Davis AI
Davis events represent different types of individual incidents, such as metric-threshold breaches, baseline degradations, or point-in-time events, such as process crashes. Dynatrace also detects and processes informational events such as new software deployments, configuration changes, and other event types.
A Davis problem may be the result of a single event or multiple events, which is often the case in complex environments. To prevent a flood of seemingly unrelated problem alerts for related events in such environments, the Dynatrace AI correlates all events that share the same root cause into a single, trackable problem. This approach prevents event and alert spamming.
Problems have defined lifespans and are updated in real time with all incoming events and findings. Once a problem is detected, it's listed on your problems feed.
Davis events
Every Davis event update is exported to Grail. This includes updates that only refresh the event, which is guaranteed to be at least 1 update every 6 hours.
Events are essential raw data that Davis (the Dynatrace AI engine) considers during automated root-cause analysis to understand the reasons underlying any problems that are detected in your environment. Out of the box, Davis detects more than 80 different built-in system event types, including process crashes, deployment configuration changes, and VM motion events. Using extension points, you can report custom events through OneAgent plugins or via the Dynatrace API.
Davis shows all system events in the context of your data center topology. So you can analyze events in relation to their parent topological components (for example, hosts, processes, or services) and see how they relate to one another.
Query
Davis events can be queried using the following base query.
fetch dt.davis.events
Event
This section contains general event information.
Attribute
Type
Description
Examples
dt.querystring
timeseries avg(dt.host.cpu.idle)dt.source_entitystring
experimental
The ID of the entity considered the source of the event. The string needs to be in the format of any MONITORED_ENTITY type. 1
Tags:
The ID of the entity considered the source of the event. The string needs to be in the format of any MONITORED_ENTITY type. 1
Tags:
entity-idHOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24Fdt.source_entity.typestring
stable
The type of the entity considered the source of the event. The string needs to be in the format of any MONITORED_ENTITY type.
The type of the entity considered the source of the event. The string needs to be in the format of any MONITORED_ENTITY type.
host; process_group_instance; cloud:azure:resource_groupevent.categorystring
stable
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
INFO; AVAILABILITY; ERROR; SLOWDOWN; RESOURCE_CONTENTION; CUSTOM_ALERT; MONITORING_UNAVAILABLEevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %event.endstring
stable
The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000event.group_labelstring
experimental
Group label of an event.
Group label of an event.
Availabilityevent.idstring
stable
Unique identifier string of an event, is stable across multiple refreshes and updates.
Unique identifier string of an event, is stable across multiple refreshes and updates.
5547782627070661074_1647601320000event.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionDAVIS_EVENTevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
CPU saturation; User action duration degradationevent.providerstring
stable
Source of the event, for example the name of the component or system that generated the event.
Tags:
Source of the event, for example the name of the component or system that generated the event.
Tags:
permissionAVAILABILITY; LOG_EVENTS; METRIC_EVENTS; SYNTHETIC; EVENTS_REST_API_INGEST; KUBERNETES_ANOMALY_DETECTION; AGENT_LOCAL_REST_API_INGESTevent.startstring
stable
The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). This is different from the timestamp even for the first record, as event sources require some time to analyze the underlying data, so the time when an event update is created (timestamp) differs from the time when the event started (event.start)
The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). This is different from the timestamp even for the first record, as event sources require some time to analyze the underlying data, so the time when an event update is created (timestamp) differs from the time when the event started (event.start)
16481073970000event.statusstring
stable
Status of an event as being either Active or Closed.
Status of an event as being either Active or Closed.
Activeevent.status_transitionstring
experimental
An enum that shows the transition of the above event state.
An enum that shows the transition of the above event state.
CREATED; UPDATED; REFRESHED; TIMED_OUT; RECOVEREDevent.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionAPPLICATION_SLOWDOWN; AVAILABILITY_EVENTtimestamptimestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
16498225201231231231
Value of this attribute will be based on one of dt.entity.<type> attributes value. That means that both attributes dt.source_entity and corresponding dt.entity.<type> will be set to the same ID.
