Dynatrace Dashboards and Notebooks offer the following options for exploring your data:
To explore data such as logs, metrics, or business events with our point-and-click interface
In your document, open the Add menu and select one of the following options, depending on what you want to explore.
For this example, select Logs, but there are other options.
Option
Description
Query with AI
Enter a plain-text query to get AI-powered insights from Grail.
Logs
Explore logs via the UI. We use this option in the example that follows.
Metrics
Explore metrics via the UI.
Events
Explore events via the UI.
Problems
Explore problems via the UI.
Traces
Explore traces via the UI.
Business Events
Explore business events via the UI.
Security events
Explore events via the UI.
The layouts differ slightly between Dashboards and Notebooks to suit the different contexts, but the functionality is the same.
Use the displayed elements to define your exploration.
In this example, we focus on Logs. By default, the filter field and a default limit of 20 is added.
Click into the filter field and, for example, select content as a field from the list of suggested fields.
Add an operator and a search string right after.
Operator
Description
=
equals
!=
doesn't equal
<
less than
<=
less than or equal to
>
greater than
>=
greater than or equal to
= *
is any value
!= *
isn't any value
in
matches one or more values in a list of values
not in
doesn’t match any value in a list of values
Note: Combining =
with a wildcard in before *
, after, or both, before your search term will resolve to a starts with, ends with, or contains filter respectively.
The on the bottom of the definition opens a menu of additional commands you can add.
Select any in the definition to remove the element that comes before the
. If you remove an element and then change your mind, you can use to select it from the menu and add it back to your definition.
Select Run to test it and see your results.
When you need to cover more complex use cases, you can create a DQL query from it.
The result of this step is equivalent to opening the menu, selecting DQL, and writing a DQL query without this web UI assistance. Then you can edit the DQL directly as needed, and you're free to delete the exploration version if you no longer need it.
You can create a notebook section or dashboard tile using Davis CoPilot to translate your natural language questions into DQL queries.
To create a dashboard tile using Davis CoPilot
Go to Dashboards and open or create a dashboard you can edit.
Open the Add menu and select Query with AI.
optional At the top of the prompt definition panel, enter a tile title.
In the prompt box, type a prompt. Try average cpu usage percentage by host
or see the examples displayed in the web UI for inspiration.
optional If your prompt doesn't specify a timeframe, you can still specify it for the dashboard in your dashboard header (default is Last 2 hours) or the Custom timeframe settings (for a tile-specific timeframe).
Select Run. Davis CoPilot generates and runs the query for you.
Review the results.
optional Select the Visual tab to change the visualization (refer to the visualization-specific documentation for more information).
To create a notebook section using Davis CoPilot
Go to Notebooks and open or create a notebook you can edit.
Open the Add menu and select Query with AI. A new Davis CoPilot notebook section is created with an empty prompt box.
In the prompt box, type a prompt. Try average cpu usage percentage by host
or see the examples displayed in the web UI for inspiration.
optional If your prompt doesn't specify the timeframe, you can still specify it in your section header. The default is Last 2 hours.
Select Run. Davis CoPilot generates and runs the query for you.
optional If you want to see the generated query before running it, open the menu next to the Run button and select Generate DQL only.
Review the results.
optional Select the Options in the section header to change the visualization (refer to the visualization-specific documentation for more information).
To have Dynatrace automatically select a visualization for your query, turn on Auto select in the upper-right corner of your visualization settings pane.
This exploration functionality is the same in Dashboards and
Notebooks. We use
Notebooks in this example.
Open Notebooks and select Notebook in the app header to create a new document.
In the empty document, open the Add menu and select Logs.
Inspect the results (initially, results are automatically fetched).
Done. You have fetched the first 20 log lines with just a few clicks.
To make it more useful, now click in the box to get filter suggestions.
Filter suggestions are available for any field apart from content.
Starting from the previous example, let's add a log.source filter to return only those logs where the log.source field contains a certain string.
