{"id":1014,"date":"2026-05-29T12:19:58","date_gmt":"2026-05-29T12:19:58","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1014"},"modified":"2026-05-29T12:20:00","modified_gmt":"2026-05-29T12:20:00","slug":"dynatrace-query-language-tutorial-complete-step-by-step-dql-guide-from-basics-to-advanced-observability-queries","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/dynatrace-query-language-tutorial-complete-step-by-step-dql-guide-from-basics-to-advanced-observability-queries\/","title":{"rendered":"Dynatrace Query Language Tutorial: Complete Step-by-Step DQL Guide from Basics to Advanced Observability Queries"},"content":{"rendered":"\n

Dynatrace Query Language, or DQL<\/strong>, is the query language used to explore, filter, aggregate, correlate, and visualize data stored in Dynatrace Grail<\/strong>. Dynatrace describes DQL as a language for exploring data, discovering patterns, identifying anomalies\/outliers, and building analysis on top of Grail data. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n

This guide is designed for hands-on learning in the Dynatrace Playground<\/strong>, especially from:<\/p>\n\n\n\n

Dynatrace Playground \u2192 Notebooks \u2192 Add \u2192 DQL\n<\/code><\/pre>\n\n\n\n
You can copy\/paste most examples directly.<\/p>\n\n\n\n
\n\n\n\n
1. Where to run DQL in Dynatrace<\/h1>\n\n\n\n
You can run DQL in multiple Dynatrace places.<\/p>\n\n\n\n
Option 1: Notebooks \u2014 best place for learning<\/h2>\n\n\n\n
Use this for practice, training, investigation, and experiments.<\/p>\n\n\n\n
Steps:<\/p>\n\n\n\n
1. Open Dynatrace Playground\n2. Go to Apps\n3. Open Notebooks\n4. Click Notebook or Create new notebook\n5. Open Add menu\n6. Select DQL\n7. Paste query\n8. Click Run\n<\/code><\/pre>\n\n\n\n
Dynatrace\u2019s own tutorial recommends Notebooks<\/strong> for running DQL examples: go to Notebooks<\/strong>, create a notebook, open Add<\/strong>, select DQL<\/strong>, enter your query, and click Run<\/strong>. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Option 2: Dashboards \u2014 best place for reusable charts<\/h2>\n\n\n\n
Use this when you want to convert your DQL into a dashboard tile.<\/p>\n\n\n\n
Steps:<\/p>\n\n\n\n
1. Open Dynatrace Playground\n2. Go to Dashboards\n3. Open or create a dashboard\n4. Click Add > DQL\n5. On Data tab, paste query\n6. Click Run\n7. Go to Visual tab\n8. Choose Table, Line chart, Bar chart, Single value, etc.\n<\/code><\/pre>\n\n\n\n
Dynatrace dashboards support Add > DQL<\/strong>, where the Data<\/strong> tab is used to define the query, Run<\/strong> executes it, and the Visual<\/strong> tab controls the result format. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Option 3: Logs app \u2014 best for log investigation<\/h2>\n\n\n\n
Use this when your main target is logs.<\/p>\n\n\n\n
Typical flow:<\/p>\n\n\n\n
1. Go to Logs\n2. Use filter\/search\n3. Switch to advanced DQL\/edit DQL query mode if available\n4. Run query\n<\/code><\/pre>\n\n\n\n
Dynatrace documentation describes testing DQL matchers from Logs by going to Logs, opening the actions menu next to the filter field, selecting Edit DQL query<\/strong>, entering the DQL query, and running it. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Option 4: Documentation \u201cRun in Playground\u201d<\/h2>\n\n\n\n
Many Dynatrace documentation examples include Run in Playground<\/strong>. That is very useful because it opens a ready-made query in the Playground.<\/p>\n\n\n\n
\n\n\n\n
2. DQL mental model<\/h1>\n\n\n\n
DQL is a read-only<\/strong>, pipeline-based query language. A DQL query contains one or more commands, and each command passes records to the next command using the pipe operator |<\/code>. Dynatrace explains that each command returns tabular output: records are rows, fields are columns, and command order matters for both results and performance. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Think like this:<\/p>\n\n\n\n
Load data \u2192 filter data \u2192 select fields \u2192 transform \u2192 aggregate \u2192 visualize\n<\/code><\/pre>\n\n\n\n
Mermaid view of DQL pipeline<\/h2>\n\n\n\n
flowchart LR\n    A[fetch \/ data \/ timeseries] --> B[filter \/ search]\n    B --> C[fields \/ fieldsAdd \/ fieldsRemove]\n    C --> D[parse \/ fieldsFlatten]\n    D --> E[summarize \/ makeTimeseries]\n    E --> F[sort \/ limit]\n    F --> G[Table \/ Line chart \/ Bar chart \/ Single value]\n<\/code><\/pre>\n\n\n\n
Basic DQL example:<\/p>\n\n\n\n
fetch logs\n| filter loglevel == \"ERROR\"\n| summarize error_count = count()\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
One-row table with error_count.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
3. DQL command categories<\/h1>\n\n\n\n
Dynatrace groups DQL commands into categories such as data source commands, metric commands, filter\/search commands, selection\/modification commands, parsing commands, ordering commands, structuring commands, aggregation commands, correlation\/join commands, and Smartscape commands. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Category<\/th>Important commands<\/th>Purpose<\/th><\/tr><\/thead>
Data source<\/td>fetch<\/code>, data<\/code>, describe<\/code>, fieldsSnapshot<\/code><\/td>Load or inspect data<\/td><\/tr>
Metrics<\/td>timeseries<\/code>, metrics<\/code><\/td>Query metric data<\/td><\/tr>
Filter\/search<\/td>filter<\/code>, filterOut<\/code>, search<\/code>, dedup<\/code><\/td>Reduce records<\/td><\/tr>
Selection<\/td>fields<\/code>, fieldsAdd<\/code>, fieldsRemove<\/code>, fieldsRename<\/code><\/td>Control columns<\/td><\/tr>
Parsing<\/td>parse<\/code><\/td>Extract structured data<\/td><\/tr>
Ordering<\/td>sort<\/code>, limit<\/code><\/td>Order\/restrict output<\/td><\/tr>
Structuring<\/td>fieldsFlatten<\/code>, expand<\/code><\/td>Work with nested records\/arrays<\/td><\/tr>
Aggregation<\/td>summarize<\/code>, makeTimeseries<\/code>, fieldsSummary<\/code><\/td>Group and calculate<\/td><\/tr>
Correlation<\/td>join<\/code>, lookup<\/code>, append<\/code><\/td>Combine datasets<\/td><\/tr>
Smartscape<\/td>smartscapeNodes<\/code>, smartscapeEdges<\/code>, traverse<\/code><\/td>Entity topology<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n
4. First safe command: data<\/code><\/h1>\n\n\n\n
Before using real Dynatrace logs, learn with data<\/code>.<\/p>\n\n\n\n
The data<\/code> command creates sample records during query runtime. It is useful for testing and documentation because it does not depend on whether your Playground has logs\/spans\/events at that exact time. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Run this in Notebooks<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"payment\", status = 200, duration_ms = 300),\n     record(service = \"payment\", status = 503, duration_ms = 1500)\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
A table with four rows:\nservice | status | duration_ms\n<\/code><\/pre>\n\n\n\n
This is your safest learning playground inside the Dynatrace Playground.<\/p>\n\n\n\n
\n\n\n\n
5. Load real data with fetch<\/code><\/h1>\n\n\n\n
The fetch<\/code> command loads data from a Dynatrace\/Grail data object. The simplest example is:<\/p>\n\n\n\n
fetch logs\n<\/code><\/pre>\n\n\n\n
