DQL operators

• Latest Dynatrace
• Reference
• 22-min read
• Updated on Jun 08, 2026

The following table shows a list of all the DQL operators.

The precedence for the operators is as follows (from strongest to weakest):

Arithmetic operators

You can use arithmetic operators with numbers, represented by both the types long or double. In addition, some operators support the types timestamp, timeframe, duration or ip.

ADDITION

SUBTRACTION

MULTIPLICATION

DIVISION

MODULO

ARITHMETIC NEGATION

Comparison operators

Comparison operators (<, <=, >, >=)

Equality operators

Equality comparisons (==, !=) use a tri-state boolean algebra (true, false, null). This means that if any side of the equality comparison is null, the overall result of the comparison is null. There are four DQL functions that cover scenarios where missing or null records need to be retrieved:

For example, the below query that uses basic filtering does not provide records with null or missing values:

fetch logs
| filter log.source != "logsourcename"  // does not provide the records where `log.source` is null or missing

However, using the isTrueOrNull function includes those records with null and missing values:

fetch logs
| filter isTrueOrNull(log.source != "logsourcename") // also provides the records where `log.source` is null or missing

Equality operators (==, !=)

Logical operators

The behavior of logical operators follows the tri-state boolean logic.

Iterative expressions

Iterative expressions allow you to perform element-wise operations on arrays without expanding them into separate records.

The core mechanism behind iterative expressions is the [] operator appended to an array, which can be referenced by a field name or any array expression in general. Writing myArray[] tells DQL to iterate over each element of myArray. You can also access nested fields within arrays of records using the syntax myArray[][fieldName], which iterates over each record in the array and extracts the specified field. Similarly, you can also use nested arrays and iterate along one dimension such as with myArray[][0].

DQL provides iterative functions such as iAny() and iCollectArray(), that consume the per-element results. iIndex() is a companion function available in any iterative expression that returns the 0-based integer index of the current element.

Implicit wrapping

When an iterative expression appears outside of an explicit iterative function, such as iAny() or iCollectArray(), DQL implicitly wraps it in iCollectArray(). This means the per-element results are automatically collected into a new array.

In other words, these two statements are equivalent:

| fieldsAdd a[] * b[]

| fieldsAdd iCollectArray(a[] * b[])

Both evaluate a[i] * b[i] for each index i and collect the results into an array. This implicit wrapping allows you to write concise element-wise expressions directly in DQL without always spelling out iCollectArray(...).

Element-wise evaluation

When arrays are referenced with [], DQL performs element-wise operations. The implicit iCollectArray() wrapping applies in the following example as well:

data record(a = array(1, 2, 3), b = array(10, 20, 30)),
     record(a = array(1, 2, 3), b = array(10, 20)),
     record(a = array(1, 2, 3), b = null)
| fieldsAdd a[] * b[]

Query result:

The iterative expression evaluates to null for records where a and b are not both arrays of equal size.

iAny

Checks an iterative boolean expression. Returns true if the expression evaluated to true for at least one element, false if it was never true (non-boolean values are treated as false), or null if all elements are null.

Example 1: Check for any array element to match a condition

data record(a = array(1, 2, 3)),
     record(a = array(4, 5, 6))
| fieldsAdd iAny(a[] >= 4)

Query result:

Example 2: Evaluate an array of records

data record(a = array(record(b = 1), record(b = 2), record(b = 3))),
     record(a = array(record(b = 4), record(b = 5), record(b = 6)))
| fieldsAdd iAny(a[][b] >= 4)

Query result:

Example 3: Find out if any or all elements do not match a condition

data record(technologies = array("Java", "Python")),
     record(technologies = array("Go", "Rust")),
     record(technologies = array(null, null))
| fieldsAdd no_java      = not iAny(technologies[] == "Java"),
            any_but_java = iAny(not technologies[] == "Java")

Query result:

When all array elements are null, both expressions return null. iAny cannot resolve to true or false without at least one definitive value. Consequently, records with fully null arrays will never pass a filter iAny(...) regardless of where not is placed.

