Davis events represent different types of individual incidents, such as metric-threshold breaches, baseline degradations, or point-in-time events, such as process crashes. Dynatrace also detects and processes informational events such as new software deployments, configuration changes, and other event types.
A Davis problem may result from a single event or multiple events, which is often the case in complex environments. To prevent a flood of seemingly unrelated problem alerts for related events in such environments, the Dynatrace AI correlates all events that share the exact root cause into a single, trackable problem. This approach prevents event and alert spamming.
Problems have defined lifespans and are updated in real time with all incoming events and findings. Once a problem is detected, it's listed on your problems feed.
Davis event reports
Davis event reports create, update, refresh, or close events within the Davis system.
These reports are uniquely identified and linked through their event.name, event.type, and dt.source_entity.
This linkage ensures that identical identifiers contribute to a singular event.
A new event is generated in the absence of a matching existing event,
while a matching event triggers an update to reflect the latest information.
Davis events are enriched with additional fields, as detailed in the Davis event model documentation.
Event reports can be created through various methods, including direct creation via the REST API.
Additionally, features like metric events or log events autonomously generate these reports.
These features also offer customization capabilities through event templates.
Davis event report fields
General event information that can be set on an event report or an event template.
Attribute
Type
Description
Examples
dt.analysis.offset
duration
stable A time duration that defines one end of the analysis window relative to event.start. If positive, the analysis window spans from the event.start to event.start plus the offset. If negative, the window spans from event.start minus the offset up to event.start. If missing, no analysis window was required for event creation, or no information about the analysis window is provided.
5m; -5m
dt.query
string
experimental Display name: Dynatrace query A DQL query associated with the event, see Dynatrace Query Language. If the query returns time series data, the time series is charted in the event details in the Problems app.
timeseries avg(dt.host.cpu.idle)
dt.smartscape.__type__
smartscapeId
resourcestable Display name: Smartscape ID A Smartscape ID that can be used to query entities from the Smartscape storage. __type__ is a placeholder for any Smartscape type. Tags: smartscape-id
K8S_CLUSTER-E0D8F94D9065F24F
dt.smartscape_source.id
smartscapeId
resourcestable Display name: Smartscape source ID The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead. Display name: Source entity The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 2 Tags: entity-id
stable Display name: Event description Human-readable description of an event.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %
event.end
string
stable Display name: Event end The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). If not set, event.start plus dt.davis.timeout is used.
16481073970000
event.group_label
string
experimental Display name: Event group label Group label of an event.
Availability
event.name
string
stable Display name: Event name The human readable display name of an event type.
CPU saturation; User action duration degradation
event.severity
long
experimental Display name: Event severity Incident severity on a scale of 1 to 5 (1 = most severe, 5 = least severe), aligned with ITIL severity levels.
1; 2; 3; 4; 5
event.start
string
stable Display name: Event start The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). If not set, the current timestamp is used.
For events created based on a sliding window with enough violating slots, event.start should be the timestamp of the first violating slot.
Depending on the event type, the start time must not lie in the past more than 6 hours for problem-opening events and 30 days for info events.
Depending on the event type, the start time must not lie in the future more than 5 minutes for problem-opening events and 7 days for info events.
Events that can be sent up to 7 days in the future: * CUSTOM_ANNOTATION * CUSTOM_CONFIGURATION * CUSTOM_DEPLOYMENT * CUSTOM_INFO * MARKED_FOR_TERMINATION * WARNING
16481073970000
event.status
string
stable Display name: Event status Controls the event lifecycle: ACTIVE creates or updates the active event; CLOSED closes the active event — if none exists, no event is created.
ACTIVE; CLOSED
event.type
string
stable Display name: Event type The unique type identifier of a given event. Must be one of: * AVAILABILITY_EVENT * PERFORMANCE_EVENT * RESOURCE_CONTENTION_EVENT * ERROR_EVENT * CUSTOM_ALERT * CUSTOM_ANNOTATION * CUSTOM_CONFIGURATION * CUSTOM_DEPLOYMENT * CUSTOM_INFO * MARKED_FOR_TERMINATION * WARNING Tags: permission
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
2
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
Davis event report config fields
Davis-specific fields that influence the Davis routine on an event report or an event template.
