System event models

• Latest Dynatrace
• Reference
• Updated on Oct 05, 2026

System events are used to store details about executed queries, auditing events, billing events and more. In order to query system events, you need the storage:system:read permission.

Query

Query system events.

fetch dt.system.events

AI Function Standard Call billing usage

Model describing a billing usage event for AI Function Standard Calls. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for AI Function Standard Calls.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Function Standard Call"
| dedup event.id

Analyze billing usage of AI Function Standard Calls by tool and caller type.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Function Standard Call"
| dedup event.id
| summarize billed_invocations = sum(billed_invocations), by: {tool, caller.type}

Analyze billing usage of AI Function Standard Calls by app and tool.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Function Standard Call"
| dedup event.id
| summarize billed_invocations = sum(billed_invocations), by: {caller.app.id, tool}
| sort billed_invocations desc

AI Function Standard Call billing usage fields

AI Units billing usage

Model describing a billing usage event for AI Units. Billing usage events are stored in the dt.system.events table. Unlike the AI Function Standard Call, this event tracks billable quantity instead of a flat invocation count.

Query

Analyze billing usage events for AI Units.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Units"
| dedup event.id

Analyze billable quantity of AI Units by tool and caller type.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Units"
| dedup event.id
| summarize total_quantity = sum(usage.quantity.billable), by: {tool, caller.type}

Analyze billable quantity of AI Units by app and tool.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AI Units"
| dedup event.id
| summarize total_quantity = sum(usage.quantity.billable), by: {caller.app.id, tool}
| sort total_quantity desc

AI Units billing usage fields

Analyzer execution event

Analyzer execution events track all executions of analyzers.

Query

List all analyzer executions.

fetch dt.system.events
| filter event.kind == "ANALYZER_EXECUTION_EVENT"

List all analyzer executions that failed.

fetch dt.system.events, from:now()-24h
| filter event.kind == "ANALYZER_EXECUTION_EVENT"
| filter dt.analyzer.result_status == "FAILED"

Chart the number of result records for each task and user.

fetch dt.system.events
| filter event.kind == "ANALYZER_EXECUTION_EVENT"
| fieldsRename dt.settings.object_id = dt.task.id
| makeTimeseries result_records = sum(dt.analyzer.result_records), by:{dt.settings.object_id, user.id}

Analyzer execution event fields

Anomaly Detector status event

The Anomaly Detector status events are used for Davis anomaly detection. They track errors and warnings during the execution of an anomaly detector. Examples:

Query

Analyze anomaly detectors status events.

fetch dt.system.events
| filter event.kind == "ANOMALY_DETECTOR_STATUS_EVENT"

Anomaly Detector status event fields

AppEngine Functions - Small billing usage

Model describing a billing usage event of function invocations. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"
| dedup event.id

Analyze billing usage of function invocations by their respective workflow ID.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"
| dedup event.id
| filter isNotNull(workflow.id)
| summarize billed_invocations = sum(billed_invocations), by:{workflow.id}

Analyze billing usage of function invocations by the app and function that caused them.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"
| filterOut isNull(dt.app.id) or isNull(function.id)
| summarize billed_invocations = sum(billed_invocations), by:{dt.app.id, function.id}
| sort billed_invocations desc

AppEngine Functions - Small billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

function.type MUST be one of the following:

Audit event

For every API access, Dynatrace stores an audit event in the dt.system.events table. Additionally, the Audit Event allows to attach an arbitrary key/value map with string keys and string values to the event. Keys are prefixed with "details." during serialization.

Query

Analyze audit events stored in the system event bucket.

fetch dt.system.events
| filter event.kind == "AUDIT_EVENT"

Audit event fields

Automation Workflow billing usage

Model describing a billing usage event of automation workflows. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for AutomationEngine workflows.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Automation Workflow"

Automation Workflow billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

AutomationEngine action execution event

Model describing an AutomationEngine action execution event. Action execution events are stored in the dt.system.events table.

Query

AutomationEngine action execution state change.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="ACTION_EXECUTION"

AutomationEngine action execution event fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.automation_engine.state MUST be one of the following:

AutomationEngine task execution event

Model describing an AutomationEngine task execution event. Task execution events are stored in the dt.system.events table.

