Extract the name of the entities impacted or related to the event

[RPbiaggio]

Guys, is it possible to extract the name of the entities impacted or related to the event?

fetch events, from:now()-6h 
  | filter dt.system.bucket == "default_davis_events" 
  | filter event.kind == "DAVIS_PROBLEM" 
  | summarize {problem = takeMax(record(timestamp, event.id, event.start, event.status, entity_tags,affected_entity_types,affected_entity.id,affected_entity.name) )},
    by:{{display_id,alias:Problem}, {event.start, alias:Inicio},{event.name, alias:Titulo},maintenance.is_under_maintenance, affected_entity.id, affected_entity.name} 
  | fieldsFlatten problem 
  | expand environment = problem.entity_tags 
  | fieldsAdd environment = (environment=="env:PRD")
  | expand entidade.afetada = problem.affected_entity_types 
  | fieldsAdd entidade.afetada = in(entidade.afetada,
      {
        "dt.entity.host", 
        "dt.entity.hypervisor", 
        "dt_entity.cloud_application", 
        "dt.entity.kubernetes_cluster",
        "dt.entity.kubernetes_node",
        "dt.entity.process_group_instance",
        "dt.entity.cloud_application_namespace",
        "dt.entity.custom_device"
        
      })
  | filter environment == true and maintenance.is_under_maintenance == false
  | filter problem.event.status == "ACTIVE" and entidade.afetada == true 

When I pass the field, it returns null.

[Pawel_Zalewski · Accepted solution]

Hi,

So I would change 

affected_entity.id

to

affected_entity_ids

 And about entityName please look on this thread https://community.dynatrace.com/t5/DQL/Get-Host-Name-in-Open-Events/m-p/230190

Mr. sinisa_zubic explain there "Since affected_entity_ids are stored in an array, we have to expand it and find to every affected entity ID the entity name.  " 

[RPbiaggio]

@Pawel_Zalewski Thanks for the answer. Should this DQL also work for CUSTOM_DEVICE? It's the only one that I can't extract the name from.

[Pawel_Zalewski]

I think its depends on what variables your script send to Dynatrace and you need to capture them somehow via DQL but overall it's shouldn't. But I'm not really sure about that.