Attribute
Type
Description
Examples
dt.analysis.offset
duration
stable A time duration that defines one end of the analysis window relative to event.start. If positive, the analysis window spans from the event.start to event.start plus the offset. If negative, the window spans from event.start minus the offset up to event.start. If missing, no analysis window was required for event creation, or no information about the analysis window is provided.
5m; -5m
dt.davis.analysis_time_budget
long
stable The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
dt.davis.analysis_trigger_delay
long
stable The time delay (in seconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules— you can delay the analysis until data from all sources is available. Note that while longer delays mean more data is available for root cause analysis, they also delay the delivery of alerts.
Attention: When sent as an event report, the value is in seconds. In Grail, the value is represented in milliseconds.
dt.davis.is_entity_remapping_allowed
boolean
stable This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
dt.davis.is_frequent_issue_detection_allowed
boolean
stable The flag controls whether the Davis® engine should detect frequent issues. If the flag is set to true, events identified as frequent won't be triggered or merged into a problem. If the flag is set to false, frequent issues won't be detected and events will be triggered and merged as normal.
dt.davis.is_merging_allowed
boolean
stable This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false). By default, merging is allowed, except for the event type CUSTOM_ALERT, where it is by default not allowed.
dt.davis.is_problem_suppressed
boolean
stable This flag controls whether the Davis® engine suppresses the problem from showing up in the web UI and sending notifications.
dt.davis.is_rootcause_relevant
boolean
stable This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
dt.davis.preferred_entity_type
string
stable The preferred classic entity type for remapping. You can find possible values in the classic Dynatrace web UI under Settings > Topology model > Generic types. If the remapping (dt.davis.is_entity_remapping_allowed) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
my.custom.entity.type
dt.davis.timeout
long
stable The event timeout period (in minutes). If not set, 15 is used. The timeout will automatically be capped to a maximum of 360 minutes (6 hours).
Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period.
Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.
dt.event.correlation_tag
string
stable Set this tag to control which event reports connect together. This value is combined with internal system fields—such as event.name, dt.source_entity, and event.provider—to generate a unique correlation ID for event tracking. The final correlation ID that's used for connecting event reports is stored in dt.event.correlation_id.
custom correlation tags
Davis events
Every Davis event update is exported to Grail.
This includes updates that only refresh the event, which is guaranteed to be at least 1 update every 6 hours.
Events are essential raw data that Davis (the Dynatrace AI engine) considers during automated root-cause analysis to understand the reasons underlying any problems that are detected in your environment. Out of the box, Davis detects more than 80 different built-in system event types, including process crashes, deployment configuration changes, and VM motion events. Using extension points, you can report custom events through OneAgent plugins or via the Dynatrace API.
Davis shows all system events in the context of your data center topology. So you can analyze events in relation to their parent topological components (for example, hosts, processes, or services) and see how they relate to one another.
dt.davis.events
This is a view over the underlying event data. It represents the current/latest state of each Davis event — essentially a deduplicated, up-to-date picture of each event. It is the recommended, less error-prone way to query Davis events.
dt.davis.events.snapshots
This is the raw, immutable, point-in-time state of a Davis event. Every time a Davis event is updated (created, refreshed, closed, etc.), a new snapshot record is written to Grail. This means the table contains multiple records per event — one for each state change over time.
Because of this, when querying dt.davis.events.snapshots, you typically need to:
Deduplicate by event.id (taking the latest timestamp) to get the current state
Filter for event.status == "ACTIVE" if you only want active events
Query
Searches for all Davis events.
fetch dt.davis.events
Searches for all active Davis events and displays their id, name and status.
fetch dt.davis.events
|filter event.status == "ACTIVE"
|fields event.id, event.name, event.status
Counts all active Davis events grouped by event.type, showing the most frequent event types first.
fetch dt.davis.events
|filter event.status == "ACTIVE"
|summarize count = count(), by: { event.type }
|sort count desc
Counts Davis events grouped by event.status, giving a quick breakdown of active versus closed events.
fetch dt.davis.events
|summarize count = count(), by: { event.status }
Lists active Davis events sorted by event.severity (1 = most severe), useful for triaging the highest-impact events first.