Davis config fields
This section contains fields that influence the Davis routine.
Attribute
Type
Description
Examples
dt.davis.analysis_time_budgetlong
stable
The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
dt.davis.analysis_trigger_delaylong
stable
The time delay (in seconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules - you can delay the analysis until data from all sources is available. Note that while longer delays means more data is available for root cause analysis, it also delays alerts delivery.
The time delay (in seconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules - you can delay the analysis until data from all sources is available. Note that while longer delays means more data is available for root cause analysis, it also delays alerts delivery.
dt.davis.is_entity_remapping_allowedboolean
stable
This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
dt.davis.is_frequent_issue_detection_allowedboolean
stable
The flag controls whether the Davis® engine should consider suppressing frequent events (true) or bypassing frequent issues check (false).
The flag controls whether the Davis® engine should consider suppressing frequent events (true) or bypassing frequent issues check (false).
dt.davis.is_merging_allowedboolean
stable
This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false).
This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false).
dt.davis.is_problem_suppressedboolean
stable
This flag controls whether the Davis® engine suppresses the problem from showing up in the UI and sending notifications.
This flag controls whether the Davis® engine suppresses the problem from showing up in the UI and sending notifications.
dt.davis.is_rootcause_relevantboolean
stable
This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
dt.davis.preferred_entity_typestring
stable
The preferred entity type for remapping. You can find possible values in Dynatrace UI under Settings > Topology model > Generic types. If the remapping (dt.event.allow_entity_remapping) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
The preferred entity type for remapping. You can find possible values in Dynatrace UI under Settings > Topology model > Generic types. If the remapping (dt.event.allow_entity_remapping) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
my.custom.entity.typedt.davis.timeoutlong
stable
The event timeout period (in minutes). Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period. Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.
The event timeout period (in minutes). Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period. Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.
Davis system fields
This section contains fields that the Davis routine sets.
Attribute
Type
Description
Examples
dt.davis.disable_merging_reasonstring
stable
Short explanation for why an event should not be merged with other events into the same problem. This is usually set when 'dt.davis.is_merging_allowed' is set to true. If merging is disallowed due to a custom configuration, this field contains the value "Set by event reporter". Additionally, there are scenarios where the Davis® engine may automatically disable merging, typically in cases of problem suppression.
Short explanation for why an event should not be merged with other events into the same problem. This is usually set when 'dt.davis.is_merging_allowed' is set to true. If merging is disallowed due to a custom configuration, this field contains the value "Set by event reporter". Additionally, there are scenarios where the Davis® engine may automatically disable merging, typically in cases of problem suppression.
Set by event reporter; Monitored dimensions limit violateddt.davis.entity_remapping_failure_infostring
stable
Provides additional information in case remapping an event onto an entity that was extracted from the event metadata failed.
Provides additional information in case remapping an event onto an entity that was extracted from the event metadata failed.
No entity of type 'myPreferredEntityType' could be extracted from the provided event properties.dt.davis.impact_levelstring
stable
The impact level of the event.
The impact level of the event.
Application; Environment; Infrastructure; Servicesdt.davis.is_frequent_eventboolean
stable
Indicates if the event was found to frequently happen. Can only be true if dt.davis.is_frequent_issue_detection_allowed is not set to false.
Indicates if the event was found to frequently happen. Can only be true if dt.davis.is_frequent_issue_detection_allowed is not set to false.
dt.davis.mute.statusstring
stable
Status describing if the event is muted. It is also set to muted when the event is part of a problem that is manually closed.
Status describing if the event is muted. It is also set to muted when the event is part of a problem that is manually closed.
MUTEDdt.davis.mute.userstring
stable
User id of the user who muted the event.
User id of the user who muted the event.
donald_duck@gmail.comdt.davis.suppress_problem_reasonstring
stable
A short description of the suppression reason.
A short description of the suppression reason.
Due to manual problem close with id P-2307288 by user donaldmaintenance.is_under_maintenanceboolean
stable
Indicates if the event is within a maintenance window.
Indicates if the event is within a maintenance window.
Settings data
This section contains information on the main settings object that contributes to the event.