To do this, we need to specify
=
Insert your cursor in the filter field and start typing log.source, or search for it via the search at the top of the suggestions, and select it.
Add =
as an operator by either selecting it from the suggestions from the auto complete or by typing it.
Enter the string you want to search for.
For this example, enter oneagent
to get all logs where the log.source field contains oneagent
.
Add *
a wildcard before and after your filter term such that the results are restricted to logs where the log.source field contains oneagent
instead of only considering exact matches.
Select Run and inspect the results.
Starting from the previous example, let's add a content filter to focus on logs where the content contains the string crash
(and, because we are starting from the previous settings, where the log.source field contains oneagent
).
Insert your cursor in the filter field immediately after the previously added log.source filter and either select content from the suggested fields or type it in.
Add =
as an operator by either selecting it from the suggestions from the auto complete or by typing it.
Enter the string you want to search for.
If you are using Dashboards, you can also reference existing variables by entering a $
sign and selecting the desired variable. In this example, we are looking for logs that contain the string crash
somewhere in the content, so enter crash
.
Add *
a wildcard before and after your filter term such that the results are restricted to logs where the content field contains crash
instead of only considering exact matches.
Select Run and inspect the results.
Now the results are restricted to logs where the log.source field contains oneagent
and the content contains the string crash
. If you want to search for all occurrences where either one or the other filter applies, add an OR
between the two filters.
Starting from the previous example, let's add a status filter to focus on logs that contain status strings (and, because we're building on the previous settings, where the log.source field contains oneagent
and the content contains the string crash
).
status
from the suggested fields or type it in.in
as an operator by either selecting it from the suggestions or by typing it.To summarize your results
Open the Command menu and select Summarize.
Specify how you want to summarize the results.
You can choose between aggregation options and you can select the field by which the results are aggregated.
You can convert log-based events to a time series format appropriate to be visualized with graph visualizations. This is done by counting occurrences of fields specified for each timeslot.
To convert log-based events to a time series format
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
To sort your results
Select Sort.
After you select Sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
value.A
is selected by defaultTo change the limit of your results, change the value of Limit to the maximum number of records you want to return.
If the Limit setting is not displayed, Limit and then set the value.
This exploration functionality is the same in Dashboards and
Notebooks. We use
Notebooks in these examples.
Open Notebooks and select Notebook in the app header to create a new notebook.
In the empty notebook, open the Add menu and select Metrics.
Use the metric selector to select the metric you want to explore.
For example, if you want to explore a metric for Kubernetes workloads, you can search for the string or use the menu to find what you want.
In this example, we searched for cpu usage
and selected the best match.
Additional options are displayed after you select a metric.
Select Run to see what we have so far.
Without making any additional settings, we get this line chart of the metric average over time.
To see additional options for a metric, use the metric-specific menus.
Metric-specific commands:
Global commands:
If you still aren't finished and you want to keep configurations for potential latter adjustments, you can hide or show selected metrics or expressions.
To make a copy of a metric or expression that you have already added, select the menu for that metric or expression and then select Duplicate. Edit the copy as needed.
To remove a metric or expression from your query, select the menu for that metric or expression and then select Delete.
Starting from the previous example, let's add a host.name filter to focus on specific hosts, where the host.name field contains a certain host name.
Select the metric-specific menu and then select Filters.
Insert your cursor in the filter field and either select host.name from the suggested fields or type it in.
Add =
as an operator by either selecting it from the auto-complete suggestions or by typing it in.
Enter a host name you want to filter by or use one of the value suggestions provided.
Select Run and inspect the results.
Note: As an alternative to using auto-enriched fields such as host.name or k8s.pod.name, names and tags are automatically offered as additional filter values for each entity contained in your data. For example, if your data contains the entity dt.entity.host, the two additional fields dt.entity.host.name and dt.entity.host.tags are offered in the field suggestions for you to use as a filter.
If Split by isn't displayed
To see the same metric by host, we can aggregate on (Split by) dt.entity.host
and then select Run again.