Searches all point-in-time snapshots of a specific Davis event by its id, sorted by the most recent timestamp. The result is a chronological history of the event's state changes.
experimental Display name: Dynatrace query A DQL query associated with the event, see Dynatrace Query Langauge.
timeseries avg(dt.host.cpu.idle)
dt.smartscape_source.id
smartscapeId
resourcestable Display name: Smartscape source ID The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id
stable Display name: Smartscape source type The entity type of the entity whose identifier is held in dt.smartscape_source.id. Automatically set by Davis to match the type of the entity referenced in dt.smartscape_source.id.
K8S_CLUSTER; AWS_LAMBDA_FUNCTION
dt.source_entity
string
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.id instead. Display name: Source entity The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 2 Tags: entity-id
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape_source.type instead. Display name: Source entity type The entity type of the entity whose identifier is held in dt.source_entity. The value must be a valid entity type and consistent with dt.source_entity. Note, however, that the type identifiers are expected to be lowercased in alignment with suffixes of dt.entity.* keys.
stable Display name: Event category Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
stable Display name: Event description Human-readable description of an event.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %
event.end
string
stable Display name: Event end The event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.group_label
string
experimental Display name: Event group label Group label of an event.
Availability
event.id
string
stable Display name: Event ID Unique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stable Display name: Event kind Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission
DAVIS_EVENT
event.name
string
stable Display name: Event name The human readable display name of an event type.
CPU saturation; User action duration degradation
event.provider
string
stable Display name: Event provider Source of the event, for example, the name of the component or system that generated the event. Tags: permission
experimental Display name: Event severity Incident severity on a scale of 1 to 5 (1 = most severe, 5 = least severe), aligned with ITIL severity levels.
1; 2; 3; 4; 5
event.start
string
stable Display name: Event start The event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). This is different from the timestamp even for the first record, as event sources require some time to analyze the underlying data, so the time when an event update is created (timestamp) differs from the time when the event started (event.start).
For events created based on a sliding window with enough violating slots, event.start should be the timestamp of the first violating slot.
16481073970000
event.status
string
stable Display name: Event status Status of an event as being either Active or Closed.
Active
event.status_transition
string
experimental Display name: Status transition An enum that shows the transition of the above event state.
CREATED; UPDATED; REFRESHED; TIMED_OUT; RECOVERED
event.type
string
stable Display name: Event type The unique type identifier of a given event. Tags: permission
APPLICATION_SLOWDOWN; AVAILABILITY_EVENT
timestamp
timestamp
stable Display name: Timestamp The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
1
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
2
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
Davis event config fields
Fields that influence the Davis routine.
Attribute
Type
Description
Examples
dt.analysis.offset
duration
stable A time duration that defines one end of the analysis window relative to event.start. If positive, the analysis window spans from the event.start to event.start plus the offset. If negative, the window spans from event.start minus the offset up to event.start. If missing, no analysis window was required for event creation, or no information about the analysis window is provided.
5m; -5m
dt.davis.analysis_time_budget
long
stable The time budget (in seconds) that the Davis® engine is granted before it must raise a problem. The analysis time budget can be set per event and controls the balance of sending out alerts early and granting the AI analysis enough time to finish its analysis. The trade-off of a short analysis budget is that the root cause and event merge analysis is limited or even skipped. For example, the time budget of 0 seconds means that the event raises a problem and sends the alert immediately, without any analysis.
dt.davis.analysis_trigger_delay
long
stable The time delay (in milliseconds) before the trigger of Davis® analysis. For example, the delay of 0 seconds triggers a Davis® problem and the root cause analysis immediately. The trigger delay can be used to hold the analysis until all the relevant root cause data has arrived to Dynatrace. For example, it might be beneficial for cloud integrations or log integrations that report data in different schedules— you can delay the analysis until data from all sources is available. Note that while longer delays mean more data is available for root cause analysis, they also delay the delivery of alerts.