Attribute
Type
Description
Examples
dt.settings.object_idstring
experimental
The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.
The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.
vu9U3hXa3q0AAAABACFidWlsdGluOnJ1bS51c2VyLWV4cGVyaWVuY2Utc2NvcmUABnRlbmFudAAGdGVuYW50ACRhMzZmYmYwMy00NDY1LTNlNTYtOTZiOS1kOWMzOGQ3MzU1NmO-71TeFdrerQdt.settings.schema_idstring
experimental
The schema ID of a settings schema, as used in the Settings APIs.
The schema ID of a settings schema, as used in the Settings APIs.
builtin:problem.notifications; app:dynatrace.jenkins:connectiondt.settings.scope_idstring
experimental
The ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API.
The ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API.
environment; HOST-EFAB6D2FE7274823Environmental data
This section contains information on entities.
Attribute
Type
Description
Examples
affected_entity_idsstring[]
stable
A list of all entities that are directly affected. Each element in the list represents a unique entity.
A list of all entities that are directly affected. Each element in the list represents a unique entity.
[HOST-1234567890ABCDEF]affected_entity_typesstring[]
stable
A distinct list of entity types corresponding to the entities listed in 'affected_entity_ids'. The order of elements in this list does not necessarily correspond to the order of entity ids.
A distinct list of entity types corresponding to the entities listed in 'affected_entity_ids'. The order of elements in this list does not necessarily correspond to the order of entity ids.
[dt.entity.host, dt.entity.service]entity_tagsstring[]
stable
A list of entity tags that were assigned to the affected entities at the time of event creation.
A list of entity tags that were assigned to the affected entities at the time of event creation.
[departmentA, department:A]related_entity_idsstring[]
experimental
A list of all entities that are related to the affected entities. Each element in the list represents a unique entity.
A list of all entities that are related to the affected entities. Each element in the list represents a unique entity.
[HOST-1234567890ABCDEF]Davis event reports
Davis event reports create, update, refresh, or close events within the Davis system. These reports are uniquely identified and linked through their event.name, event.type, and dt.source_entity. This linkage ensures that identical identifiers contribute to a singular event. A new event is generated in the absence of a matching existing event, while a matching event triggers an update to reflect the latest information.
Davis events are enriched with additional fields, as detailed in the Davis event model documentation.
Event reports can be created through various methods, including direct creation via the REST API. Additionally, features like metric events or log events autonomously generate these reports. These features also offer customization capabilities through event templates.
Event
This section contains general event information that can be set on an event report or an event template.
Attribute
Type
Description
Examples
dt.querystring
timeseries avg(dt.host.cpu.idle)dt.source_entitystring
experimental
The ID of the entity considered the source of the event. The string needs to be in the format of any MONITORED_ENTITY type. 1
Tags:
The ID of the entity considered the source of the event. The string needs to be in the format of any MONITORED_ENTITY type. 1
Tags:
entity-idHOST-E0D8F94D9065F24F; PROCESS_GROUP_INSTANCE-E0D8F94D9065F24Fevent.descriptionstring
stable
Human-readable description of an event.
Human-readable description of an event.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %event.endstring
stable
The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000event.group_labelstring
experimental
Group label of an event.
Group label of an event.
Availabilityevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
CPU saturation; User action duration degradationevent.startstring
stable
The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000event.typestring
stable
The unique type identifier of a given event.
Tags:
The unique type identifier of a given event.
Tags:
permissionCUSTOM_ALERT; AVAILABILITY_EVENT1
Value of this attribute will be based on one of dt.entity.<type> attributes value. That means that both attributes dt.source_entity and corresponding dt.entity.<type> will be set to the same ID.
Davis config fields
This section contains Davis-specific fields that influence the Davis routine on an event report or an event template.
Attribute
Type
Description
Examples
dt.davis.analysis_time_budgetlong
stable
The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
dt.davis.analysis_trigger_delaylong
stable
The time delay (in seconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules - you can delay the analysis until data from all sources is available. Note that while longer delays means more data is available for root cause analysis, it also delays alerts delivery.
