How to add other dimension column which is not used in DQL to split?

[O11y_Noob]

timeseries { count(`unexpecteddowntime`), value.A = avg(`unexpecteddowntime`) }, by: {`site` }
| fieldsAdd arrayAvg(`count(\`unexpecteddowntime\`)`)
| filter value.A > 30

i am trying to alert whenever the unexpecteddowntime goes above 30 on certain units and group it to site level to avoid multiple alert for same site , but i want to list the units in the email , how can i add it to the DQL , unexpecteddowntime is the metric key and site , units are dims 

[t_pawlak · Accepted solution]

You can try this:

timeseries v = avg(unexpecteddowntime), by: {site, unit}
| summarize {
site_series = avg(v[]), 
units = collectDistinct(unit) 
}, by: {site, timeframe, interval} 
| filter arrayMax(site_series) > 30 
| fieldsAdd units_str = toString(units)