Dynatrace documents fetch logs<\/code> as the simplest form of the fetch<\/code> command, and fetch<\/code> supports parameters such as from<\/code>, to<\/code>, timeframe<\/code>, bucket<\/code>, samplingRatio<\/code>, and scanLimitGBytes<\/code>. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Common data objects<\/h2>\n\n\n\n
Data object<\/th>Query<\/th>Use case<\/th><\/tr><\/thead>
Logs<\/td>fetch logs<\/code><\/td>Application, infrastructure, Kubernetes, process logs<\/td><\/tr>
Events<\/td>fetch events<\/code><\/td>System\/security\/custom events<\/td><\/tr>
Business events<\/td>fetch bizevents<\/code><\/td>Business transactions and custom business data<\/td><\/tr>
Spans<\/td>fetch spans<\/code><\/td>Distributed tracing\/span-level analysis<\/td><\/tr>
Problems<\/td>fetch dt.davis.problems<\/code><\/td>Davis problem analysis<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Run: recent logs<\/h2>\n\n\n\n
fetch logs\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Up to 20 log records.\n<\/code><\/pre>\n\n\n\n
If you see no result, change the Notebook timeframe to a wider window, such as Last 24 hours<\/strong>, or use an explicit timeframe:<\/p>\n\n\n\n
fetch logs, from:-24h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Run: recent spans<\/h2>\n\n\n\n
fetch spans, from:-24h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Up to 20 distributed trace span records.\n<\/code><\/pre>\n\n\n\n
If no result appears, the Playground dataset\/timeframe may not contain spans in that window.<\/p>\n\n\n\n
\n\n\n\n
6. Understand timeframe<\/h1>\n\n\n\n
There are two ways to control time.<\/p>\n\n\n\n
Method 1: UI timeframe<\/h2>\n\n\n\n
Use the time selector in the top-right of Notebook\/Dashboard.<\/p>\n\n\n\n
Good for beginners.<\/p>\n\n\n\n
Method 2: DQL timeframe<\/h2>\n\n\n\n
Use from<\/code>, to<\/code>, or timeframe<\/code>.<\/p>\n\n\n\n
Dynatrace recommends using the UI timeframe controls, but DQL can override them using from<\/code>, to<\/code>, or timeframe<\/code>. If no timeframe is specified in the app\/API, Dynatrace notes a default timeframe behavior; the documentation example also shows relative and absolute timeframes. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Last 2 hours<\/h2>\n\n\n\n
fetch logs, from:now() - 2h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Last 24 hours, excluding last 2 hours<\/h2>\n\n\n\n
fetch logs, from:now() - 24h, to:now() - 2h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Shorter syntax<\/h2>\n\n\n\n
fetch logs, from:-2h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Absolute timeframe<\/h2>\n\n\n\n
fetch logs, timeframe:\"2026-05-28T00:00:00Z\/2026-05-29T00:00:00Z\"\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Records only from the specified time window.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
7. Select fields with fields<\/code><\/h1>\n\n\n\n
Raw records can contain many fields. Use fields<\/code> to keep only the fields you want.<\/p>\n\n\n\n
Dynatrace lists fields<\/code> under selection\/modification commands and describes it as keeping only specified fields. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Run<\/h2>\n\n\n\n
fetch logs, from:-2h\n| fields timestamp, loglevel, log.source, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
A cleaner table with only timestamp, loglevel, log.source, and content.\n<\/code><\/pre>\n\n\n\n
With sample data<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"payment\", status = 503, duration_ms = 1500)\n| fields service, status\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Only service and status columns.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
8. Add calculated fields with fieldsAdd<\/code><\/h1>\n\n\n\n
fieldsAdd<\/code> evaluates an expression and appends or replaces a field. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Run<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"payment\", status = 503, duration_ms = 1500)\n| fieldsAdd is_error = status >= 500\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
New column is_error:\nfalse\ntrue\ntrue\n<\/code><\/pre>\n\n\n\n
Add severity category<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"payment\", status = 503, duration_ms = 1500)\n| fieldsAdd severity = if(status >= 500, \"error\", else:\"ok\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
New severity column:\nok\nerror\nerror\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
9. Sort and limit<\/h1>\n\n\n\n
Use sort<\/code> to order results and limit<\/code> to reduce result size.<\/p>\n\n\n\n
Dynatrace documents sort<\/code> as sorting records and limit<\/code> as limiting the number of returned records. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Sort sample records<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"payment\", status = 503, duration_ms = 1500),\n     record(service = \"catalog\", status = 200, duration_ms = 80)\n| sort duration_ms desc\n| limit 2\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Top 2 slowest records.\n<\/code><\/pre>\n\n\n\n
Logs sorted latest first<\/h2>\n\n\n\n
fetch logs, from:-2h\n| fields timestamp, loglevel, content\n| sort timestamp desc\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
20 latest log records.\n<\/code><\/pre>\n\n\n\n
Performance note: Dynatrace recommends putting sort<\/code> near the end of the query rather than sorting immediately after fetch<\/code>, because sorting early can reduce performance. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
\n\n\n\n
10. Filter data with filter<\/code><\/h1>\n\n\n\n
filter<\/code> keeps only records matching a condition. Dynatrace describes filter<\/code> as reducing the number of records by keeping only records that match the specified condition. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Equality filter<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503)\n| filter service == \"checkout\"\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Only records where service is checkout.\n<\/code><\/pre>\n\n\n\n
Not equal<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503)\n| filter service != \"payment\"\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Everything except payment.\n<\/code><\/pre>\n\n\n\n
Greater than \/ less than<\/h2>\n\n\n\n
data record(service = \"checkout\", duration_ms = 120),\n     record(service = \"payment\", duration_ms = 1500),\n     record(service = \"catalog\", duration_ms = 80)\n| filter duration_ms > 500\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Only slow records above 500 ms.\n<\/code><\/pre>\n\n\n\n
Multiple conditions<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"payment\", status = 503, duration_ms = 1500)\n| filter status >= 500 and duration_ms > 1000\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Only payment 503 with duration 1500.\n<\/code><\/pre>\n\n\n\n
OR condition<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503)\n| filter status == 500 or status == 503\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Only 500 and 503 records.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
11. String filtering: contains<\/code>, startsWith<\/code>, endsWith<\/code><\/h1>\n\n\n\n
DQL functions like contains<\/code>, startsWith<\/code>, and endsWith<\/code> are useful for string filtering. Dynatrace lists string functions including contains<\/code>, endsWith<\/code>, matchesPhrase<\/code>, parse<\/code>, startsWith<\/code>, substring<\/code>, and others. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