Example 4: Check if all elements of an array are inside another array

This pattern uses double negation: not in(needle[], haystack) is true for each element of needle that is absent from haystack. iAny(...) returns true if at least one element is missing. Negating the whole result with not means the expression is true only when no element is missing — that is, all elements of needle are contained in haystack.

data record(needle = array(1, 2), haystack = array(1, 2, 3)),
     record(needle = array(3, 4), haystack = array(1, 2, 3))
| fieldsAdd not iAny(not in(needle[], haystack))

Query result:

iCollectArray

Collects the results of an iterative expression into a new array. Returns null if the expression can't be evaluated (for example, when referenced arrays differ in length or any referenced array is null).

Example 1: Collect per-element results into a new array

data record(a = array(1, 2, 3), b = array(10, 20, 30))
| fieldsAdd iCollectArray(a[] + b[])

Query result:

Example 2: Process fields from an array of records

data record(services = array(record(name = "auth",    latency = 12),
                             record(name = "gateway", latency = 8),
                             record(name = "cache",   latency = 5)))
| fieldsAdd total_latency = arraySum(iCollectArray(services[][latency]))
| fieldsAdd service_names = iCollectArray(services[][name])

Query result:

For total_latency it is important to place iCollectArray() inside arraySum(...). Otherwise iCollectArray() would be implicitly added enclosing arraySum(). For service_names, explicitly adding iCollectArray(...) is optional.

Example 3: Element-wise operation on two arrays with null fallback

data record(a = array(1, 2, 3), b = array(10, 20, 30)),
     record(a = array(1, 2, 3), b = null)
| fieldsAdd c = if(isNotNull(b), iCollectArray(a[] * b[]), else: a)

Query result:

It is important to add iCollectArray() explicitly within the if(...) function. Otherwise, the whole if() function gets evaluated repeatedly, and the iterative expression evaluates to null when a or b are not arrays or are not the same size.

iIndex

Returns the 0-based integer index of the current element in the enclosing iterative expression. Use it to pair each array element with its position or to compute index-dependent transformations.

Example 1: Pair each element with its index

data record(a = array(2, 3, 7, 7, 1))
| fieldsAdd a_indexed = record(value = a[], index = iIndex())

Query result:

Example 2: Expand an array with its indices

data record(a = array(2, 3, 7, 7, 1))
| fields a = record(value = a[], index = iIndex())
| expand a
| fields index = a[index], value = a[value]

Query result:

Operators for subqueries

in

The in comparison operator evaluates the occurrence of a value returned by the left side's expression within a list of values returned by the right side's DQL subquery.

Syntax

expression in [execution block]

Usage and constraints

Example

This example shows how to use the in keyword for filtering a host metric for the host's attribute:

timeseries avg(dt.host.cpu.usage), filter:dt.entity.host in [fetch dt.entity.host
 | fieldsAdd tags
 | expand tags
 | filter tags == "ServiceNow" | fields id]

Time alignment

The @ operator aligns a timestamp to the provided time unit. It rounds down the timestamp to the beginning of the time unit.

Syntax

[timestamp|duration|calendarDuration] @ unit

Left side

On the left side of the @ operator, you can use a timestamp expression, a duration expression, or a calendar duration.
If you use the @ operator without an expression on the left side, the operator will use the timestamp expression now() and will align the current time to the time unit. For example, @h is the beginning of the current hour, and equivalent to now()@h. Expressions of type duration and calendar durations are considered as an offset to now().
For example, -2M@... is equivalent to (now() - 2M)@....

Right side

The time unit can be any DQL supported duration unit including s (second), m (minute), h (hour), or a calendar duration unit like d (day), w (week), M (month), q (quarter), and y (year).

Duration units (h, m, s, ms, us, and ns) allow to add a factor, for example, @3h.
Leaving the factor out is equivalent to setting it to 1. Note the following constraints when adding such factor:

By default, the week unit w uses the first day of the week as defined by your configured locale. To explicitly specify the first day of the week, you can use the following time units:

For example, @w1 means midnight of Monday of the current week.

Examples

For the following examples, the current time is Wednesday, 04 September 2024, 14:47:05+0200.