Timeseries remark/question

[henk_stobbe]

Good morning,

The best way to explain is to show below examples, with the remark that only the first one works and does exactly what I wished  for:  

timeseries var1 = sum(.y.z, {var2 = sum(x.yz)}
| fieldsAdd var3 = (var1 [] / var2 [] * 100)
| fieldsRemove var1, var2

timeseries var1 = sum(.y.z, {var2 = sum(x.yz)}
| fieldsAdd var3 = (var1 [] / var2 [] * 100)
| fields var3

timeseries var1 = sum(.y.z, {var2 = sum(x.yz)}
| fieldsAdd var3 [] = (var1 [] / var2 [] * 100)
| fieldsRemove var1, var2

timeseries var1 = sum(.y.z, {var2 = sum(x.yz)}
| fieldsAdd var3 [] = (var1 [] / var2 [] * 100)
| fields var3

So my question is simple why don't I need the extra  "[]" in the fields add, and why can't I  use the "fields 3"

Who can shed some light on this?

@marc_zantingh 

KR Henk

[PedroSantos]

Hey Henk!

DQL documentation is a little all over the place at the moment, but I'll try to answer from what experience with it I've gathered so far.

Regarding the need for '[]':

If we don't use the [], we'd be referencing the timeseries as an object and not the values inside.

If we want to reference the timeseries values inside an expression, we need to use the array accessor []

However, when we are defining a new field with fieldsAdd, DQL expects us to provide the expression directly. 

I think var3 [] = … is actually syntactically invalid because we'd be trying to define a timeseries as if it were already materialized. DQL simply claims that ver3 doesn't exist. 

So, in essence, when we write "var3[] =" we're actually writing "var3[] = the content of var3 is" and not "var[]3 = the  array var3 is". They look almost similar but they're not the same.

So if we just write "var3[] =" then we're just asking DQL to write the contents inside of var3, to which DQL promptly replies "I have no idea what var3 is"

---------------

Regarding the "fields 3" issue, 

timeseries var1 = sum(`metric2`), var2 = sum(`metric2`)
| fieldsAdd var3 = (var1 [] / var2 [] * 100)
| fields var3

 This seems to work for me, but I didn't quite understand your usage of 'sum': sum(.y.z, {var2 = sum(x.yz)} so my test query is probably not suited for what you're trying to test.

Any chance you could clarify the question? 

Let me know if any of this helps you, cheers 😄

[henk_stobbe]

Hi Pedro,

Great answer thanks, I have checked the last one again:

timeseries var1 = sum(a.b.c),filter {(type =="FLOWER") AND (color=="RED")}, {var2 = sum(a.b.c), filter {color=="GREEN}}
| fieldsAdd var3 = (var1 [] / var2 [] * 100)
| fields var3

(sorry I had to remove customer data (-;)

DQL reply: Query does not return a timeseries. Consider using the makeTimeseries command

There is no issue removing fields, or not removing anything..

Thanks Henk

[PedroSantos]

Hey @henk_stobbe , so I tried to put your query on a Demo Live environment notebook to see if I could replicate the issue you're facing, but it's not a valid query.

Then I tried to adjust it to make it valid but maintain the query purpose, but didn't have much success either:

(This is on demo live so the metrics are from there and there isn't any customer data here).

Are you getting that error on a notebook or on another app that uses DQL?

Is there any chance you can try to replicate your query on demo live with dummy data metrics (so without customer info) like I did to replicate your specific error and post it here? 

Thanks 🙂

[henk_stobbe]

Hi Pedro,

Sure, and FYI that is a great idea in general to put error query's on demo env, and that share it on the community if you want to share your issue.

For this an extra "Kudo". This could even be a community guideline!

KR Henk

[henk_stobbe]

To expand on the previous,

Made it super simple (on DEMO):

Returns a timeseries (as it should)

Adding fields (or fieldsKeep) returns an array:

KR Henk

[krzysztof_hoja]

re: presence of []
Examples in documentation look lie this:
https://docs.dynatrace.com/docs/discover-dynatrace/platform/grail/dynatrace-query-language/operators... , so no [] on left side. In fact left side is optional as name of new field can be derived from exression on the right.

Additionally: you do not define explicity type of target field, it is always derived from expression on the right. Expressions you showed implicltly use iCollectArray, which by definition produces array so the type is vey well known.

re: array vs timeseries. 

timeseries is a bit "virtual" term: arrays of numbers with timeframe (type) and interval (being of type duration). It is not even obligatory that they are named as timeseries command produces. Please check example below:

Is is more defined by consumers like visualization tiles or anomaly detection, then DQL as a language itself.

[henk_stobbe]

Hi Krzysztof,

Thanks for expanding and clarifying, so only what is left for me is that given a timeseries:

fields (and fieldskeep) return an array, and remove fields (or do nothing) return the timeseries,

This seems to me not very consistent?

KR Henk

[krzysztof_hoja · Accepted solution]

when you use | fields commad, you are asking just to leave fields enumerated after, so effectively you are removing fields being timeframe and interval.

when you used | fieldsRemove var1, var2 you asked only to remove var and var2, so as a result imeframe and interval stayed.

[henk_stobbe]

Hello Krzysztof,

Took me another 10 minutes, and then "The penny dropped", the answer  was already in your previous reply (-;

Thank you again for clarifying!

KR Henk