Create Metric for DQL Query

[Vikas_g1997]

Hi Team,
We are looking to create a metric and configure an alert based on the count of logs generated from a specific source. The goal is to trigger an alert if the count value exceeds 500 or 1000.Could anyone suggest how we can set up this metric and configure the alert accordingly? Your assistance would be greatly appreciated.

| filter log.source =="/home/wtrovruns/bb/log/bb-ovo.log"
| summarize eventcount= count()

[moin_DT1]

Hi @Vikas_g1997 
Try using Davis Anomaly Detector.

And there you have to use query with makeTimeseries command. And put 500 or 1000 in the threshold value.

I never created a Metric event like this, but try creating yourself.

Regards,

Moin

[StrangerThing]

This is the way if you want to use DQL

[marco_irmer]

DQL & Davis Anomaly detector can also be used on a log metric. The main difference in using a log metric lies in the fact that the logs do not need to be queried continuously, thus reducing query expenses. The other difference is that the log metric will benefit from the longer default data retention vs logs.

[StrangerThing]

I agree and this is what I do in practice and would recommend to keep query costs down. He was just asking about creating the metric event with DQL

[marco_irmer · Accepted solution]

I believe the most straight-forward way to accomplish this would be to create a log metric to count these log entries. During the configuration, you will be asked to provide filter criteria which will ensure that only the relevant log entries are counted. Once the metric is created you will gain the ability to report and alert on the data just as you would with any other metric.

References:

1. https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-analysis/lma-log-metrics
2. https://docs.dynatrace.com/docs/analyze-explore-automate/logs/lma-openpipeline

[moin_DT1]

@marco_irmer Yes exactly, but i think he would like to if using DQL we can create metric events?

[rguaram]

Hello, how are you? I have achieved it with metric extraction

or also with workflow if the query is very complex