contains<\/h2>\n\n\n\n
data record(message = \"Payment failed due to timeout\"),\n     record(message = \"Checkout completed\"),\n     record(message = \"Database connection failed\")\n| filter contains(message, \"failed\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Rows where message contains failed.\n<\/code><\/pre>\n\n\n\n
startsWith<\/h2>\n\n\n\n
data record(path = \"\/api\/orders\"),\n     record(path = \"\/admin\/login\"),\n     record(path = \"\/api\/payments\")\n| filter startsWith(path, \"\/api\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
\/api\/orders\n\/api\/payments\n<\/code><\/pre>\n\n\n\n
endsWith<\/h2>\n\n\n\n
data record(file = \"app.log\"),\n     record(file = \"audit.log\"),\n     record(file = \"error.txt\")\n| filter endsWith(file, \".log\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
app.log\naudit.log\n<\/code><\/pre>\n\n\n\n
Real log example<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\" and contains(content, \"Exception\")\n| fields timestamp, loglevel, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
ERROR logs where content contains Exception.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
12. Search with search<\/code><\/h1>\n\n\n\n
Use search<\/code> when you want a simple search-bar style query.<\/p>\n\n\n\n
Dynatrace says the search<\/code> command works like a search bar in DQL, can search across all fields or specific fields, and performs case-insensitive string matching. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Search all fields<\/h2>\n\n\n\n
fetch logs, from:-2h\n| search \"timeout\"\n| fields timestamp, loglevel, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Logs containing timeout in any searchable field.\n<\/code><\/pre>\n\n\n\n
Search specific field<\/h2>\n\n\n\n
fetch logs, from:-2h\n| search content ~ \"timeout\"\n| fields timestamp, loglevel, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Logs where content matches timeout.\n<\/code><\/pre>\n\n\n\n
Search with wildcard<\/h2>\n\n\n\n
fetch logs, from:-2h\n| search content ~ \"time*\"\n| fields timestamp, loglevel, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Logs where content has token beginning with time.\n<\/code><\/pre>\n\n\n\n
Difference between filter<\/code> and search<\/code><\/h2>\n\n\n\n
Feature<\/th>filter<\/code><\/th>search<\/code><\/th><\/tr><\/thead>
Best for<\/td>Precise conditions<\/td>Text search<\/td><\/tr>
Case behavior<\/td>Depends on operator\/function<\/td>Case-insensitive search behavior<\/td><\/tr>
Example<\/td>filter loglevel == \"ERROR\"<\/code><\/td>search \"error\"<\/code><\/td><\/tr>
Field-specific<\/td>Yes<\/td>Yes, with field ~ \"term\"<\/code><\/td><\/tr>
Good for<\/td>Status, duration, service, entity<\/td>Keyword investigation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Use filter<\/code> when you know the field and exact condition. Use search<\/code> when you are exploring.<\/p>\n\n\n\n
\n\n\n\n
13. Exclude data with filterOut<\/code><\/h1>\n\n\n\n
filterOut<\/code> removes records that match a condition. Dynatrace notes one important difference: filterOut x<\/code> keeps records where x<\/code> is null, while filter not x<\/code> removes records where x<\/code> is null. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Run<\/h2>\n\n\n\n
data record(service = \"checkout\", loglevel = \"INFO\"),\n     record(service = \"checkout\", loglevel = \"ERROR\"),\n     record(service = \"payment\", loglevel = \"WARN\")\n| filterOut loglevel == \"INFO\"\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
ERROR and WARN records only.\n<\/code><\/pre>\n\n\n\n
Real log example<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filterOut loglevel == \"INFO\" or loglevel == \"NONE\"\n| fields timestamp, loglevel, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Logs except INFO\/NONE.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
14. Remove duplicates with dedup<\/code><\/h1>\n\n\n\n
dedup<\/code> removes duplicate records based on one or more fields. Dynatrace explains that dedup<\/code> removes duplicate values, while summarize<\/code> groups records and aggregates them. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Run<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503),\n     record(service = \"payment\", status = 200)\n| dedup service\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
One row per service.\n<\/code><\/pre>\n\n\n\n
Keep latest per service<\/h2>\n\n\n\n
data record(timestamp = 1, service = \"checkout\", status = 200),\n     record(timestamp = 2, service = \"checkout\", status = 500),\n     record(timestamp = 3, service = \"payment\", status = 503),\n     record(timestamp = 4, service = \"payment\", status = 200)\n| dedup service, sort:{timestamp desc}\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Latest record per service.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
15. Understand DQL data types<\/h1>\n\n\n\n
DQL is strongly typed. Functions and operators expect specific declared data types, and types are assigned during parsing or casting. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Important types:<\/p>\n\n\n\n
Type<\/th>Example<\/th>Use<\/th><\/tr><\/thead>
string<\/code><\/td>\"checkout\"<\/code><\/td>Text<\/td><\/tr>
long<\/code><\/td>500<\/code><\/td>Integer<\/td><\/tr>
double<\/code><\/td>99.95<\/code><\/td>Decimal<\/td><\/tr>
boolean<\/code><\/td>true<\/code>, false<\/code><\/td>Conditions<\/td><\/tr>
timestamp<\/code><\/td>now()<\/code><\/td>Point in time<\/td><\/tr>
duration<\/code><\/td>2h<\/code>, 500ms<\/code><\/td>Time duration<\/td><\/tr>
timeframe<\/code><\/td>timeframe(from:..., to:...)<\/code><\/td>Start\/end window<\/td><\/tr>
array<\/code><\/td>array(1,2,3)<\/code><\/td>List<\/td><\/tr>
record<\/code><\/td>record(name=\"app\")<\/code><\/td>Nested object<\/td><\/tr>
ip<\/code><\/td>IP address<\/td>Network fields<\/td><\/tr>
uid<\/code><\/td>Entity\/problem IDs<\/td>Unique identifiers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Dynatrace documents primitive types such as Boolean, Long, Double, Timestamp, Timeframe, Duration, String, IP address, UID, and complex types like Array and Record. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Check type using type()<\/code><\/h2>\n\n\n\n
Dynatrace lists type<\/code> as a conversion\/type function that returns the type of a value as a string. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
data record(service = \"checkout\", status = 500, duration_ms = 900)\n| fields service_type = type(service),\n         status_type = type(status),\n         duration_type = type(duration_ms)\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
service_type  = string\nstatus_type   = long\nduration_type = long\n<\/code><\/pre>\n\n\n\n
Casting examples<\/h2>\n\n\n\n
data record(status_text = \"500\", duration_text = \"120.5\", enabled_text = \"true\")\n| fields status_num = toLong(status_text),\n         duration_num = toDouble(duration_text),\n         enabled_bool = toBoolean(enabled_text)\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
status_num as long\nduration_num as double\nenabled_bool as boolean\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
16. Functions in DQL<\/h1>\n\n\n\n
Functions transform, test, calculate, or format values.<\/p>\n\n\n\n
