Explore data
Latest Dynatrace
Explore your logs, metrics, and business events with our point-and-click interface.
Get started
To explore logs, metrics, or business events
-
In your document, open the
Add menu and select Logs, Metrics, or Business Events.
This feature is available for dashboards and notebooks. The layouts differ slightly to suit the different contexts, but the functionality is the same.
In Dashboards, an Explore… tile is added to the dashboard. The tile is open for editing, with an options side panel displayed on the right.
In Notebooks, an Explore… section is added to the notebook. The section is open for editing with the default elements selected.
-
Use the displayed elements to define your exploration.
In this example, we focus on Logs. By default, the following elements are displayed when selecting.
-
log.source describes the log source.
Operator Description ==
The log source equals the filter value you enter !=
The log source does not equal the filter value you enter contains
The log source includes the filter value you enter not contains
The log source does not include the filter value you enter starts with
The log source starts with the value you enter ends with
The log source starts with the value you enter -
content describes the log content you want to search in.
Operator Description ==
The content equals the filter value you enter !=
The content does not equal the filter value you enter contains
The content includes the filter value you enter not contains
The content does not include the filter value you enter starts with
The content starts with the value you enter ends with
The content starts with the value you enter -
status describes the log statuses you're interested in. You can select more than one.
-
The
on the end of the definition opens a menu of additional commands and filters you can add.
-
Select any X in the definition to remove the element that comes before the X.
In this example, you would remove the content element from your definition.
If you remove an element and then change your mind, you can use
to select it from the menu and add it back to your definition.
-
-
Select Run to test it and see your results.
-
When you're satisfied with your results, you can create a standard dashboard tile or notebook section from it. The result of this step is equivalent to using
>
Query Grail and writing a DQL query without this web UI assistance. Then you can edit the DQL directly as needed, and you're free to delete the exploration version if you no longer need it.
- In Dashboards, select
>
Create DQL tile
- In Notebooks, select
>
Create DQL section
- In Dashboards, select
Explore logs
This exploration functionality is the same in the Dashboards and Notebooks apps. We use Notebooks in this example.
-
Open the Notebooks app and select
Notebook in the app header to create a new notebook.
-
In the empty notebook, open the
Add menu and select Logs.
The default settings look like this:
-
Inspect the results (initially, results are automatically fetched).
Done. You have fetched the first 20 log lines with just a few clicks.
But with no filters set—no selections for content, status, or limit—it shows the first 20 log records (the default for Limit). To make your result more useful, you need to filter it.
Filter by log.source
Starting from the previous example, let's add a log.source filter to return only those logs where the log.source field contains a certain string.
To do this, we need to specify
- The
contains
operator - A filter value (a string that needs to occur somewhere in the log.source field)
-
Select
and select log.source from the menu.
-
Under log.source, the default operator is
contains
, so we don't need to change that.(If you instead wanted to select a different operator, you would just need to select
contains
and then select a different operator from the menu, but let's leave it set tocontains
for this example.) -
Under log.source, in the
Filter value
box next tocontains
, enter the string you want to search for.For this example, enter
oneagent
to get all logs where the log.source field containsoneagent
. -
Select Run and inspect the results.
Now the results are restricted to logs where the log.source field contains
oneagent
.
Filter by content
Starting from the previous example, let's add a content filter to focus on logs where the content contains the string crash
(and, because we are starting from the previous settings, where the log.source field contains oneagent
).
-
Under content, leave the operator set to
contains
. -
Under content, in the
Filter value
box next tocontains
, enter the string you want to search for. If you are using Dashboards, you can also reference existing variables by entering a$
sign and selecting the desired variable. In this example, we are looking for logs that contain the stringcrash
somewhere in the content, so entercrash
. -
Select Run and inspect the results.
Now the results are restricted to logs where the log.source field contains
oneagent
and the content contains the stringcrash
.
Filter by status
Starting from the previous example, let's add a status filter to focus on logs that contain status strings (and, because we are building on the previous settings, where the log.source field contains oneagent
and the content contains the string crash
).
- Under status, open the Select an option menu.
- Select each status you want to search for. These are ORed together: there's a match if at least one of the selected status strings occurs in the log.
- Select Run and inspect the results.
Sort results
To sort your results
- Select
and then select Sort from the Available commands.