Now we get a separate line per host.
To focus our exploration, we can set a limit on the results returned. If you add multiple metrics to your query, the limit applies to all of them.
Select Limit to add a Limit.
Set Limit to the maximum number of records we want to return. In this case, we set the limit to 5, and then we ran it again to see the following results.
To shift the metric to a previous period and add it for comparison
To replace null values in your time series data with a default value
To visualize the rate at which a metric is changing
To make your results suitable for certain visualizations such as Single value, Table, or Categorical bar chart
This reduces the time series data to a single scalar value over the selected timeframe and adds this as a new column called value that can then be used to properly map the results to your visualization.
You might want to rename (add an alias to) a metric to make it more readable.
To add an alias for metric
Select the metric in your query definition. This makes the name of the metric editable.
Type an alias and press Enter.
In this example, we added the metric avg(dt.host.cpu.usage)
to our query, and now we want to give it a simpler alternative name, such as Average host CPU usage
, to display instead of avg(dt.host.cpu.usage)
in your notebook section or dashboard tile.
Expand DQL in your query definition to see how your alias is handled in DQL.
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
The interval defines the time granularity for metrics, determining how data is grouped and aggregated over time. It is expressed as a duration of each time slot (for example, 1h, 5m) for aggregating data points.
If you add multiple metrics to your query, the interval applies to all of them, ensuring consistency in data granularity across all metrics.
For details on how an interval is used in DQL, see timeseries.
Add expressions to apply arithmetic based on your selected metrics.
Add the metrics you want to base your expression on.
For example, to calculate the total capacity of all your disks, we can select:
A
B
.Select the global Source menu and then select Expression.
Define your expression by combining references from
A
, B
, and C
+
, -
, /
, *
, (
, and )
For example, to calculate the total disk capacity, we simply add both metrics together using A+B
Select Run and inspect the results.
This exploration functionality is the same as described for logs.
To start exploring events
Done. You have fetched the first 20 events with just a few clicks.
To make it more useful, now click in the box to get filter suggestions.
Filter suggestions are available for any field apart from content.
To summarize your results
Open the Command menu and select Summarize.
Specify how you want to summarize the results.
You can choose between aggregation options and you can select the field by which the results are aggregated.
You can convert log-based events to a time series format appropriate to be visualized with graph visualizations. This is done by counting occurrences of fields specified for each timeslot.
To convert log-based events to a time series format
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
To sort your results
Select Sort.
After you select Sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
value.A
is selected by defaultTo change the limit of your results, change the value of Limit to the maximum number of records you want to return.
If the Limit setting is not displayed, Limit and then set the value.
A problem
in Dynatrace represents an anomaly from a normal behavior or state, such as a slow service response or user-login process. Whenever a problem is detected, Dynatrace raises a specific problem event indicating such an anomaly. Every Davis problem update is exported to Grail. Use the Problems explorer to query Grail for problems matching your search filters.
Open Dashboards or
Notebooks and select in an empty notebook or the document header of a dashboard.
Select Problems to add a section or tile based on it.
If you run it like that, with Limit set to 20
(the default), you get the first 20 results of fetching problem records from Grail.
In DQL, this is the equivalent of:
fetch dt.davis.problems| limit 20
Inspect the results (if no results are initially displayed, select Run).
Done. You have fetched the first 20 problems with just a few clicks.
To make it more useful, now click in the box to get filter suggestions.
Filter suggestions are available for any field apart from content.
To summarize your results
Open the Command menu and select Summarize.
Specify how you want to summarize the results.
You can choose between aggregation options and you can select the field by which the results are aggregated.
You can convert log-based events to a time series format appropriate to be visualized with graph visualizations. This is done by counting occurrences of fields specified for each timeslot.
To convert log-based events to a time series format
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
To sort your results
Select Sort.
After you select Sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
value.A
is selected by defaultTo change the limit of your results, change the value of Limit to the maximum number of records you want to return.
