DQL timeseries: aggregate data based on lookup fields

[Adrien_Z]

Hello,

I'm trying to group a timeseries based on new fields I fetch after a lookup.

So basically, I'm fetching a timeseries (here dt.kubernetes.node_conditions). Then, I lookup the kubernetes nodes to get a specific label and the managementZone.

After that, I would like to group the timeseries based on this label and the management zone.

For example:

timeseries avg(dt.kubernetes.node.conditions), by:{dt.entity.kubernetes_node}, interval: 10m
| lookup [fetch dt.entity.kubernetes_node], sourceField:dt.entity.kubernetes_node, lookupField:id
| fieldsAdd node_type = lookup.kubernetesLabels[`kube/nodetype`], managementZone = lookup.managementZones

I didn't find a way to group the timeseries avg(dt.kubernetes.node.conditions) based on these new fields.

Is it something possible ?

[fcourbon]

Hello @Adrien_Z , what kind of output are you expecting ? A time series or a single scalar per node_type (or managementZone)?

[Adrien_Z]

Hello,

I want a time series per node_type that will represent the sum of the timeseries of all nodes having this node_type.

for example:

node |avg(dt.kubernetes.node.condition)|node_type
nodeA|1,1,,,1 |typeA
nodeB|,1,1,1, |typeA

Result: -->
node_type|avg(dt.kubernetes.node.condition)
typeA    |1,2,2,1,1

Let me know if you need more information

[fcourbon]

Thanks for the additional information, this will be possible with an enhancement that will be delivered this year. I will revert with the syntax once it is made available.

[Adrien_Z]

Hello,

Thank you for the information.

I'll wait for the update of this tread

[Tommaso_Fin]

Hi, 

I would need this feature too. Since 2023 is over, is it possible now to do so?

thanks

[krzysztof_hoja · Accepted solution]

It is possible right now. Using the initial example it would look like time:

timeseries cond=avg(dt.kubernetes.node.conditions), by:{dt.entity.kubernetes_node}, interval: 10m
| lookup [fetch dt.entity.kubernetes_node], sourceField:dt.entity.kubernetes_node, lookupField:id
| fieldsAdd node_type = lookup.kubernetesLabels[`kube/nodetype`], managementZone = lookup.managementZones
| summarize {cond=sum(cond[])}, by:{node_type, managementZone, interval, timeframe}

-Kris

[Adrien_Z]

Thank you. It is working now and thanks for the example.

[Tommaso_Fin]

Thanks, it work fine, even if I would never find the solution without your help. The sintax is not really simple

[krzysztof_hoja]

For future reference:
https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/commands/aggregation-command...
Example 6