Dynatrace groups DQL functions into categories such as aggregation, string, conversion\/type, conditional, boolean, time, array, mathematical, join, and general functions. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Important function categories<\/h2>\n\n\n\n
mindmap\n  root((DQL Functions))\n    Aggregation\n      count\n      avg\n      sum\n      min\n      max\n      percentile\n      countIf\n    String\n      contains\n      startsWith\n      endsWith\n      lower\n      concat\n      matchesPhrase\n      parse\n    Type conversion\n      toLong\n      toDouble\n      toString\n      toTimestamp\n      type\n    Conditional\n      if\n      coalesce\n    Boolean\n      isNull\n      isNotNull\n      exists\n    Time\n      now\n      formatTimestamp\n      getHour\n      getDayOfWeek\n    Array\n      arrayAvg\n      arrayMax\n      arraySize\n      arrayFirst\n    Entity\n      entityName\n      entityAttr\n<\/code><\/pre>\n\n\n\n
Conditional function: if<\/code><\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"payment\", status = 503)\n| fieldsAdd result = if(status >= 500, \"failed\", else:\"success\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
checkout \u2192 success\npayment  \u2192 failed\n<\/code><\/pre>\n\n\n\n
Null handling: coalesce<\/code><\/h2>\n\n\n\n
data record(service = \"checkout\", owner = \"team-a\"),\n     record(service = \"payment\")\n| fieldsAdd owner_safe = coalesce(owner, \"unknown\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
checkout \u2192 team-a\npayment  \u2192 unknown\n<\/code><\/pre>\n\n\n\n
Time function<\/h2>\n\n\n\n
data record(service = \"checkout\", timestamp = now())\n| fields timestamp,\n         hour = formatTimestamp(timestamp, format:\"HH\"),\n         day = formatTimestamp(timestamp, format:\"EE\")\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
timestamp plus formatted hour\/day columns.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
17. Aggregation with summarize<\/code><\/h1>\n\n\n\n
summarize<\/code> groups records and calculates values.<\/p>\n\n\n\n
Dynatrace describes summarize<\/code> as grouping records that have the same field values and aggregating them. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Count all records<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503)\n| summarize total = count()\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
total = 3\n<\/code><\/pre>\n\n\n\n
Count by service<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503)\n| summarize total = count(), by:{service}\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
checkout = 2\npayment  = 1\n<\/code><\/pre>\n\n\n\n
Count failures by service<\/h2>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"checkout\", status = 500),\n     record(service = \"payment\", status = 503),\n     record(service = \"payment\", status = 200)\n| summarize failures = countIf(status >= 500), total = count(), by:{service}\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
checkout \u2192 failures 1, total 2\npayment  \u2192 failures 1, total 2\n<\/code><\/pre>\n\n\n\n
Average and percentile<\/h2>\n\n\n\n
data record(service = \"checkout\", duration_ms = 120),\n     record(service = \"checkout\", duration_ms = 900),\n     record(service = \"checkout\", duration_ms = 1500),\n     record(service = \"payment\", duration_ms = 300),\n     record(service = \"payment\", duration_ms = 2000)\n| summarize avg_duration = avg(duration_ms),\n            p95_duration = percentile(duration_ms, 95),\n            max_duration = max(duration_ms),\n            requests = count(),\n  by:{service}\n| sort p95_duration desc\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
One row per service with average, p95, max, and request count.\n<\/code><\/pre>\n\n\n\n
Aggregation functions include avg<\/code>, count<\/code>, countIf<\/code>, max<\/code>, median<\/code>, min<\/code>, percentile<\/code>, sum<\/code>, and several more. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
\n\n\n\n
18. Create time charts with makeTimeseries<\/code><\/h1>\n\n\n\n
Use makeTimeseries<\/code> when you start from raw records such as logs, events, or spans and want to aggregate them over time.<\/p>\n\n\n\n
Dynatrace says DQL provides commands like makeTimeseries<\/code> to aggregate raw event records into chartable time series. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Error logs over time<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\" or loglevel == \"SEVERE\"\n| makeTimeseries errors = count(), by:{loglevel}, interval:5m\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
A time series grouped by loglevel.\n<\/code><\/pre>\n\n\n\n
In Notebooks or Dashboards, choose:<\/p>\n\n\n\n
Visualization \u2192 Line chart\n<\/code><\/pre>\n\n\n\n
Sample data with timestamps<\/h2>\n\n\n\n
data record(timestamp = now() - 20m, service = \"checkout\", status = 500),\n     record(timestamp = now() - 15m, service = \"checkout\", status = 200),\n     record(timestamp = now() - 10m, service = \"payment\", status = 503),\n     record(timestamp = now() - 5m, service = \"payment\", status = 200)\n| filter status >= 500\n| makeTimeseries failures = count(), by:{service}, interval:5m\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Time series of failures by service.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
19. Query metrics with timeseries<\/code><\/h1>\n\n\n\n
Use timeseries<\/code> for metric data.<\/p>\n\n\n\n
Dynatrace describes timeseries<\/code> as a starting DQL command that combines loading, filtering, and aggregating metric data into a time series output. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Average CPU usage<\/h2>\n\n\n\n
timeseries usage = avg(dt.host.cpu.usage)\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Time series showing average CPU usage.\n<\/code><\/pre>\n\n\n\n
Visualization:<\/p>\n\n\n\n
Line chart\n<\/code><\/pre>\n\n\n\n
CPU by host<\/h2>\n\n\n\n
timeseries usage = avg(dt.host.cpu.usage), by:{dt.entity.host}\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
One CPU usage series per host.\n<\/code><\/pre>\n\n\n\n
p99 service response time<\/h2>\n\n\n\n
timeseries p99 = percentile(dt.service.request.response_time, 99),\nby:{dt.entity.service}\n| limit 5\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
p99 response time series for up to 5 services.\n<\/code><\/pre>\n\n\n\n
Dynatrace documents metric aggregation functions for timeseries<\/code>, including sum<\/code>, avg<\/code>, min<\/code>, max<\/code>, count<\/code>, percentile<\/code>, and countDistinct<\/code>. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
\n\n\n\n
20. Explore available metrics with metrics<\/code><\/h1>\n\n\n\n
Use metrics<\/code> to discover metric keys and dimensions.<\/p>\n\n\n\n
Dynatrace explains that metrics<\/code> retrieves metric series for exploring metric keys, dimension keys, and values, but recommends timeseries<\/code> for charting\/calculations because metrics<\/code> does not return timestamps or time-series values. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Run<\/h2>\n\n\n\n
metrics\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Metric metadata rows.\n<\/code><\/pre>\n\n\n\n
Find CPU metrics<\/h2>\n\n\n\n
metrics\n| filter contains(metric.key, \"cpu\")\n| dedup metric.key\n| sort metric.key asc\n| limit 50\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