If the Limit setting is not displayed, Limit and then set the value.
Open Dashboards or
Notebooks and select in an empty notebook or the document header of a dashboard.
Select Traces to add a section or tile based on it.
If you run it like that, with Limit set to 20
(the default), you get the first 20 results of fetching spans from Grail.
In DQL, this is the equivalent of:
fetch spans| limit 20
Inspect the results (if no results are initially displayed, select Run).
Done. You have fetched the first 20 spans with just a few clicks.
To make it more useful, now click in the box to get filter suggestions.
Filter suggestions are available for any field apart from content.
To summarize your results
Open the Command menu and select Summarize.
Specify how you want to summarize the results.
You can choose between aggregation options and you can select the field by which the results are aggregated.
You can convert log-based events to a time series format appropriate to be visualized with graph visualizations. This is done by counting occurrences of fields specified for each timeslot.
To convert log-based events to a time series format
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
To sort your results
Select Sort.
After you select Sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
value.A
is selected by defaultTo change the limit of your results, change the value of Limit to the maximum number of records you want to return.
If the Limit setting is not displayed, Limit and then set the value.
This exploration functionality is the same as described for logs.
To start exploring business events
Done. You have fetched the first 20 business events with just a few clicks.
To make it more useful, now click in the box to get filter suggestions.
Filter suggestions are available for any field apart from content.
Let's add an event.provider filter to return only those business events where the event.provider field contains a certain string.
To do this, we need to specify
=
as an operator by either selecting it from the suggestions or by typing it in.Now the results are restricted to logs where the event.provider field contains our filter value.
Now let's further refine exploration by specifying an event type.
=
as an operator by either selecting it from the suggestions or by typing it in.Now the results are restricted to business events where the event.provider and event.type match our filter values.
To summarize your results
Open the Command menu and select Summarize.
Specify how you want to summarize the results.
You can choose between aggregation options and you can select the field by which the results are aggregated.
You can convert log-based events to a time series format appropriate to be visualized with graph visualizations. This is done by counting occurrences of fields specified for each timeslot.
To convert log-based events to a time series format
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
To sort your results
Select Sort.
After you select Sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
value.A
is selected by defaultTo change the limit of your results, change the value of Limit to the maximum number of records you want to return.
If the Limit setting is not displayed, Limit and then set the value.
This exploration functionality is the same as described for logs.
To start exploring security events
Done. You have fetched the first 20 security events with just a few clicks.
To make it more useful, now click in the box to get filter suggestions.
Filter suggestions are available for any field apart from content.
To summarize your results
Open the Command menu and select Summarize.
Specify how you want to summarize the results.
You can choose between aggregation options and you can select the field by which the results are aggregated.
You can convert log-based events to a time series format appropriate to be visualized with graph visualizations. This is done by counting occurrences of fields specified for each timeslot.
To convert log-based events to a time series format
The bucketize command is used to group metric data into fixed-size ranges (buckets) for histogram visualizations. It defines the bucket size, which directly influences the granularity and scale of the x-axis in the chart.
To sort your results
Select Sort.
After you select Sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
value.A
is selected by defaultTo change the limit of your results, change the value of Limit to the maximum number of records you want to return.
If the Limit setting is not displayed, Limit and then set the value.
When you're exploring data, you're automatically creating a DQL query that you can view, copy, and use as the basis of more complex queries.
To see the DQL that is created automatically during your exploration with the point-and-click interface, select DQL. This shows you the DQL that you can copy and use elsewhere.
When you're satisfied with the results but want to advance with more complex DQL commands, you can easily create a standard notebook section or dashboard tile based on it.
Open the menu and select Create DQL section or Create DQL tile
Edit the resulting query section or tile as needed.
If you no longer need the UI-constructed version, you can delete it and just use the duplicate notebook section or dashboard tile with the DQL query.
The result of this step is equivalent to
That's what makes this a great tool for beginners and experts.