Attention: When sent as an event report, the value is in seconds. In Grail, the value is represented in milliseconds.
dt.davis.is_entity_remapping_allowed
boolean
stable This flag defines whether the remapping of the target entity is enabled (true) or disabled (false). If the remapping is enabled, Dynatrace can map the event to an entity extracted from the event metadata. If the remapping is disabled or the extraction is not possible, Dynatrace maps the event to the entity specified in the event configuration (for example, a specific host) or to the global environment entity.
dt.davis.is_frequent_issue_detection_allowed
boolean
stable The flag controls whether the Davis® engine should detect frequent issues. If the flag is set to true, events identified as frequent won't be triggered or merged into a problem. If the flag is set to false, frequent issues won't be detected and events will be triggered and merged as normal.
dt.davis.is_merging_allowed
boolean
stable This flag controls whether the Davis® engine is allowed to merge this event into a larger problem (true) or if a new problem must be created (false). By default, merging is allowed, except for the event type CUSTOM_ALERT, where it is by default not allowed.
dt.davis.is_problem_suppressed
boolean
stable This flag controls whether the Davis® engine suppresses the problem from showing up in the web UI and sending notifications.
dt.davis.is_rootcause_relevant
boolean
stable This flag controls whether the Davis® engine should include this event within the root cause analysis (true) or if it is not (false) relevant.
dt.davis.preferred_entity_type
string
stable The preferred classic entity type for remapping. You can find possible values in the classic Dynatrace web UI under Settings > Topology model > Generic types. If the remapping (dt.davis.is_entity_remapping_allowed) is enabled, this property defines the entity type to which the event should be mapped. If no entity of the preferred type is extracted, no remapping is applied.
my.custom.entity.type
dt.davis.timeout
long
stable The event timeout period (in minutes). If not set, 15 is used. The timeout will automatically be capped to a maximum of 360 minutes (6 hours).
Various event sources use this event property to keep an event active by regularly refreshing an initial event. The timeout defines how fast the event source must refresh an event to keep it active. To keep the event active, the event source must send the refresh within the timeout period. If no refresh is sent, the event is automatically closed by Dynatrace after the timeout period.
Note that metric sources use their own configurable de-alerting windows to close events. Setting the timeout shorter than the de-alerting window will force events to close and increase the risk of false-positive alerts.
dt.event.correlation_tag
string
stable Set this tag to control which event reports connect together. This value is combined with internal system fields—such as event.name, dt.source_entity, and event.provider—to generate a unique correlation ID for event tracking. The final correlation ID that's used for connecting event reports is stored in dt.event.correlation_id.
custom correlation tags
Davis event system fields
Fields that are Davis-specific and set by the Davis routine.
Attribute
Type
Description
Examples
dt.davis.disable_merging_reason
string
stable Short explanation for why an event should not be merged with other events into the same problem. This is usually set when 'dt.davis.is_merging_allowed' is set to true. If merging is disallowed due to a custom configuration, this field contains the value "Set by event reporter". Additionally, there are scenarios where the Davis® engine may automatically disable merging, typically in cases of problem suppression.
Set by event reporter; Monitored dimensions limit violated
dt.davis.entity_remapping_failure_info
string
stable Provides additional information in case remapping an event onto an entity that was extracted from the event metadata failed.
No entity of type 'myPreferredEntityType' could be extracted from the provided event properties.
stable Indicates if the event was found to frequently happen. Can only be true if dt.davis.is_frequent_issue_detection_allowed is set to true. If events are frequent events, they will not trigger or merge into problems. To disable frequent issue detection, i.e., set the dt.davis.is_frequent_issue_detection_allowed field to false in an event template section of an event-raising config. Frequent issue detection can be disabled globally in the frequent issue detection settings.
dt.davis.mute.status
string
stable Status describing if the event is muted. It is also set to muted when the event is part of a problem that is manually closed.
MUTED
dt.davis.mute.user
string
stable User id of the user who muted the event.
donald_duck@gmail.com
dt.davis.suppress_problem_reason
string
stable A short description of the suppression reason.
Due to manual problem close with id P-2307288 by user donald
dt.event.correlation_id
uid
stable Event reports with the same correlation ID will be grouped together into the same event. There is only one event active at the same time for the same correlation ID. Over time, there might be multiple events with different event.id values but the same dt.event.correlation_id.
b52o3b1a50dbbb31
maintenance.is_under_maintenance
boolean
stable Indicates if the event is within a maintenance window.
Davis settings data
Settings fields for Davis events. Describes the settings object that was the main contributor to the event.