List of metric keys containing cpu.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
21. Parse logs with parse<\/code><\/h1>\n\n\n\n
Use parse<\/code> when your log content is text\/JSON and you need to extract fields.<\/p>\n\n\n\n
Dynatrace describes parse<\/code> as parsing a record field into one or more fields using a pattern, and notes that it works with Dynatrace Pattern Language. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Parse JSON from sample data<\/h2>\n\n\n\n
data record(content = \"{\\\"service\\\":\\\"checkout\\\",\\\"status\\\":500,\\\"duration_ms\\\":900}\"),\n     record(content = \"{\\\"service\\\":\\\"payment\\\",\\\"status\\\":200,\\\"duration_ms\\\":300}\")\n| parse content, \"JSON:json\"\n| fields json[service], json[status], json[duration_ms]\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Extracted service, status, and duration_ms from JSON.\n<\/code><\/pre>\n\n\n\n
Flatten parsed JSON<\/h2>\n\n\n\n
data record(content = \"{\\\"service\\\":\\\"checkout\\\",\\\"status\\\":500,\\\"duration_ms\\\":900}\"),\n     record(content = \"{\\\"service\\\":\\\"payment\\\",\\\"status\\\":200,\\\"duration_ms\\\":300}\")\n| parse content, \"JSON:json\"\n| fieldsFlatten json\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Fields from JSON become normal table columns.\n<\/code><\/pre>\n\n\n\n
Dynatrace documents fieldsFlatten<\/code> as extracting\/flattening fields from a nested record. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Real log JSON parsing<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filter contains(content, \"{\")\n| parse content, \"JSON:json\"\n| fields timestamp, loglevel, json\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Parsed JSON records, if your logs contain JSON.\n<\/code><\/pre>\n\n\n\n
If parsing fails, the log may not be valid JSON or may have prefix\/suffix text.<\/p>\n\n\n\n
\n\n\n\n
22. Flatten nested records with fieldsFlatten<\/code><\/h1>\n\n\n\n
Use this after parsing JSON or when records contain nested structures.<\/p>\n\n\n\n
data record(payload = record(service = \"checkout\", status = 500, duration_ms = 900)),\n     record(payload = record(service = \"payment\", status = 200, duration_ms = 300))\n| fieldsFlatten payload, prefix:\"app.\"\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
app.service\napp.status\napp.duration_ms\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
23. Work with arrays<\/h1>\n\n\n\n
Arrays appear in timeseries results, JSON arrays, or custom records.<\/p>\n\n\n\n
Dynatrace documents arrays as complex types containing a sequence of values identified by index. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Create and inspect array<\/h2>\n\n\n\n
data record(service = \"checkout\", durations = array(100, 200, 500, 900))\n| fields service,\n         first_value = durations[0],\n         avg_value = arrayAvg(durations),\n         max_value = arrayMax(durations)\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
first_value = 100\navg_value   = 425\nmax_value   = 900\n<\/code><\/pre>\n\n\n\n
Dynatrace lists array functions such as arrayAvg<\/code>, arrayMax<\/code>, arrayMin<\/code>, arrayFirst<\/code>, arrayLast<\/code>, arrayDistinct<\/code>, and others. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
\n\n\n\n
24. Add entity names with entityName<\/code><\/h1>\n\n\n\n
Dynatrace entity IDs are often not human-friendly. Use entityName()<\/code> when available.<\/p>\n\n\n\n
Dynatrace lists entityName<\/code> as a general DQL function that returns the name of an entity. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Host CPU with host name<\/h2>\n\n\n\n
timeseries usage = avg(dt.host.cpu.usage), by:{dt.entity.host}\n| fieldsAdd host_name = entityName(dt.entity.host)\n| fields host_name, usage, timeframe, interval\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
CPU series with readable host_name.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
25. Join and lookup basics<\/h1>\n\n\n\n
Use joins when you need to combine results from two datasets.<\/p>\n\n\n\n
Dynatrace lists join<\/code>, joinNested<\/code>, lookup<\/code>, and append<\/code> as correlation\/join commands. join<\/code> joins records when source and subquery fulfill a join condition, while lookup<\/code> adds fields from a subquery by matching source and lookup fields. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Simple lookup with sample data<\/h2>\n\n\n\n
data record(service = \"checkout\", owner_id = 1, errors = 10),\n     record(service = \"payment\", owner_id = 2, errors = 5)\n| lookup [\n    data record(owner_id = 1, owner = \"Team A\"),\n         record(owner_id = 2, owner = \"Team B\")\n  ],\n  sourceField:owner_id,\n  lookupField:owner_id\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Original records enriched with owner data.\n<\/code><\/pre>\n\n\n\n
Join sample data<\/h2>\n\n\n\n
data record(service = \"checkout\", errors = 10),\n     record(service = \"payment\", errors = 5)\n| join [\n    data record(service = \"checkout\", requests = 1000),\n         record(service = \"payment\", requests = 500)\n  ],\n  on:{service}\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Errors joined with request counts by service.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
26. Visualization views in Dynatrace<\/h1>\n\n\n\n
After running DQL in Notebooks or Dashboards, choose the right visualization.<\/p>\n\n\n\n
Dynatrace lets you choose visualization types for dashboard tiles and notebook sections after adding a query. In Notebooks, the Visualization section displays visualization types; in Dashboards, the Visual tab is available after running the query. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Common views<\/h2>\n\n\n\n
View<\/th>Best for<\/th>Example query<\/th><\/tr><\/thead>
Table<\/td>Raw rows, grouped summary<\/td>`fetch logs<\/td><\/tr>
Line chart<\/td>Time trend<\/td>timeseries avg(dt.host.cpu.usage)<\/code><\/td><\/tr>
Bar chart<\/td>Top N comparison<\/td>summarize count(), by:{service}<\/code><\/td><\/tr>
Pie chart<\/td>Share\/distribution<\/td>Count by status\/loglevel<\/td><\/tr>
Single value<\/td>KPI\/SLO number<\/td>Error count, p95, CPU average<\/td><\/tr>
Markdown\/Text<\/td>Notes\/documentation<\/td>Notebook explanation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Line chart<\/h2>\n\n\n\n
Use a line chart for measurements and trends over time, comparing multiple series, or finding correlations between variables. Dynatrace\u2019s line chart example uses timeseries avg(dt.host.cpu.usage)<\/code>. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
timeseries avg_cpu = avg(dt.host.cpu.usage)\n<\/code><\/pre>\n\n\n\n
Expected visual:<\/p>\n\n\n\n
Line chart of CPU over time.\n<\/code><\/pre>\n\n\n\n
Single value<\/h2>\n\n\n\n
Use single value for one important KPI, business metric, or SLO-type measurement. Dynatrace documents single value visualizations for aggregated measurements, KPIs, and infrastructure-related SLOs. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
timeseries sparkline = avg(dt.host.cpu.usage)\n| fieldsAdd value = arrayAvg(sparkline)\n<\/code><\/pre>\n\n\n\n
Expected visual:<\/p>\n\n\n\n
Single value with optional sparkline.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
27. Discover fields before writing queries<\/h1>\n\n\n\n
