How to build a DQL query that accounts for timestamp discrepancies

[Nick-Montana]

Greetings,

I am capturing the JSON response body of a transaction as a bizEvent in Dynatrace. Everything looks good except for one discrepancy that I need help accounting for. As you can see from the screenshot below occasionally the Agent captures the json response body in quick successions one after the other and every value within the record is the same. Ultimately this make the my resulting summations inaccurate. Below the highlighted timestamps in the normal behavior for capture intervals. So we can assume that if all the values in the record are the same and there is more than 1 record within a short amount of time (lets say 2-5 minutes) then in truth there is only a single transaction taking place

So how would I write a DQL query that combines n>1 transactions if all other values are the same besides the timestamp? 

[joeistyping · Accepted solution]

Hi Nick thanks for asking!

If the other fields are unique to a particular transaction (like request id), you can summarize and get the # unique transactions (number of unique records).

As an example below, I grab a few bizevents including timestamps, all related to the some similar traceparents:

by using summarize you can group records together, use the timestamp of the earliest data sent and append any optional fields too.

If you would like add other fields, append them to the "by" clause

| summarize timestamp=takeLast(timestamp), by:{traceparent, dt.entity.process_group}

Resulting in 2 unique records (2 unique requests):

Hope this helps!