The time delay (in seconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules - you can delay the analysis until data from all sources is available. Note that while longer delays means more data is available for root cause analysis, it also delays alerts delivery.
dt.davis.is_entity_remapping_allowedboolean
stable
This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
dt.davis.is_frequent_issue_detection_allowedboolean
stable
The flag controls whether the Davis® engine should consider suppressing frequent events (true) or bypassing frequent issues check (false).
The flag controls whether the Davis® engine should consider suppressing frequent events (true) or bypassing frequent issues check (false).
dt.davis.is_merging_allowedboolean
stable
This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false).
This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false).
dt.davis.is_problem_suppressedboolean
stable
This flag controls whether the Davis® engine suppresses the problem from showing up in the UI and sending notifications.
This flag controls whether the Davis® engine suppresses the problem from showing up in the UI and sending notifications.
dt.davis.is_rootcause_relevantboolean
stable
This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
dt.davis.preferred_entity_typestring
stable
The preferred entity type for remapping. You can find possible values in Dynatrace UI under Settings > Topology model > Generic types. If the remapping (dt.event.allow_entity_remapping) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
The preferred entity type for remapping. You can find possible values in Dynatrace UI under Settings > Topology model > Generic types. If the remapping (dt.event.allow_entity_remapping) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
my.custom.entity.typedt.davis.timeoutlong
stable
The event timeout period (in minutes). Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period. Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.
The event timeout period (in minutes). Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period. Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.
Davis problems
Every Davis problem update is exported to Grail. This includes updates that only refresh the problem, which is guaranteed to be at least 1 update every 6 hours.
Problems in Dynatrace represent anomalies in normal behavior or state. Such anomalies can be, for example, a slow service response or user-login process. Whenever a problem is detected, Dynatrace raises a specific problem event indicating such an anomaly.
Raised problems provide insight into their underlying root causes. To identify the root causes of problems, Dynatrace follows a context-aware approach that detects interdependent events across time, processes, hosts, services, applications, and both vertical and horizontal topological monitoring perspectives. Only through such a context-aware approach is it possible to pinpoint the true root causes of problems. For this reason, newly detected anomalous events in your environment won't necessarily result in the immediate raising of a new problem.
Query
Davis problems can be queried using the following base query.
fetch dt.davis.problems
Event
This section contains general event information.
Attribute
Type
Description
Examples
event.categorystring
stable
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
AVAILABILITY; ERROR; SLOWDOWN; RESOURCE_CONTENTION; CUSTOM_ALERT; MONITORING_UNAVAILABLEevent.endstring
stable
The problem end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
The problem end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000event.idstring
stable
Unique identifier string of a problem, is stable across refreshes and updates.
Unique identifier string of a problem, is stable across refreshes and updates.
5547782627070661074_1647601320000event.kindstring
stable
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
Gives high-level information about what kind of information the event contains, without being specific to the contents of the event. Helps to determine the record type of a raw event.
Tags:
permissionDAVIS_PROBLEMevent.namestring
stable
The human readable display name of an event type.
The human readable display name of an event type.
CPU saturation; Multiple infrastructure problemsevent.startstring
stable
The problem start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). This is different from the timestamp even for the first record, as event sources require some time to analyze the underlying data, so the time when a problem update is created (timestamp) differs from the time when the event started (event.start)
The problem start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). This is different from the timestamp even for the first record, as event sources require some time to analyze the underlying data, so the time when a problem update is created (timestamp) differs from the time when the event started (event.start)
16481073970000event.statusstring
stable
Status of an event as being either Active or Closed.
Status of an event as being either Active or Closed.
ACTIVE; CLOSEDevent.status_transitionstring
experimental
An enum that shows the transition of the above event state.
An enum that shows the transition of the above event state.
CREATED; UPDATED; REFRESHED; RESOLVED; REOPENED; CLOSEDtimestamptimestamp
stable
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
The time (UNIX Epoch time in nanoseconds) when the event originated, typically when it was created by the source. If no original timestamp is available, it will be populated at ingest time. Required for all events. In case of a correlated event (e.g. ITIL events) this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123Davis system fields
This section contains fields that the Davis routine sets.