A very important beginner skill: first discover what fields exist.<\/p>\n\n\n\n
Use fieldsSnapshot<\/code><\/h2>\n\n\n\n
fieldsSnapshot<\/code> returns a snapshot of fields present in records for supported data objects such as logs<\/code>, spans<\/code>, smartscape.nodes<\/code>, and metrics<\/code>, and Dynatrace notes it does not scan raw data and does not produce consumption. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
fieldsSnapshot logs\n| sort relative_count desc\n| limit 50\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Top fields found in logs.\n<\/code><\/pre>\n\n\n\n
Fields by bucket and type<\/h2>\n\n\n\n
fieldsSnapshot logs, by:{dt.system.bucket, data_type}\n| sort relative_count desc\n| limit 100\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Fields with bucket and data type information.\n<\/code><\/pre>\n\n\n\n
Find sparse fields<\/h2>\n\n\n\n
fieldsSnapshot logs, by:{dt.system.bucket}\n| filter relative_count < 10\n| sort relative_count asc\n| limit 50\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Fields present in fewer than 10% of log records.\n<\/code><\/pre>\n\n\n\n
Use describe<\/code><\/h2>\n\n\n\n
describe<\/code> returns known fields and their data types for a data object. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
describe bizevents\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Known fields and data types for business events.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
28. Beginner practice labs<\/h1>\n\n\n\n
Lab 1: Load logs<\/h2>\n\n\n\n
Where to run:<\/p>\n\n\n\n
Notebooks \u2192 Add \u2192 DQL\n<\/code><\/pre>\n\n\n\n
Query:<\/p>\n\n\n\n
fetch logs, from:-2h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
20 logs or fewer.\n<\/code><\/pre>\n\n\n\n
If no result:<\/p>\n\n\n\n
fetch logs, from:-24h\n| limit 20\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 2: Show important log columns<\/h2>\n\n\n\n
fetch logs, from:-2h\n| fields timestamp, loglevel, log.source, content\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Clean log table.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 3: Error logs only<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\" or loglevel == \"SEVERE\"\n| fields timestamp, loglevel, content\n| sort timestamp desc\n| limit 50\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Latest ERROR\/SEVERE logs.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 4: Search timeout logs<\/h2>\n\n\n\n
fetch logs, from:-24h\n| search content ~ \"timeout\"\n| fields timestamp, loglevel, content\n| sort timestamp desc\n| limit 50\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Logs containing timeout.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 5: Count logs by log level<\/h2>\n\n\n\n
fetch logs, from:-24h\n| summarize logs = count(), by:{loglevel}\n| sort logs desc\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Table: loglevel | logs\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Bar chart or Pie chart\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 6: Errors over time<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter loglevel == \"ERROR\" or loglevel == \"SEVERE\"\n| makeTimeseries errors = count(), by:{loglevel}, interval:15m\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Time series of error count.\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Line chart\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
29. Intermediate practice labs<\/h1>\n\n\n\n
Lab 7: Top sources producing errors<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter loglevel == \"ERROR\" or loglevel == \"SEVERE\"\n| summarize errors = count(), by:{log.source}\n| sort errors desc\n| limit 10\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Top 10 log sources by error count.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 8: Find repeated messages<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter loglevel == \"ERROR\" or loglevel == \"SEVERE\"\n| summarize occurrences = count(), by:{content}\n| sort occurrences desc\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Most repeated error messages.\n<\/code><\/pre>\n\n\n\n
Warning:<\/p>\n\n\n\n
content can be high-cardinality. Use carefully on large datasets.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 9: Parse JSON logs<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter contains(content, \"{\")\n| parse content, \"JSON:json\"\n| fields timestamp, loglevel, json\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Parsed JSON object if log content is JSON.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 10: Flatten JSON logs<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter contains(content, \"{\")\n| parse content, \"JSON:json\"\n| fieldsFlatten json\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
JSON keys become fields.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
30. Metrics practice labs<\/h1>\n\n\n\n
Lab 11: Average CPU usage<\/h2>\n\n\n\n
timeseries cpu = avg(dt.host.cpu.usage), from:-2h\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
CPU usage time series.\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Line chart\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 12: CPU usage by host<\/h2>\n\n\n\n
timeseries cpu = avg(dt.host.cpu.usage), by:{dt.entity.host}, from:-2h\n| fieldsAdd host = entityName(dt.entity.host)\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
CPU series grouped by host.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 13: Top hosts by average CPU<\/h2>\n\n\n\n
timeseries cpu = avg(dt.host.cpu.usage), by:{dt.entity.host}, from:-2h\n| fieldsAdd host = entityName(dt.entity.host)\n| fieldsAdd avg_cpu = arrayAvg(cpu)\n| sort avg_cpu desc\n| limit 10\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Top 10 hosts by average CPU.\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Table or Single value grid\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 14: Service response time p99<\/h2>\n\n\n\n
timeseries p99 = percentile(dt.service.request.response_time, 99),\nby:{dt.entity.service},\nfrom:-2h\n| fieldsAdd service = entityName(dt.entity.service)\n| limit 10\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
p99 response time for services.\n<\/code><\/pre>\n\n\n\n
Note: Dynatrace documents that dt.service.request.response_time<\/code> is reported in microseconds in its percentile examples, so be careful when interpreting units. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
\n\n\n\n
31. Distributed tracing\/spans practice labs<\/h1>\n\n\n\n
Dynatrace\u2019s trace\/DQL tutorial says DQL can help identify inefficient database queries, workload patterns, abnormalities, and performance-analysis signals using traces and logs. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Lab 15: Show recent spans<\/h2>\n\n\n\n
fetch spans, from:-2h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Recent span records.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 16: Inspect span fields<\/h2>\n\n\n\n
fieldsSnapshot spans\n| sort relative_count desc\n| limit 50\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Common fields available in spans.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 17: Slow spans<\/h2>\n\n\n\n
fetch spans, from:-2h\n| filter duration > 1s\n| fields timestamp, duration, span.name, dt.entity.service\n| sort duration desc\n| limit 20\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Slow span operations.\n<\/code><\/pre>\n\n\n\n
