Notebook query

[Stephen1_Lee]

Hi

I can see that event.kind == "DAVIS_PROBLEM" can be used as a filter for notebook events.

But can we also filter on the labels.

For example in the event, I can see 

labels.management_zone:Synthetic

So can I add a  filter expression?  I tried (labels.management_zone == "Synthetic") but my query returns nothing.

[michal_zawislak]

Hi @Stephen1_Lee,

You could try with matchesValue e.g.

fetch events | filter event.kind == "DAVIS_PROBLEM" AND matchesValue(labels.management_zone, "Synthetic")

Please check out the documentation for more usage examples.

[Stephen1_Lee]

hi.  the matchesValue works.

I as trying to dashboard a barchart of problems per management zone so I could make it into a tile.

Running this over the past 2 hrs only give me 2 records.

fetch events
| filter (event.kind == "DAVIS_PROBLEM") and matchesValue(labels.management_zone, "EBE")
| summarize value = count(), by:{display_id,event.status}
| fields display_id,event.status

[Stephen1_Lee]

but when I go to problems and filter to the same management zone I see 10 active problems.

I would like a dashboard tile of the same bar chart.

[sinisa_zubic]

Hi Stephen,

First, I would like to share with you some info about Davis problems in Grail. Davis problem records in Grail represent snapshots of a problem. So for one problem, there are multiple records and the most recent record for a problem represents the current status of a problem. E.g. here you have a DQL query that shows you the open and close time stamps for problems

fetch events
| filter event.kind == "DAVIS_PROBLEM"
| fieldsAdd close_ts = if(event.status == "CLOSED" AND event.status_transition == "RESOLVED",timestamp)
| fieldsAdd open_ts = if(event.status == "ACTIVE" AND event.status_transition == "UPDATED",timestamp)
| filter isNotNull(close_ts) or isNotNull(open_ts)
| summarize 
  open = min(open_ts),
  closed = max(close_ts),
  by:{display_id, event.category, event.name }
| sort open asc

So it might be possible if you query for problems in the last 2h that you don't get all active problems of the last 2 hours. For instance if a problem was opened more than 3 hours ago and there was no update since then. 

Unfortunately what you want to achieve, to display number of problems per management zone, is currently not possible with DQL & Grail. The management zone information is stored as array information for a problem. But the team is currently working on a "expand" command which expands arrays to multiple records. With that new command the query will be possible. Expect it to be released within the next couple months.

Best,
Sini