Attribute
Type
Description
Examples
display_idstring
stable
A pretty, mostly unique id for the problem.
A pretty, mostly unique id for the problem.
P-2307288dt.davis.affected_users_countlong
experimental
The estimated count of users affected by the problem for the application with the highest individual impact.
The estimated count of users affected by the problem for the application with the highest individual impact.
dt.davis.event_idsstring[]
stable
A collection of Davis event ids that belong to the problem.
A collection of Davis event ids that belong to the problem.
[-2127669892157121805_1688396340000]dt.davis.is_duplicateboolean
stable
Indicates if the problem has become a duplicate of another problem. Duplicates can be related by looking for event ids that are part of multiple problems.
Indicates if the problem has become a duplicate of another problem. Duplicates can be related by looking for event ids that are part of multiple problems.
dt.davis.is_frequent_eventboolean
stable
Indicates if the problem was found to frequently happen. Can only be true if dt.davis.is_frequent_issue_detection_allowed is not set to false for any event of the problem.
Indicates if the problem was found to frequently happen. Can only be true if dt.davis.is_frequent_issue_detection_allowed is not set to false for any event of the problem.
dt.davis.last_reopen_timestampboolean
stable
Timestamp in UTC (given in Grail preferred Linux timestamp nano precision format) when the problem has reopened the last time. A reopen can occur when a problem has resolved, but is not yet closed. If Davis causal AI identified a new event that should be part of the problem, the problem reopens. The field is not set if the problem never reopened.
Timestamp in UTC (given in Grail preferred Linux timestamp nano precision format) when the problem has reopened the last time. A reopen can occur when a problem has resolved, but is not yet closed. If Davis causal AI identified a new event that should be part of the problem, the problem reopens. The field is not set if the problem never reopened.
dt.davis.mute.statusstring
stable
Status describing if the problem is muted. It is also set to muted when the problem is manually closed.
Status describing if the problem is muted. It is also set to muted when the problem is manually closed.
MUTEDdt.davis.mute.userstring
stable
User id of the user who muted the event.
User id of the user who muted the event.
donald_duck@gmail.comlabels.alerting_profilestring[]
stable
A list of alerting profiles that match the problem at the current time.
A list of alerting profiles that match the problem at the current time.
[Production, Team DevOps]maintenance.is_under_maintenanceboolean
stable
Indicates if the problem is within a maintenance window.
Indicates if the problem is within a maintenance window.
resolved_problem_durationduration
stable
Final duration of the problem in nanoseconds after it was resolved.
Final duration of the problem in nanoseconds after it was resolved.
Environmental data
This section contains information on entities.
Attribute
Type
Description
Examples
affected_entity_idsstring[]
stable
A list of all entities that are directly affected. Each element in the list represents a unique entity.
A list of all entities that are directly affected. Each element in the list represents a unique entity.
[HOST-1234567890ABCDEF]affected_entity_typesstring[]
stable
A distinct list of entity types corresponding to the entities listed in 'affected_entity_ids'. The order of elements in this list does not necessarily correspond to the order of entity ids.
A distinct list of entity types corresponding to the entities listed in 'affected_entity_ids'. The order of elements in this list does not necessarily correspond to the order of entity ids.
[dt.entity.host, dt.entity.service]entity_tagsstring[]
stable
A combined list of all Davis event entity tags.
A combined list of all Davis event entity tags.
[departmentA, department:A]related_entity_idsstring[]
experimental
A list of all entities that are related to the affected entities. Each element in the list represents a unique entity.
A list of all entities that are related to the affected entities. Each element in the list represents a unique entity.
[HOST-1234567890ABCDEF]root_cause_entity_idstring
stable
The problem root cause entity.
The problem root cause entity.
HOST-1234567890ABCDEFroot_cause_entity_namestring
stable
The name of the problem root cause entity at the time when the problem snapshot was created.
The name of the problem root cause entity at the time when the problem snapshot was created.
Server 1.2.3.4