Attribute
Type
Description
Examples
dt.settings.object_id
string
experimental Display name: Settings object ID The object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API.
experimental Display name: Settings scope ID The ID of the scope that a settings object is persisted on. This corresponds to the 'scope' field/parameter in the Settings API.
environment; HOST-EFAB6D2FE7274823
Davis environmental data (classic topology)
References to classic entities.
Attribute
Type
Description
Examples
affected_entity_ids
string[]
deprecatedThis field is deprecated and will be removed in the future. Use smartscape.affected_entities instead. A list of all entities that are directly affected. Each element in the list represents a unique entity.
['HOST-1234567890ABCDEF']
affected_entity_types
string[]
deprecatedThis field is deprecated and will be removed in the future. Use smartscape.affected_entities instead. A distinct list of entity types corresponding to the entities listed in 'affected_entity_ids'. The order of elements in this list does not necessarily correspond to the order of entity IDs.
['dt.entity.host', 'dt.entity.service']
entity_tags
string[]
deprecatedThis field is deprecated and will be removed in the future. Use primary_tags.\* instead. A list of entity tags that were assigned to the affected entities at the time of event creation.
['departmentA', 'department:A']
related_entity_ids
string[]
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.related_entities' instead. A list of all entities that are related to the affected entities. Each element in the list represents a unique entity.
['HOST-1234567890ABCDEF']
Davis environmental data (Smartscape topology)
References to Smartscape entities.
Attribute
Type
Description
Examples
dt.smartscape.__type__
smartscapeId
resourcestable Display name: Smartscape ID A Smartscape ID that can be used to query entities from the Smartscape storage. __type__ is a placeholder for any Smartscape type. Tags: smartscape-id
K8S_CLUSTER-E0D8F94D9065F24F
smartscape.affected_entities
record[]
stable A list of all Smartscape nodes that are directly affected. Each element in the list represents a unique Smartscape node and contains the node's Smartscape ID, type, and name.
stable A list of all Smartscape nodes that are related to the affected Smartscape nodes. Each element in the list represents a unique Smartscape node and contains the node's Smartscape ID, type, and name.
resourcedeprecatedThis field is deprecated and will be removed in the future. Use dt.smartscape.synthetic_location instead. Display name: Synthetic location An entity ID of an entity of type SYNTHETIC_LOCATION. Tags: entity-id
SYNTHETIC_LOCATION-D140F3B85BCCBD1A
dt.smartscape.browser_monitor_step
smartscapeId
resourcestable Display name: Browser monitor step ID Smartscape ID referencing a browser monitor step entity. Tags: smartscape-id
BROWSER_MONITOR_STEP-A140F3B85BCCBD1A
dt.smartscape.http_monitor_step
smartscapeId
resourcestable Display name: HTTP monitor step ID Smartscape ID referencing an HTTP monitor step entity. Tags: smartscape-id
HTTP_MONITOR_STEP-A140F3B85BCCBD1A
dt.smartscape.synthetic_location
smartscapeId
resourcestable Display name: Synthetic location ID Smartscape ID referencing a Synthetic Location entity. Tags: smartscape-id
resourceexperimental Display name: Synthetic monitored entity Smartscape ids The Smartscape IDs of monitored entities.
[['FRONTEND-E0D8F94D9065F24F']]
dt.synthetic.request.targets
array
experimental Display name: Synthetic request targets Request target addresses with DNS record type or TCP port number.
127.0.0.1:22
dt.synthetic.step.id
string[]
resourceexperimental Display name: Synthetic step ID An array of identifiers for the affected monitor steps. The array is ordered by step index, so elements at the same position refer to the same monitor step.
experimental An array of names of the affected monitor steps. The array is ordered by step index, so elements at the same position refer to the same monitor step.
['Step name', 'Second step']
dt.synthetic.step.sequence_number
long[]
experimental An array of sequence numbers of the affected monitor steps.
[1, 2]
dt.synthetic.step.smartscape.id
smartscapeId[]
resourceexperimental An array of Smartscape IDs of the affected monitor steps. The array is ordered by step index, so elements at the same position refer to the same monitor step.
