Issue with dt.host.availability

[JoãoSilva]

Can someone explain why does this DQL query return Host Unavailable for any host every 5 minutes?

If we change the interval to another value, it seems to return host_unavailable at multiples of that interval.

The condition appears to be true for roughly one minute within each interval.

timeseries values = avg(dt.host.availability, default: 0),
    by: {
      dt.entity.host,
      dt.entity.host_group
    },
    filter: {
      matchesPhrase(entityName(dt.entity.host), "example")
    },
    interval: 5m,
    from: -15m

    | fieldsAdd host_availability = arrayLast(values)
    | filter host_availability == 0

    | summarize affected_items = count()
    | filter affected_items > 0
    | fieldsAdd failed_condition = "HOST_UNAVAILABLE"

[michiel_otten]

With missing data, the value is returned as null. It could be that the most recent minute has not been fully processed or ingested yet, which makes the last datapoint appear missing. Default: 0 would the put it as 0.

Using to: -1m could help here by excluding the most recent, potentially incomplete minute from the query.

[AntonioSousa]

@michiel_otten ,
The issue, which we've replicated across several tenants is that it most of the times works, but sometimes it does not. Not all minutes behave similarly, and it seems it might have something to do with the interval value. The query above has the following behavior.

• Minute 0: gives "Host Unavailable"

• Minute 1: does not give "Host Unavailable"

• Minute 2: does not give "Host Unavailable"

• Minute 3: does not give "Host Unavailable"

• Minute 4: does not give "Host Unavailable"

• Minute 5: gives "Host Unavailable"

• Minute 6: does not give "Host Unavailable"

• ...

[michiel_otten]

this is because the Oneagent doesn’t send each minute. The data is null, because of the default 0, you are defaulting it to 0. Therefore it is “Host unavailable” 🙂 

[AntonioSousa]

@michiel_otten ,
Don't understand: "Oneagent doesn’t send each minute"
I have been keeping doing CTRL-F5, with different "interval" values, and it doesn't make any sense. Sometimes it gives “Host unavailable” with intervals of 1 and 3, and not with 2, 4 and 5; sometimes it does not; other times it's with 1 and 2. It's very easy to replicate.

[michiel_otten]

  perhaps I've misread but the interval is not so relevant for the question imo.
Independent of the interval, somethimes the last minute has not arrived yet, resulting in an null value. Therefore when defaulting to 0, the last minute will result in Host Unavailable.

You could fix this adding to: -1m in the query. 

If I'm missing the point, I'm sorry.. 🙂