03 Jun 2025 04:06 PM
I have the following DQL with which I get information about the hosts and the activity of their services.
timeseries avg(dt.osservice.availability)
by: { host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name}
filter: { NOT matchesValue(dt.osservice.status, { “active”, “running” }) }
I want to get out what OS the host listed in my DQL has.
I've tried something like this but it doesn't match it, any solution?
timeseries avg(dt.osservice.availability)
by: { host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name, osType}
filter: { NOT matchesValue(dt.osservice.status, { “active”, “running” }) }
| expand host.name
| lookup [fetch dt.entity.host], sourceField:host.name, lookupField:osType
03 Jun 2025 05:42 PM
Try this:
timeseries avg(dt.osservice.availability),
by: { host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name, osType},
filter: { NOT in(dt.osservice.status, array("active", "running")) }
| expand host.name
| lookup [fetch dt.entity.host], sourceField:host.name, lookupField:entity.name, fields:{osType}
03 Jun 2025 11:09 PM
Another way to accomplish this would be to add the dt.entity.host dimension to the timeseries query, and then use the entityAttr() function to retrieve the osType field value.
The query looks like this:
timeseries avg(dt.osservice.availability),
by: { dt.entity.host, host.name, dt.osservice.status, dt.osservice.startup_type, dt.osservice.name, osType},
filter: { NOT in(dt.osservice.status, array("active", "running")) }
| fieldsAdd entityAttr(dt.entity.host,"osType")