['HTTP_MONITOR_STEP-6349B98E1CD87352']
dt.synthetic.violated_entity_ids
string[]
resourceexperimental Display name: Synthetic violated entity ids IDs of synthetic monitor or steps.
Every Davis problem update is exported to Grail.
This includes updates that only refresh the problem, which is guaranteed to be at least 1 update every 6 hours.
Problems in Dynatrace represent anomalies in normal behavior or state. Such anomalies can be, for example, a slow service response or user-login process. Whenever a problem is detected, Dynatrace raises a specific problem event indicating such an anomaly.
Raised problems provide insight into their underlying root causes. To identify the root causes of problems, Dynatrace follows a context-aware approach that detects interdependent events across time, processes, hosts, services, applications, and both vertical and horizontal topological monitoring perspectives. Only through such a context-aware approach is it possible to pinpoint the true root causes of problems. For this reason, newly detected anomalous events in your environment won't necessarily result in the immediate raising of a new problem.
dt.davis.problems
This is a view over the underlying problem data. It represents the current/latest state of each problem — essentially a deduplicated, up-to-date picture of each problem. It is the recommended, less error-prone way to query Davis problems.
dt.davis.problems.snapshots
dt.davis.problems.snapshots contains immutable point-in-time snapshots of a problem's state. Every time a problem is updated (for example, new affected entities, a change in category, or a change in severity), a new snapshot record is written. This means a single problem will have multiple snapshot records over its lifecycle.
Query
Searches for all davis problems.
fetch dt.davis.problems
Searches for all unique Davis problems and return status, title and the display id.
Shows the logs of all entities affected by the problem 'P-12345678'.
fetch logs
|filter dt.source_entity in [
fetch dt.davis.problems
|filter display_id == "P-12345678"
|fields affected_entity_ids
]
Searches all point-in-time snapshots of a specific problem by its id, sorted by the most recent timestamp. The result is a chronological history of the problem's state changes.
fetch dt.davis.problems.snapshots
|filter event.id == "P-2606232"
|sort timestamp desc
Davis problem event fields
General event information.
Attribute
Type
Description
Examples
dt.analysis.offset
duration
stable A time duration that defines one end of the analysis window relative to event.start. If positive, the analysis window spans from the event.start to event.start plus the offset. If negative, the window spans from event.start minus the offset up to event.start. If missing, no analysis window was required for event creation, or no information about the analysis window is provided.
5m; -5m
event.category
string
stable Display name: Event category Standard categorization based on the significance of an event (similar to the severity level in the previous Dynatrace).
stable Display name: Event description A description of the problem. The problem description contains the different event descriptions from the events of the problem.
The current response time (11 s) exceeds the auto-detected baseline (767 ms) by 1,336 %
event.end
string
stable Display name: Event end The problem end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format).
16481073970000
event.id
string
stable Display name: Event ID Unique identifier string of a problem, is stable across refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stable Display name: Event kind Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission
DAVIS_PROBLEM
event.name
string
stable Display name: Event name The human readable display name of an event type.
CPU saturation; Multiple infrastructure problems
event.severity
long
experimental Display name: Event severity Problem severity is the minimum value (maximum severity) across all events in the problem. For example, if a problem contains events with severities 2, 3, and 4, the problem severity is 2.
1; 2; 3; 4; 5
event.start
string
stable Display name: Event start The problem start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). This is different from the timestamp even for the first record, as event sources require some time to analyze the underlying data, so the time when a problem update is created (timestamp) differs from the time when the event started (event.start).
The problem start time is set to the start time + analysis offset of the earliest event in the problem.
For problems created based on a sliding window with enough violating slots, event.start should be the timestamp of the last violating slot.
16481073970000
event.status
string
stable Display name: Event status Status of an event as being either Active or Closed.
ACTIVE; CLOSED
event.status_transition
string
experimental Display name: Status transition An enum that shows the transition of the above event state.
stable Display name: Timestamp The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Davis problem system fields
Fields that the Davis routine sets.
Attribute
Type
Description
Examples
display_id
string
stable A pretty, mostly unique id for the problem.
