Hi Harry. 3rd gen dashboards and DQL are not really meant to use management zones so it's a little more complicated than it should for now. In the future there will be better features (filters) for doing this...
In the meantimen the only way you can access the management zone is to do a lookup with the affected entities. Imagine you want to get services in the "Cloud: Google" MZ. Something like this might help:
fetch events
| filter event.kind=="DAVIS_PROBLEM"
| dedup display_id, sort:{timestamp desc} // Remove duplicates
| filter contains(tostring(affected_entity_types), "dt.entity.service")
| expand affected_entity_ids
| filter contains(affected_entity_ids, "SERVICE")
| lookup [fetch dt.entity.service], sourceField:affected_entity_ids, lookupField:id, fields:{managementZones}
| filter contains(toString(managementZones), "Cloud: Google")
There are other options, you might want to use the alerting profile, the entity_tags field, etc...
2 - I feel autocomplete is your best bet. You can also do "fetch events" in a record list visualizations and look at the left part of the table (it has a list of all fields).
3- Probably becasue labels.alerting_profile is an array (you can see this in the raw visualization) and those are string functions. You can use tostring to turn it into a string.
fetch events
| filter contains(toString(labels.alerting_profile), "Default")
or use something like arrayIndexOf
Featured Posts
