authorization: Api-Token XXXX'

About the time - yes, you can:

curl -X 'GET' \  'https://{environmentid}.live.dynatrace.com/api/v1/userSessionQueryLanguage/table?query=select%20%2A%20FROM%20usersession%20WHERE%20osFamily%3D%22Linux%22%20and%20browserMajorVersion%3D%22Chrome%20138%22%20and%20screenOrientation%3D%22LANDSCAPE%22%20and%20displayResolution%3D%22FHD%22&startTimestamp=1753569000&addDeepLinkFields=false&explain=false' \  -H 'accept: application/json' \  -H 'Authorization: Api-Token XXX'

You can see the full list of parameters in the swagger UI:
1. Go to Dynatrace old UI

2. Click on your profile in the upper right corner.

3. Select Environment API v1

4. Check Rum - User Sessions API

Regards, Deni

 

[jmonroy · Accepted solution]

Thank you very much for your response, Deni, it was exactly what I needed. However, I believe Dynatrace is currently missing the capability to query data via DQL in real time.

We are looking to detect when a specific userId connects to a session and immediately trigger alerts. This is especially useful in financial contexts, where real-time awareness is critical. As it stands, the API only allows querying data nearly an hour after the event occurs, which prevents us from generating live alerts — particularly for sessions that may pose a security risk.

From my own experience, I’ve validated that Dynatrace provides enough information to profile a potential attacker. However, receiving that data with such a delay is not sufficient. Ideally, DQL queries via API should work in real time, just like the visual inspection of LIVE sessions. If it's possible to see this data live in the UI, I don’t understand why the same isn’t available through DQL via API.

[deni]

@jmonroy This is a very interesting point.

From what I know, this API works only with closed sessions. I assume it was designed this way (which makes sense to me), because most of the session parameters — such as called actions, durations, business events, etc. — can still change while the session is alive. Only static attributes like sessionId and userId remain fixed. Allowing queries on open sessions could compromise analytics consistency and lead to inaccurate results.

That said, since data about live sessions is visible in the UI, it obviously has to be stored somewhere. It’s possible that this is also in Grail (I’m not certain), but it seems this data cannot be accessed through the API directly. Personally, I would start exploring this through DQL in Notebooks to see what’s feasible.

I can’t give you a definitive answer to your use case yet, but I agree it’s a very important scenario — especially in contexts like financial services where real-time user activity can indicate potential security risks. I’ll experiment further on my side, and if I discover a solution I’ll share it here. Meanwhile, if you come across any workaround or approach, please do the same 🙂

[Julius_Loman]

@jmonroy , @deni - RUM (as it is now) was not designed for real time business analytics, although it is possible to use it for this purpose to some degree. If you need real-time data, bizevents is the path (SaaS only), it fits such use cases much better. Querying live session data will be available with the upcoming RUM in Grail. (SaaS only).

For Dynatrace Managed, the answer depends on particular use cases. I'd recommend focusing on your own Application metrics or USQL metrics (but those are calculated after the session is closed).

[Yosi_Neuman · Accepted solution]

Hi @jmonroy 

Your statement is User Sessions Query Language (AKA USQL) one,  and you can use it with User sessions API

Further information about USQL can be found in Custom queries, segmentation, and aggregation of session data

HTH

Yos