If span.name<\/code> is not present in your environment, inspect fields first:<\/p>\n\n\n\n
fieldsSnapshot spans\n| filter contains(field, \"span\")\n| limit 50\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Lab 18: Failed spans<\/h2>\n\n\n\n
fetch spans, from:-2h\n| filter request.is_failed == true\n| summarize failed_spans = count(), by:{dt.entity.service}\n| sort failed_spans desc\n| limit 10\n<\/code><\/pre>\n\n\n\n
Expect:<\/p>\n\n\n\n
Services with failed spans.\n<\/code><\/pre>\n\n\n\n
If request.is_failed<\/code> is unavailable, use fieldsSnapshot spans<\/code> and search for failure\/error fields.<\/p>\n\n\n\n
\n\n\n\n
32. Davis problem analysis<\/h1>\n\n\n\n
Count problems in last 24 hours<\/h2>\n\n\n\n
fetch dt.davis.problems, from:now()-24h, to:now()\n| summarize problemCount = countDistinct(event.id)\n<\/code><\/pre>\n\n\n\n
Dynatrace\u2019s own DQL example for Dynatrace Intelligence uses fetch dt.davis.problems<\/code> and countDistinct(event.id)<\/code> to count distinct problems in the last 24 hours. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Expected result:<\/p>\n\n\n\n
One number: problemCount.\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
33. Advanced: compare current period with past period<\/h1>\n\n\n\n
Dynatrace documents the shift<\/code> parameter for timeseries<\/code>, which lets you compare a metric series with another timeframe, such as the same period 7 days earlier. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
CPU now vs 7 days ago<\/h2>\n\n\n\n
timeseries cpu_now = avg(dt.host.cpu.usage), by:{dt.entity.host}, from:-24h\n| append [\n    timeseries cpu_7d_ago = avg(dt.host.cpu.usage), by:{dt.entity.host}, shift:-7d, from:-24h\n  ]\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Current CPU series plus shifted CPU series from 7 days ago.\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Line chart\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
34. Advanced: calculate failure rate from logs<\/h1>\n\n\n\n
fetch logs, from:-24h\n| fieldsAdd is_error = loglevel == \"ERROR\" or loglevel == \"SEVERE\"\n| summarize total_logs = count(),\n            error_logs = countIf(is_error)\n| fieldsAdd error_rate_percent = toDouble(error_logs) \/ toDouble(total_logs) * 100\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
total_logs\nerror_logs\nerror_rate_percent\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Single value\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
35. Advanced: service health summary from sample data<\/h1>\n\n\n\n
This query is fully runnable because it uses data<\/code>.<\/p>\n\n\n\n
data record(service = \"checkout\", status = 200, duration_ms = 120),\n     record(service = \"checkout\", status = 500, duration_ms = 900),\n     record(service = \"checkout\", status = 503, duration_ms = 1500),\n     record(service = \"payment\", status = 200, duration_ms = 300),\n     record(service = \"payment\", status = 200, duration_ms = 400),\n     record(service = \"catalog\", status = 500, duration_ms = 2000)\n| summarize total_requests = count(),\n            failed_requests = countIf(status >= 500),\n            avg_duration = avg(duration_ms),\n            p95_duration = percentile(duration_ms, 95),\n  by:{service}\n| fieldsAdd failure_rate_percent = toDouble(failed_requests) \/ toDouble(total_requests) * 100\n| sort failure_rate_percent desc\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Health summary per service.\n<\/code><\/pre>\n\n\n\n
This is a very good pattern for real service observability.<\/p>\n\n\n\n
\n\n\n\n
36. Advanced: log message classification<\/h1>\n\n\n\n
fetch logs, from:-24h\n| fieldsAdd category = if(contains(content, \"timeout\"), \"timeout\",\n                    else:if(contains(content, \"connection\"), \"connection\",\n                    else:if(contains(content, \"permission\"), \"permission\",\n                    else:\"other\")))\n| summarize logs = count(), by:{category}\n| sort logs desc\n<\/code><\/pre>\n\n\n\n
Expected result:<\/p>\n\n\n\n
Logs grouped by message category.\n<\/code><\/pre>\n\n\n\n
Best visualization:<\/p>\n\n\n\n
Bar chart or Pie chart\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
37. DQL query structure cheat sheet<\/h1>\n\n\n\n
flowchart TD\n    A[Start Command] --> B{What kind of data?}\n    B -->|Logs\/Events\/Spans| C[fetch logs\/events\/spans]\n    B -->|Metrics| D[timeseries]\n    B -->|Practice data| E[data record...]\n    C --> F[filter\/search\/filterOut]\n    D --> G[by\/filter\/from\/to]\n    E --> F\n    F --> H[fields\/fieldsAdd\/parse]\n    H --> I[summarize\/makeTimeseries]\n    I --> J[sort\/limit]\n    J --> K[Visualization]\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
38. Best practices for writing DQL<\/h1>\n\n\n\n
1. Start small<\/h2>\n\n\n\n
Bad for beginners:<\/p>\n\n\n\n
fetch logs\n<\/code><\/pre>\n\n\n\n
Better:<\/p>\n\n\n\n
fetch logs, from:-30m\n| limit 20\n<\/code><\/pre>\n\n\n\n
2. Filter early<\/h2>\n\n\n\n
Good:<\/p>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\"\n| fields timestamp, loglevel, content\n| limit 50\n<\/code><\/pre>\n\n\n\n
3. Sort late<\/h2>\n\n\n\n
Dynatrace recommends sorting near the end rather than immediately after fetch<\/code>. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Better:<\/p>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\"\n| fields timestamp, loglevel, content\n| sort timestamp desc\n| limit 50\n<\/code><\/pre>\n\n\n\n
4. Use fields<\/code> to reduce noisy output<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\"\n| fields timestamp, loglevel, content\n<\/code><\/pre>\n\n\n\n
5. Do not limit<\/code> before aggregation unless intentional<\/h2>\n\n\n\n
Dynatrace\u2019s best-practice guidance says to use summarize<\/code> for tabular aggregation and makeTimeseries<\/code> for time charts, and not to use limit<\/code> before aggregation unless that is intentional because it can produce wrong aggregates. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
Wrong:<\/p>\n\n\n\n
fetch logs, from:-24h\n| limit 100\n| summarize count(), by:{loglevel}\n<\/code><\/pre>\n\n\n\n
Better:<\/p>\n\n\n\n
fetch logs, from:-24h\n| summarize logs = count(), by:{loglevel}\n| sort logs desc\n<\/code><\/pre>\n\n\n\n
6. Discover fields before assuming names<\/h2>\n\n\n\n
fieldsSnapshot logs\n| limit 100\n<\/code><\/pre>\n\n\n\n
7. Use data<\/code> to learn syntax<\/h2>\n\n\n\n
data record(a = \"DQL\", b = 1)\n<\/code><\/pre>\n\n\n\n
8. Use timeseries<\/code> for metrics, not fetch<\/code><\/h2>\n\n\n\n
For metrics, use:<\/p>\n\n\n\n
timeseries avg(dt.host.cpu.usage)\n<\/code><\/pre>\n\n\n\n
Use metrics<\/code> only to discover metric keys\/dimensions. Dynatrace recommends timeseries<\/code> for actual time-series analysis. (docs.dynatrace.com<\/a>)<\/p>\n\n\n\n
\n\n\n\n
39. Common DQL mistakes and fixes<\/h1>\n\n\n\n
Mistake 1: No data returned<\/h2>\n\n\n\n
Possible causes:<\/p>\n\n\n\n
Wrong timeframe\nWrong field name\nNo matching data in Playground\nNo permission for bucket\/table\nWrong data object\n<\/code><\/pre>\n\n\n\n
Fix:<\/p>\n\n\n\n
fetch logs, from:-24h\n| limit 20\n<\/code><\/pre>\n\n\n\n
Then inspect fields:<\/p>\n\n\n\n
fieldsSnapshot logs\n| limit 100\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Mistake 2: Field does not exist<\/h2>\n\n\n\n