- After you select sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.
Summarize results
To summarize your results
- Select
and then select Summarize from the Available commands.
- After you select summarize, specify how you want to summarize the results.
Limit results
To change the limit of your results, change the value of Limit to the maximum number of records you want to return.
Explore metrics
This exploration functionality is the same in the Dashboards and Notebooks apps. We use Notebooks in these examples.
-
Open the Notebooks app and select
Notebook in the app header to create a new notebook.
-
In the empty notebook, open the
Add menu and select Metrics.
-
Use the metric selector to select the metric you want to explore.
For example, if you want to explore a metric for Kubernetes workloads, you can search for the string or use the menu to find what you want.
In this example, we searched for
cpu usage
and selected the best match.Additional options are displayed after you select a metric.
-
Select Run to see what we have so far.
Without making any additional settings, we get this line chart of the metric average over time.
Aggregate
To see the same metric by host, we can aggregate on dt.entity.host
and then select Run again.
Now we get a separate line per host. In this case, perhaps too many hosts to be useful.
Compare to previous period
To shift the metric to a previous period and add it for comparison, select and then select Compare to previous period from the Available commands.
This adds a command where you can provide the relative time shift as a numerical value by seconds, minutes, hours, or days.
Default
To replace null values in your timeseries data, select and then select Default from the Available commands.
This adds a command to enter a positive or negative numerical integer value that is used to replace null values.
Rate
To visualize the rate at which a metric is changing, select and then select Rate from the Available commands.
This adds a command to set the rate of the metric to Per Second, Per Minute, Per Hour, or Per Day.
Convert to value
To make your results suitable for certain visualizations such as Single value, Table, or Categorical bar chart, select and then select Convert to value from the Available commands.
This reduces the timeseries data to a single value over the selected timeframe and adds this as a new column called value that can then be used to properly map the results to your visualization.
Limit results
To focus our exploration, we can set a limit on the results returned.
-
Select
and then select Limit from the Available commands. This adds Limit to our available commands.
-
Set Limit to the maximum number of records we want to return. In this case, we set the limit to 5, and then we ran it again to see the following results.
Explore business events
This exploration functionality is the same in the Dashboards and Notebooks apps. We use Notebooks in this example.
-
Open the Notebooks app and select
Notebook in the app header to create a new notebook.
-
In the empty notebook, open the
Add menu and select Business Events.
The default settings look like this:
-
Inspect the results (initially, results are automatically fetched).
Done. You have fetched the first 20 business events with just a few clicks.
But with no filters set—no selections for event.provider, event.type, or limit—it shows the first 20 business events (the default for Limit). To make your result more useful, you need to filter it.
Filter by event.provider
Let's add an event.provider filter to return only those business events where the event.provider field contains a certain string.
To do this, we need to specify
- The
contains
operator - A filter value (a string that needs to occur somewhere in the event.provider field)
-
Under event.provider
- The default operator is
contains
, so we don't need to change that. - In the
Filter value
box next tocontains
, enter the string you want to search for.
- The default operator is
-
Select Run and inspect the results.
Now the results are restricted to logs where the event.provider field contains our filter value.
Filter by event.type
Now let's further refine exploration by specifying an event type.
-
Under event.type
- Leave the operator set to
contains
. - In the
Filter value
box next tocontains
, enter the string you want to search for.
- Leave the operator set to
-
Select Run and inspect the results.
Now the results are restricted to business events where the event.provider and event.type match our filter values.
Limit results
To change the limit of your results, change the value of Limit to the maximum number of records you want to return.
Advance with Grail
Whether you're exploring logs, metrics, or business events, you're automatically creating a DQL query that you can view, copy, and use as the basis of more complex queries.
Show DQL
To see the DQL that you're creating automatically, select DQL.
Create a Grail query
When you're satisfied with the results but want to advance with more complex DQL commands, you can easily create a standard notebook section or dashboard tile based on it.
-
Select
>
Create DQL section or Create DQL tile
-
Edit the resulting query section or tile as needed.
-
If you no longer need the UI-constructed version, you can delete it and just use the duplicate notebook section or dashboard tile with the DQL query.
The result of this step is equivalent to
- Select
>
DQL.
- Write a DQL query (without UI assistance) to do everything you did in the previous examples.
That's what makes this a great tool for beginners and experts.