Explore data
Latest Dynatrace
Explore your logs and metrics with our point-and-click interface.
Get started
To explore logs or metrics
-
In your document, open the Add menu and select Explore > Logs or Explore > Metrics.
This feature is available for dashboards and notebooks. The layouts differ slightly to suit the different contexts, but the functionality is the same.
In Dashboards, an Explore logs or Explore metrics tile is added to the dashboard. The tile is open for editing, with an options side panel displayed on the right.
In Notebooks, an Explore logs or Explore metrics section is added to the notebook. The section is open for editing with the default elements selected.
-
Use the displayed elements to define your exploration.
In this example, we focus on Explore > Logs. By default, the following elements are displayed when selecting.
-
log.source describes the log source.
Operator Description ==
The log source equals the filter value you enter !=
The log source does not equal the filter value you enter contains
The log source includes the filter value you enter not contains
The log source does not include the filter value you enter starts with
The log source starts with the value you enter ends with
The log source starts with the value you enter -
content describes the log content you want to search in.
Operator Description ==
The content equals the filter value you enter !=
The content does not equal the filter value you enter contains
The content includes the filter value you enter not contains
The content does not include the filter value you enter starts with
The content starts with the value you enter ends with
The content starts with the value you enter -
status describes the log statuses you're interested in. You can select more than one.
-
The on the end of the definition opens a menu of additional commands and filters you can add.
-
Select any X in the definition to remove the element that comes before the X.
In this example, you would remove the content element from your definition.
If you remove an element and then change your mind, you can use to select it from the menu and add it back to your definition.
-
-
Select Run to test it and see your results.
-
When you're satisfied with your results, you can create a standard dashboard tile or notebook section from it. The result of this step is equivalent to using > Query Grail and writing a DQL query without this web UI assistance. Then you can edit the DQL directly as needed, and you're free to delete the exploration version if you no longer need it.
- In Dashboards, select > Create DQL tile
- In Notebooks, select > Create DQL section
Explore logs
This exploration functionality is the same in the Dashboards and Notebooks apps. We use Notebooks in this example.
-
Open the Notebooks app and select Notebook in the app header to create a new notebook.
-
In the empty notebook, open the menu and select Explore > Logs.
The default settings look like this:
-
Inspect the results (initially, results are automatically fetched).
Done. You have fetched the first 20 log lines with just a few clicks.
But with no filters set—no selections for content, status, or limit—it shows the first 20 log records (the default for Limit). To make your result more useful, you need to filter it.
Filter by log.source
Starting from the previous example, let's add a log.source filter to return only those logs where the log.source field contains a certain string.
To do this, we need to specify
- The
contains
operator - A filter value (a string that needs to occur somewhere in the log.source field)
-
Select and select log.source from the menu.
-
Under log.source, the default operator is
contains
, so we don't need to change that.(If you instead wanted to select a different operator, you would just need to select
contains
and then select a different operator from the menu, but let's leave it set tocontains
for this example.) -
Under log.source, in the
Filter value
box next tocontains
, enter the string you want to search for.For this example, enter
oneagent
to get all logs where the log.source field containsoneagent
. -
Select Run and inspect the results.
Now the results are restricted to logs where the log.source field contains
oneagent
.
Filter by content
Starting from the previous example, let's add a content filter to focus on logs where the content contains the string crash
(and, because we are starting from the previous settings, where the log.source field contains oneagent
).
-
Under content, leave the operator set to
contains
. -
Under content, in the
Filter value
box next tocontains
, enter the string you want to search for. If you are using Dashboards, you can also reference existing variables by entering a$
sign and selecting the desired variable. In this example, we are looking for logs that contain the stringcrash
somewhere in the content, so entercrash
. -
Select Run and inspect the results.
Now the results are restricted to logs where the log.source field contains
oneagent
and the content contains the stringcrash
.
Filter by status
Starting from the previous example, let's add a status filter to focus on logs that contain status strings (and, because we are building on the previous settings, where the log.source field contains oneagent
and the content contains the string crash
).
- Under status, open the Select an option menu.
Select each status you want to search for. These are ORed together: there's a match if at least one of the selected status strings occurs in the log.
- Select Run and inspect the results.
Sort results
To sort your results
- Select and then select Sort from the Available commands.
- After you select sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
Summarize results
To summarize your results
- Select and then select Summarize from the Available commands.
- After you select summarize, specify how you want to summarize the results.
Limit results
To change the limit of your results, change the value of Limit to the maximum number of records you want to return.
Advance with DQL by creating a Grail query
When you're satisfied with the results but want to advance with more complex DQL commands, you can easily create a standard notebook section based on it.
-
Select > Create DQL section
-
Edit the resulting query section as needed.
-
If you no longer need the UI-constructed version, you can delete it and just use the duplicate section with the DQL query.
The result of this step is equivalent to
- Select > Query Grail.
Write a DQL query (without UI assistance) to do everything you did in the previous examples.
That's what makes this a great tool for beginners and experts.
Explore metrics
This exploration functionality is the same in the Dashboards and Notebooks apps. We use Notebooks in these examples.
-
Open the Notebooks app and select Notebook in the app header to create a new notebook.
-
In the empty notebook, open the menu and select Explore > Metrics.
-
Use the metric selector to select the metric you want to explore.
For example, if you want to explore a metric for Kubernetes workloads, you can search for the string or use the menu to find what you want.
In this example, we searched for
cpu usage
and selected the best match.Additional options are displayed after you select a metric.
-
Select Run to see what we have so far.
Without making any additional settings, we get this line chart of the metric average over time.
Aggregate
To see the same metric by host, we can aggregate on dt.entity.host
and then select Run again.
Now we get a separate line per host. In this case, perhaps too many hosts to be useful.
Compare to previous period
To shift the metric to a previous period and add it for comparison, select and then select Compare to previous period from the Available commands.
This adds a command where you can provide the relative time shift as a numerical value by seconds, minutes, hours, or days.
Default
To replace null values in your timeseries data, select and then select Default from the Available commands.
This adds a command to enter a positive or negative numerical integer value that is used to replace null values.
Rate
To visualize the rate at which a metric is changing, select and then select Rate from the Available commands.
This adds a command to set the rate of the metric to Per Second, Per Minute, Per Hour, or Per Day.
Convert to value
To make your results suitable for certain visualizations such as Single value, Table, or Categorical bar chart, select and then select Convert to value from the Available commands.
This reduces the timeseries data to a single value over the selected timeframe and adds this as a new column called value that can then be used to properly map the results to your visualization.
Limit
To focus our exploration, we can set a limit on the results returned.
-
Select and then select Limit from the Available commands. This adds Limit to our available commands.
-
Set Limit to the maximum number of records we want to return. In this case, we set the limit to 5, and then we ran it again to see the following results.