Need to extract logs on behalf of Opco and IMSI variable

[kumarv14]

Hello everyone and @krzysztof_hoja ,

Can someone help me create a dashboard that uses two input values — Market (OpCo) and IMSI?
I want the dashboard to accept these two values as variables, and then display the logs based on the selected Market and IMSI.

Please find the attached screenshot for reference.
So far, I was able to pass a list for the Market value, but for IMSI I need a user‑input field.
Both values should be passed into the query, and the dashboard should show the results just like in the screenshot.

in first image on which i am working , in second logs pic showing here , what i wants  after enter the values .

Name: Market
Type: Text/List
Default: empty (shows all)
Example values: PT, DE, IN, 

fetch logs, scanLimitGBytes:-1
| filter dt.system.bucket=="_engineering" and index == "serv_db"
| filter Market=="UK" and IMSI=="11502178721"

| fields timestamp,AuditMessage

[kumarv14]

@krzysztof_hoja PFA the snap where i am able to pass IMSI and Market but not getting expected result as i wants about this IMSI against the Market .. I will appreciate you in advance  if you reply with solution on the same .

[t_pawlak · Accepted solution]

Hi,
Yes this is possible, and for your use case the best setup is:

• Market as a List variable
• IMSI as a Free Text variable

Dynatrace dashboards support both list variables and manual text input variables, and you can reference them in DQL using $VariableName. By default, the variable is inserted into the query as a quoted string.
Add a variable to a dashboard <-- here you have documentation.
“empty = show all” is not automatic. You need to handle that logic directly in the DQL query. The same applies if you want Market to support an “All” option. Dashboard variables recalculate the tiles when their values change.
IMO you should set it like this:

Variable 1

• Name: Market
• Type: List
• Values: ALL,PT,DE,IN,UK

Variable 2

• Name: IMSI
• Type: Free Text
• Default: empty

then you can use them in DQL, like this:

fetch logs, scanLimitGBytes:-1
| filter dt.system.bucket == "_engineering" and index == "serv_db"
| filter ($Market == "ALL" or Market == $Market)
| filter IMSI == $IMSI
| fields timestamp, AuditMessage, Market, IMSI
| sort timestamp desc

or you can also replace 

| filter IMSI == $IMSI

to

| filter ($IMSI == "" or IMSI == $IMSI)

[kumarv14]

Hey , 

could you please help me on this ?

App TO DEVICE -> Sending SIMStatus response= STATUS_CODE=6000, Subscription={},Secondary-devices={EID:84130096,sICCID:,Status:Pending-Profile-Release;}

i wants to extract field Status:Pending-Profile-Release in this anyother string can also come i used below query but getting error

fetch logs, scanLimitGBytes:-1
| filter dt.system.bucket=="_engineering" and index=="serv_db"
| filter Market=="IN"
| filter Direction=="OUT"
| filter contains(AuditMessage, "App TO DEVICE -> Sending SIMStatus response")
| parse AuditMessage, "Status:{DeviceStatus};"
| filter DeviceStatus == "Pending-Profile-Release"
| fields timestamp, IMSI, DEG_MDN, DeviceStatus, AuditMessage

[kumarv14]

Thanks for the reply , it is working now .!!