P-2307288
dt.analysis.ready
boolean
stable Indicates whether problem analysis has progressed enough for follow‑up actions. When true, initial analysis results are available, and it is a suitable point to trigger actions like notifications, automation, or integrations. This is the exact moment when classic problem notifications start being sent. This property does not mean the problem will remain unchanged. Problem details may still evolve during the analysis's lifecycle. You can adjust the speed of analysis progresses by setting the dt.davis.analysis_trigger_delay event property.
dt.davis.affected_users_count
long
stable The estimated count of users affected by the problem for the application with the highest individual impact.
dt.davis.event_ids
string[]
stable A collection of Davis event ids that belong to the problem.
['-2127669892157121805_1688396340000']
dt.davis.impact_level
string
stable Lists all impact levels observed in the events contributing to the problem. Identifies the affected system layers and helps estimate potential end‑user impact. For example, if a problem contains events with impact levels Application and Services, then both the user-facing application and its underlying services are affected, making real end‑user impact very likely.
stable Indicates if the problem has become a duplicate of another problem. Duplicates can be related by looking for event ids that are part of multiple problems.
dt.davis.last_reopen_timestamp
timestamp
stable Timestamp in UTC (given in Grail preferred Linux timestamp nano precision format) when the problem has reopened the last time. A reopen can occur when a problem has resolved, but is not yet closed. If Davis causal AI identified a new event that should be part of the problem, the problem reopens. The field is not set if the problem never reopened.
dt.davis.mute.status
string
stable Status describing if the problem is muted. It is also set to muted when the problem is manually closed.
MUTED
dt.davis.mute.user
string
stable User id of the user who muted the event.
donald_duck@gmail.com
dt.duration_marker
duration
stable Represents a stepped duration marker indicating how long a problem has been open. The value is one of the fixed thresholds: 5 min, 10 min, 15 min, 30 min, 60 min, 2 h, 4 h, 24 h, or 7 days. This field is only updated while the problem remains open and is calculated based on event.start. Note that if a backdated event is ingested, the marker may skip directly to a higher threshold value.
5 min; 2 h; 7 days
duplicate_problem_ids
string[]
stable IDs of duplicate problems that were merged into this problem.
['P-260401367', 'P-26040212']
labels.alerting_profile
string[]
deprecatedAlerting profiles, previously used to filter problems, have been deprecated. Use DQL to query problem properties directly, and simple workflows to handle notifications instead. To replicate event filtering without joins in DQL, configure problem field settings to propagate relevant event fields to problems. A list of alerting profiles that match the problem at the current time.
['Production', 'Team DevOps']
maintenance.is_under_maintenance
boolean
stable Indicates if the problem is within a maintenance window.
resolved_problem_duration
duration
stable Final duration of the problem in nanoseconds after it was resolved.
Davis problem environmental data (classic topology)
References to classic entities.
Attribute
Type
Description
Examples
affected_entity_ids
string[]
deprecatedThis field is deprecated and will be removed in the future. Use smartscape.affected_entities instead. A list of all entities that are directly affected. Each element in the list represents a unique entity.
['HOST-1234567890ABCDEF']
affected_entity_names
string[]
deprecatedThis field is deprecated and will be removed in the future. Use smartscape.affected_entities instead. A list (in entity ID order) of the names of all entities that are directly affected. Each element in the list represents a unique entity.
['host-worker-097801ab8728e690a']
affected_entity_types
string[]
deprecatedThis field is deprecated and will be removed in the future. Use smartscape.affected_entities instead. A distinct list of entity types corresponding to the entities listed in 'affected_entity_ids'. The order of elements in this list does not necessarily correspond to the order of entity IDs.
['dt.entity.host', 'dt.entity.service']
entity_tags
string[]
deprecatedThis field is deprecated and will be removed in the future. Use primary_tags.\* instead. A combined list of all Davis event entity tags.
['departmentA', 'department:A']
related_entity_ids
string[]
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.related_entities' instead. A list of all entities that are related to the affected entities. Each element in the list represents a unique entity.
['HOST-1234567890ABCDEF']
related_entity_names
string[]
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.related_entities' instead. A list (in entity ID order) of the names of all entities that are related to the affected entities. Each element in the list represents a unique entity.
['host-worker-097801ab8728e690a']
root_cause_entity_id
string
deprecatedThis field is deprecated and will be removed in the future. Use 'root_cause.smartscape_entity' instead. The problem root cause entity.