Fix:<\/p>\n\n\n\n
fieldsSnapshot logs\n| filter contains(field, \"service\")\n| limit 50\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Mistake 3: Comparing string and number<\/h2>\n\n\n\n
Wrong:<\/p>\n\n\n\n
data record(status = \"500\")\n| filter status >= 500\n<\/code><\/pre>\n\n\n\n
Better:<\/p>\n\n\n\n
data record(status = \"500\")\n| fieldsAdd status_num = toLong(status)\n| filter status_num >= 500\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Mistake 4: Expecting search<\/code> and filter<\/code> to behave the same<\/h2>\n\n\n\n
Use search<\/code> for text exploration:<\/p>\n\n\n\n
fetch logs\n| search \"timeout\"\n<\/code><\/pre>\n\n\n\n
Use filter<\/code> for exact logic:<\/p>\n\n\n\n
fetch logs\n| filter loglevel == \"ERROR\"\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Mistake 5: Trying to chart non-time data as line chart<\/h2>\n\n\n\n
This is table\/bar-style data:<\/p>\n\n\n\n
fetch logs, from:-24h\n| summarize logs = count(), by:{loglevel}\n<\/code><\/pre>\n\n\n\n
This is line-chart data:<\/p>\n\n\n\n
fetch logs, from:-24h\n| makeTimeseries logs = count(), by:{loglevel}, interval:15m\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
40. Copy-ready command reference<\/h1>\n\n\n\n
Load<\/h2>\n\n\n\n
fetch logs\n<\/code><\/pre>\n\n\n\n
fetch logs, from:-2h\n<\/code><\/pre>\n\n\n\n
fetch events, from:-24h\n<\/code><\/pre>\n\n\n\n
fetch spans, from:-24h\n<\/code><\/pre>\n\n\n\n
fetch bizevents, from:-24h\n<\/code><\/pre>\n\n\n\n
Inspect<\/h2>\n\n\n\n
fieldsSnapshot logs\n<\/code><\/pre>\n\n\n\n
fieldsSnapshot spans\n<\/code><\/pre>\n\n\n\n
describe bizevents\n<\/code><\/pre>\n\n\n\n
Filter<\/h2>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel == \"ERROR\"\n<\/code><\/pre>\n\n\n\n
fetch logs, from:-2h\n| filter loglevel != \"INFO\"\n<\/code><\/pre>\n\n\n\n
fetch logs, from:-2h\n| filter contains(content, \"Exception\")\n<\/code><\/pre>\n\n\n\n
Search<\/h2>\n\n\n\n
fetch logs, from:-2h\n| search \"timeout\"\n<\/code><\/pre>\n\n\n\n
fetch logs, from:-2h\n| search content ~ \"timeout\"\n<\/code><\/pre>\n\n\n\n
Select fields<\/h2>\n\n\n\n
fetch logs, from:-2h\n| fields timestamp, loglevel, content\n<\/code><\/pre>\n\n\n\n
Aggregate<\/h2>\n\n\n\n
fetch logs, from:-24h\n| summarize logs = count(), by:{loglevel}\n<\/code><\/pre>\n\n\n\n
Time chart from logs<\/h2>\n\n\n\n
fetch logs, from:-24h\n| makeTimeseries logs = count(), by:{loglevel}, interval:15m\n<\/code><\/pre>\n\n\n\n
Metrics<\/h2>\n\n\n\n
timeseries cpu = avg(dt.host.cpu.usage)\n<\/code><\/pre>\n\n\n\n
timeseries cpu = avg(dt.host.cpu.usage), by:{dt.entity.host}\n<\/code><\/pre>\n\n\n\n
metrics\n| filter contains(metric.key, \"cpu\")\n| dedup metric.key\n<\/code><\/pre>\n\n\n\n
Parse JSON<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter contains(content, \"{\")\n| parse content, \"JSON:json\"\n| fields timestamp, json\n| limit 20\n<\/code><\/pre>\n\n\n\n
Flatten JSON<\/h2>\n\n\n\n
fetch logs, from:-24h\n| filter contains(content, \"{\")\n| parse content, \"JSON:json\"\n| fieldsFlatten json\n| limit 20\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
41. Recommended learning path<\/h1>\n\n\n\n
Day 1: DQL basics<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
data\nfetch\npipe |\nfields\nlimit\nsort\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
data record(service = \"checkout\", status = 200),\n     record(service = \"payment\", status = 500)\n| fields service, status\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 2: Filtering and searching<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
filter\nfilterOut\nsearch\ncontains\nstartsWith\nendsWith\nand\/or\/not\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
data record(message = \"payment timeout\", status = 500),\n     record(message = \"checkout success\", status = 200)\n| filter status >= 500 and contains(message, \"timeout\")\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 3: Logs<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
fetch logs\nloglevel\ncontent\nlog.source\ntimestamp\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
fetch logs, from:-24h\n| filter loglevel == \"ERROR\"\n| fields timestamp, loglevel, content\n| sort timestamp desc\n| limit 50\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 4: Aggregation<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
summarize\ncount\ncountIf\navg\npercentile\nby:{}\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
fetch logs, from:-24h\n| summarize logs = count(), by:{loglevel}\n| sort logs desc\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 5: Time series<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
makeTimeseries\ntimeseries\ninterval\nby\nline chart\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
fetch logs, from:-24h\n| makeTimeseries logs = count(), by:{loglevel}, interval:15m\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 6: Metrics<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
timeseries\nmetrics\nmetric.key\nentityName\narrayAvg\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
timeseries cpu = avg(dt.host.cpu.usage), by:{dt.entity.host}\n| fieldsAdd host = entityName(dt.entity.host)\n| fieldsAdd avg_cpu = arrayAvg(cpu)\n| sort avg_cpu desc\n| limit 10\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 7: Parsing<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
parse\nJSON\nfieldsFlatten\nrecord\narray\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
data record(content = \"{\\\"service\\\":\\\"checkout\\\",\\\"status\\\":500,\\\"duration_ms\\\":900}\")\n| parse content, \"JSON:json\"\n| fieldsFlatten json\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 8: Spans and distributed tracing<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
fetch spans\nduration\nservice\nfailed requests\nslow operations\n<\/code><\/pre>\n\n\n\n
Run:<\/p>\n\n\n\n
fetch spans, from:-24h\n| filter duration > 1s\n| fields timestamp, duration, dt.entity.service\n| sort duration desc\n| limit 20\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 9: Dashboards<\/h2>\n\n\n\n
Practice:<\/p>\n\n\n\n
Add > DQL\nData tab\nVisual tab\nTable\nLine chart\nSingle value\n<\/code><\/pre>\n\n\n\n
Create these dashboard tiles:<\/p>\n\n\n\n
1. Error count by loglevel\n2. Errors over time\n3. CPU usage by host\n4. Top slow spans\n5. Problem count\n<\/code><\/pre>\n\n\n\n
\n\n\n\n
Day 10: Real troubleshooting notebook<\/h2>\n\n\n\n
Build one notebook with sections:<\/p>\n\n\n\n
1. Recent errors\n2. Top error sources\n3. Error trend\n4. CPU trend\n5. Slow spans\n6. Failed spans\n7. Problem count\n8. Notes\/analysis\n<\/code><\/pre>\n\n\n\n
That is how you start using DQL like a real Dynatrace observability engineer.<\/p>\n","protected":false},"excerpt":{"rendered":"
Dynatrace Query Language, or DQL, is the query language used to explore, filter, aggregate, correlate, and visualize data stored in Dynatrace Grail. Dynatrace describes DQL as a… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1014","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1014"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1014\/revisions"}],"predecessor-version":[{"id":1015,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1014\/revisions\/1015"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}