DQL operators

• Latest Dynatrace
• Reference
• 22-min read
• Updated on Jul 20, 2025

The following table shows a list of all the DQL operators.

The precedence for the operators is as follows (from strongest to weakest):

Arithmetic operators

You can use arithmetic operators with numbers, represented by both the types long or double. In addition, some operators support the types timestamp, timeframe, duration or ip.

ADDITION

ADDITION	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long	(long)	(double)							(IP)
Double	(double)	(double)							(IP)
String
Boolean
Timestamp						(timestamp)
Duration					(timestamp)	(duration)	(timeframe)
Timeframe						(timeframe)
Binary
IP	(IP)	(IP)							(IP)
UID
Array
Record

SUBTRACTION

SUBTRACTION	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long	(long)	(double)
Double	(double)	(double)
String
Boolean
Timestamp					(duration)	(timestamp)
Duration						(duration)
Timeframe						(timeframe)
Binary
IP	(IP)	(IP)							(IP)
UID
Array
Record

MULTIPLICATION

MULTIPLICATION	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long	(long)	(double)				(duration)
Double	(double)	(double)				(duration, rounded to full nanos)
String
Boolean
Timestamp
Duration	(duration)	(duration, rounded to full nanos)
Timeframe
Binary
IP
UID
Array
Record

DIVISION

Integer division

When you divide a long value by another long value using the / operator, the result is also a long value, and any fractional part is discarded. To get a result with the fractional part (a double value), you need to convert or cast at least one of the operands to double (e.g., by using the toDouble function).

DIVISION	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long	(long)	(double)
Double	(double)	(double)
String
Boolean
Timestamp
Duration	(duration rounded to full nanos)	(duration rounded to full nanos)				(double)
Timeframe
Binary
IP
UID
Array
Record

The data type resulting from the operation is indicated in parentheses in the table above.

MODULO

MODULO	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long	(long)	(double)
Double	(double)	(double)
String
Boolean
Timestamp
Duration						(duration)
Timeframe
Binary
IP
UID
Array
Record

ARITHMETIC NEGATION

NEGATION	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
SELF	(long)	(double)				(duration)

Comparison operators

Comparison operators (<, <=, >, >=)

• ( ) - true or false based on the result of the operator
• ( ) - null

<, <=, >, >=	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long
Double
String
Boolean
Timestamp
Duration
Timeframe
Binary
IP
UID
Array
Record

Equality operators

Equality comparisons (==, !=) use a tri-state boolean algebra (true, false, null). This means that if any side of the equality comparison is null, the overall result of the comparison is null. There are four DQL functions that cover scenarios where missing or null records need to be retrieved:

For example, the below query that uses basic filtering does not provide records with null or missing values:

fetch logs
| filter log.source != "logsourcename"  // does not provide the records where `log.source` is null or missing

However, using the isTrueOrNull function includes those records with null and missing values:

fetch logs
| filter isTrueOrNull(log.source != "logsourcename") // also provides the records where `log.source` is null or missing

Equality operators (==, !=)

• ( ) - false for non-comparable types in case of == operator, true for non-compatible types in case of != operator
• ( ) - true or false based on the result of the operator
• null - if one of the operands is null
• null == null - null

==, !=	Long	Double	String	Boolean	Timestamp	Duration	Timeframe	Binary	IP	UID	Array	Record
Long
Double
String
Boolean
Timestamp
Duration
Timeframe
Binary
IP
UID
Array
Record

Logical operators

The behavior of logical operators follows the tri-state boolean logic.

Iterative expressions

Iterative expressions can be used to evaluate every element of a given array or every i-th element of one or more arrays.

iAny

Checks an iterative boolean expression and returns true, if the expression was true at least once, false if it wasn't. For example:

fetch logs
| fieldsAdd a = array(1, 2, 3)
| filter iAny(a[] > 2)

iCollectArray

Collects the results of an iterative expression into an array. For example:

fetch logs
| fieldsAdd a = array(1, 2, 3), b = array(10, 11, 12)
| fieldsAdd iCollectArray(a[] + b[])

iIndex

Allows to access the index of an iterative expression element. For example, you can add the index of a value in the array and expand the array.

data record(a = array(2, 3, 7, 7, 1))
| fields a = record(value = a[], index = iIndex())
| expand a
| fields value = a[value], index = a[index]

Operators for subqueries

in

The in comparison operator evaluates the occurrence of a value returned by the left side's expression within a list of values returned by the right side's DQL subquery.

Syntax

expression in [execution block]

Usage and constraints

Example

This example shows how to use the in keyword for filtering a host metric for the host's attribute:

timeseries avg(dt.host.cpu.usage), filter:dt.entity.host in [fetch dt.entity.host
 | fieldsAdd tags
 | expand tags
 | filter tags == "ServiceNow" | fields id]

Time alignment

The @ operator aligns a timestamp to the provided time unit. It rounds down the timestamp to the beginning of the time unit.

Syntax

[timestamp|duration|calendarDuration] @ unit

Left side

On the left side of the @ operator, you can use a timestamp expression, a duration expression, or a calendar duration.
If you use the @ operator without an expression on the left side, the operator will use the timestamp expression now() and will align the current time to the time unit. For example, @h is the beginning of the current hour, and equivalent to now()@h. Expressions of type duration and calendar durations are considered as an offset to now().
For example, -2M@... is equivalent to (now() - 2M)@....

Right side

The time unit can be any DQL supported duration unit including s (second), m (minute), h (hour), or a calendar duration unit like d (day), w (week), M (month), q (quarter), and y (year).

Duration units (h, m, s, ms, us, and ns) allow to add a factor, for example, @3h.
Leaving the factor out is equivalent to setting it to 1. Note the following constraints when adding such factor:

By default, the week unit w uses the first day of the week as defined by your configured locale. To explicitly specify the first day of the week, you can use the following time units:

For example, @w1 means midnight of Monday of the current week.

Examples

For the following examples, the current time is Wednesday, 04 September 2024, 14:47:05+0200.

Search

You can use the ~ operator in expressions to match the value of fields against a given search string. The performed comparison is case-insensitive and supports pattern matching using wildcards. The ~ operator returns a boolean value: true in case of a match, and false otherwise.

Syntax

fieldName ~ "string literal"

Left side

You can use the field identifier of a root-level field on the left side of the ~operator. If you want to search in any other expression, create a new field first by using the fieldsAdd command. For example, the expression "hello world" ~ "hello" isn't allowed.

Right side

The string literal to search for. It can be one of the following:

Returns

Search strings without wildcards

The ~ operator searches the value as a string token inside a string. Its behavior depends on the data type of the field on the left side:

Search strings with wildcards

The operator searches the pattern in the tokens of a string. Its behaviour depends on the data type of the field on the left side: