DQL to filter problem events by alerting profile

[dneimke]

I have a DQL query that returns a list of events for problem records which looks like this:

fetch events, from:now()-30d, to:now()  
| filter event.kind == "DAVIS_PROBLEM"
| filter contains(event.name, "database connection")

The query returns records as expected, but now I want to modify the query to filter for just a single alerting profile.

I can see the alerting profiles are coming through in a field/property named labels.alerting_profile

How can I add a filter to my DQL query so that it returns just the alerting_profile records I want?

[Yosi_Neuman · Accepted solution]

Hi @dneimke 

You can try:

| filter matchesValue(labels.alerting_profile,"<the AP you are looking for>")

HTH

Yos 

[dneimke]

Thanks @Yosi_Neuman, that worked!

As a follow up... do you know if it's possible to declare and use variables in grail queries? Similar to using the let statement in kusto queries.

For example, something like this psuedo-code:

// declare a variable
let p = "my_alerting_profile_name"

fetch events, from:now()-30d, to:now()  
... omitted for brevity
| filter matchesValue(profile, $p)  // <-- use the variable here

Note: I'm using these queries in a Notebook

 

[AntonPineiro]

Hi,

I am not sure but maybe this works for you.

Best regards

[Yosi_Neuman]

Hi @dneimke 

Ammm found variables only for dashboards 🙄

Don't know how to add variables to notebook 🤔 

Yos