HOST-1234567890ABCDEF
root_cause_entity_name
string
deprecatedThis field is deprecated and will be removed in the future. Use 'root_cause.smartscape_entity' instead. The name of the problem root cause entity at the time when the problem snapshot was created.
Server 1.2.3.4
Davis problem environmental data (Smartscape topology)
References to Smartscape entities.
Attribute
Type
Description
Examples
root_cause.smartscape_entity
record
stable The Smartscape node identified as the root cause of a problem. Contains the node's Smartscape ID, type, and name.
stable A list of all Smartscape nodes that are directly affected. Each element in the list represents a unique Smartscape node and contains the node's Smartscape ID, type, and name.
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.affected_entities' instead. A distinct list of all Smartscape IDs that are directly affected. Each element in the list represents a unique Smartscape node.
['HOST-1234567890ABCDEF']
smartscape.affected_entity.types
string[]
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.affected_entities' instead. A distinct list of Smartscape types corresponding to the Smartscape IDs listed in 'smartscape.affected_entity.ids'. The order of elements in this list does not necessarily correspond to the order of IDs.
['host', 'service']
smartscape.related_entities
record[]
stable A list of all Smartscape nodes that are related to the affected Smartscape nodes. Each element in the list represents a unique Smartscape node and contains the node's Smartscape ID, type, and name.
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.related_entities' instead. A distinct list of all Smartscape IDs that are related to the affected Smartscape IDs. Each element in the list represents a unique Smartscape node.
['HOST-1234567890ABCDEF']
smartscape.related_entity.types
string[]
deprecatedThis field is deprecated and will be removed in the future. Use 'smartscape.related_entities' instead. A distinct list of Smartscape types corresponding to the Smartscape IDs listed in 'smartscape.related_entity.ids'. The order of elements in this list does not necessarily correspond to the order of IDs.
['host', 'service']
Problem Comments
Commenting on problems works via annotation events.
They are persisted in Grail as point-in-time events (start equals end) of kind DAVIS_EVENT.
Comments support Markdown syntax and can have an optional annotation URL.
To edit existing comments, use the same annotation ID.
To delete comments, use the same annotation ID and omit the event.description.
Query
Search for problem comments for the specific problem 3417369641984270933_1773273960000V2.
fetch dt.davis.events.snapshots, from:"2026-03-12T10:17:53.560Z", to: now()
|filter event.type == "CUSTOM_ANNOTATION" and in(annotation.problem_ids, "3417369641984270933_1773273960000V2")
and isNotNull(annotation.id) and isNotNull(annotation.problem_ids) and isNotNull(annotation.source) and isNotNull(event.name)
stable Display name: Event description The comment text in Markdown format. Up to 10,000 characters. A null value is considered as a deleted comment.
# Comment heading - list item 1 - list item 2
event.kind
string
stable Display name: Event kind This field must be set to DAVIS_EVENT for comments. Tags: permission
DAVIS_EVENT
event.name
string
stable Display name: Event name The link label for the annotation.url.
Process crashed; CPU Saturation
event.start
string
stable Display name: Event start The comment timestamp in UTC (UNIX Epoch time in nanoseconds). If not set, the current timestamp is used.
16481073970000
event.type
string
stable Display name: Event type This field must be set to CUSTOM_ANNOTATION for comments. Tags: permission
CUSTOM_ANNOTATION
Problem comment annotation fields
Specific annotation fields for problem comments.
Attribute
Type
Description
Examples
annotation.id
string
stable The unique ID of the comment (required). Can be any arbitrary string (like a UUID); the format does not matter. Only the latest comment for a given ID will be shown. To edit or delete, use the ID of an existing comment.
42; 4982f1a7-1431-447d-be42-96e92942036a
annotation.problem_ids
string[]
stable The reference to one or more problems (required).
stable The source of the comment (required). Must be set by the event provider.
ServiceNow; My custom integration
annotation.url
string
stable The external URL to a third-party integration (optional), for example, a link to a ticket in your issue tracker. The event.name will be used as the label for the URL.
https://example.com
annotation.user_id
string
stable The UUID of the user writing the comment (optional). Automatically provided by the system. Will be discarded if provided by the source.