Issue with dt.host.availability

[JoãoSilva]

Can someone explain why does this DQL query return Host Unavailable for any host every 5 minutes?

If we change the interval to another value, it seems to return host_unavailable at multiples of that interval.

The condition appears to be true for roughly one minute within each interval.

timeseries values = avg(dt.host.availability, default: 0),
    by: {
      dt.entity.host,
      dt.entity.host_group
    },
    filter: {
      matchesPhrase(entityName(dt.entity.host), "example")
    },
    interval: 5m,
    from: -15m

    | fieldsAdd host_availability = arrayLast(values)
    | filter host_availability == 0

    | summarize affected_items = count()
    | filter affected_items > 0
    | fieldsAdd failed_condition = "HOST_UNAVAILABLE"

[michiel_otten]

With missing data, the value is returned as null. It could be that the most recent minute has not been fully processed or ingested yet, which makes the last datapoint appear missing. Default: 0 would the put it as 0.

Using to: -1m could help here by excluding the most recent, potentially incomplete minute from the query.