Query builder

Latest Dynatrace

Use the query builder to quickly assemble DQL queries and add them to your documents.

Explore logs

To explore logs with the query builder

In your document, open the Add menu and select Explore > Logs.

This feature is available for dashboards and notebooks. The layouts differ slightly to suit the different contexts, but the functionality is the same.

In Dashboards, an Explore logs tile is added to the dashboard. The tile is open for editing, with an Options side panel displayed on the right. This is where you build your query.

In Notebooks, an Explore logs section is added to the notebook. The section is open for editing with the default query builder elements selected.

Build a query using the displayed elements of a query definition. By default, the query builder displays the following elements.

Default selection of elements in the query builder

log.source describes the log source you want to query.

Operator	Description
`==`	The log source equals the filter value you enter
`!=`	The log source does not equal the filter value you enter
`contains`	The log source includes the filter value you enter
`not contains`	The log source does not include the filter value you enter

content describes the log content you want to search in.

Operator	Description
`==`	The content equals the filter value you enter
`!=`	The content does not equal the filter value you enter
`contains`	The content includes the filter value you enter
`not contains`	The content does not include the filter value you enter

status describes the log statuses you're interested in. You can select more than one.
The on the end of the query definition opens a menu of additional commands and filters you can add to the query definition.
Select any X in the query definition to remove the element that comes before the X.

In this example, you would remove the content element from your query definition.

If you remove an element and then change your mind, you can use to select it from the menu and add it back to your query definition.

Select Run query to test your query and see results.
When you're satisfied with your query, you can create a standard dashboard tile or notebook section from it. The result of this step is equivalent to using > Query Grail and writing your DQL query without the assistance of the query builder. Then you can edit the DQL directly as needed, and you're free to delete the query builder version if you no longer need it.

In Dashboards, select > Create DQL tile

In Notebooks, select > Duplicate as DQL section

Examples

Create a log query

The query builder is essentially the same in the Dashboards and Notebooks apps. We use Notebooks in this example.

Open the Notebooks app and select Notebook in the app header to create a new notebook.
In the empty notebook, open the menu and select Explore > Logs.

The default settings look like this:
Select Run query and inspect results.

Done. You have created a working log query with just a few clicks.

But with no filters set—no selections for log.source, content, or status—it shows all of your logs. To make your query more useful, you need to filter it.

Filter by log.source

Starting from the previous query, let's add a log.source filter to return only those logs where the log.source field contains a certain string.

To do this, we need to specify

The contains operator
A filter value (a string that needs to occur somewhere in the log.source field)

Under log.source, the default operator is contains, so we don't need to change that.

(If you instead wanted to select a different operator, you would just need to select contains and then select a different operator from the menu, but let's leave it set to contains for this example.)
Under log.source, in the Filter value box next to contains, enter the string you want to search for.

For this example, enter oneagent to get all logs where the log.source field contains oneagent.
Select Run query and inspect results.

Now the results are restricted to logs where the log.source field contains oneagent.

Filter by content

Starting from the previous query, let's add a content filter to focus on logs where the content contains the string crash (and, because we are starting from the previous settings, where the log.source field contains oneagent).

Under content, leave the operator set to contains.
Under content, in the Filter value box next to contains, enter the string you want to search for. In this example, we are looking for logs that contain the string crash somewhere in the content, so enter crash.
Select Run query and inspect results.

Now the results are restricted to logs where the log.source field contains oneagent and the content contains the string crash.

Filter by status

Starting from the previous query, let's add a status filter to focus on logs that contain status strings (and, because we are building on the previous settings, where the log.source field contains oneagent and the content contains the string crash).

Under status, open the Select an option menu.
Select each status you want to search for. These are ORed together: there's a match if at least one of the selected status strings occurs in the log.

Sort query results

To sort your query results

Select and then select sort from the Available commands.
After you select sort, use the Sort by menu to select the field you want to sort by, and to choose whether you want the results in ascending or descending order.

Summarize query results

To summarize your query results

Select and then select summarize from the Available commands.
After you select summarize, specify how you want to summarize the query results.

Limit query results

To limit your query results

Select and then select limit from the Available commands.
After you select limit, enter the maximum number of records you want your query to return.

Create a Grail query

When you're satisfied with your query in the query builder, you can create a standard notebook section from it.

Select > Duplicate as DQL section
Edit the resulting query section as needed.
If you no longer need the query builder version, you can delete it and just use the duplicate section with the DQL query.

The result of this step is equivalent to

Select > Query Grail.
Write a DQL query (without the assistance of the query builder) to do everything you did in the previous examples.

That's what makes the query builder a great tool for beginners and experts.