Query

AutomationEngine task execution state change.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="TASK_EXECUTION"

AutomationEngine task execution event fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.automation_engine.state MUST be one of the following:

AutomationEngine workflow execution event

Model describing an AutomationEngine workflow execution event. Workflow execution events are stored in the dt.system.events table.

Query

AutomationEngine workflow execution state change.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_EXECUTION"

AutomationEngine workflow execution event fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.automation_engine.state MUST be one of the following:

AutomationEngine workflow lifecycle event

Model describing an AutomationEngine workflow lifecycle event. Workflow lifecycle events are stored in the dt.system.events table.

Query

AutomationEngine workflow lifecycle events.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and in(event.type, array("WORKFLOW_CREATED", "WORKFLOW_UPDATED", "WORKFLOW_DELETED", "WORKFLOW_TRASHED"))

AutomationEngine workflow lifecycle event fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

AutomationEngine workflow throttle event

Model describing an AutomationEngine workflow throttle event. Workflow throttle events are stored in the dt.system.events table.

Query

AutomationEngine workflow throttle events.

fetch dt.system.events
| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_THROTTLED"

AutomationEngine workflow throttle event fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

Browser Monitor or Clickpath billing usage

Model describing a billing usage event for "Browser Monitor or Clickpath". Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for the "Browser Monitor or Clickpath" capability.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Browser Monitor or Clickpath"
| dedup event.id

Browser Monitor or Clickpath billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Classic Feature Tracking event

Classic Feature Tracking events capture usage and compatibility of Dynatrace Classic features across your environment. They help administrators understand which classic features are actively used and which items are compatible with Latest Dynatrace.

Two types of events are defined:

Events do not include personal data or detailed payload content. Only data necessary for usage analysis or compatibility review is reported.

Query

Retrieve all Classic Feature Tracking events.

fetch dt.system.events
| filter event.kind == "CLASSIC_TRACKING_EVENT"

Count classic feature usage events per feature area.

fetch dt.system.events
| filter event.kind == "CLASSIC_TRACKING_EVENT"
| filter event.type == "CLASSIC_USAGE"
| summarize usages=count(), by: { classic.feature }
| sort usages desc

List all items requiring attention, with their reasons and guidance links.

fetch dt.system.events
| filter event.kind == "CLASSIC_TRACKING_EVENT"
| filter event.type == "COMPATIBILITY"
| filter classic.is_ready == false
| fields classic.feature, classic.object_id, classic.object_name, classic.reason, classic.action.url

Classic Tracking event fields

Classic Feature Tracking event attributes

Code Monitoring billing usage

Model describing a billing usage event of Code Monitoring. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for the Code Monitoring capability.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Code Monitoring"
| dedup event.id

Code Monitoring billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Data Egress billing usage

Model describing a billing usage event for data egress. Billing usage events are stored in the dt.system.events table.

Query

Retrieves billing usage events related to the "Data Egress" capability and returns only unique events by removing duplicates based on event.id.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Data Egress"
| dedup event.id

Charts how Data Egress usage evolves by summing billed bytes and grouping the usage by forwarding data type.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Data Egress"
| makeTimeseries usage_bytes = sum(billed_bytes), by:{dt.openpipeline.forwarding.datatype}

Calculates the total Data Egress usage by summing billed bytes and grouping the result by forwarding configuration.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Data Egress"
| summarize total_usage_bytes = sum(billed_bytes), by:{dt.openpipeline.forwarding.config_id}

Data Egress billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Data deletion events

Dynatrace stores a data deletion event for each segment that got rewritten in the dt.system.events table.

Query

Analyze data deletion events.

fetch dt.system.events
| filter event.kind == "DATA_DELETION_EVENT"

Data deletion event fields

Database Monitoring billing usage

Model describing a billing usage event for the Database Monitoring capability. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for the Database Monitoring capability.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"
| dedup event.id

Summarize total database instance hours per monitored database instance.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"
| dedup event.id
| summarize total_instance_hours = sum(`database-instance-hours`), by: { dt.smartscape_source.id, dt.smartscape_source.type }
| sort total_instance_hours desc

Show top monitored database instances by unique query count.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"
| dedup event.id
| summarize total_queries = sum(database_queries), by: { dt.smartscape_source.id, dt.smartscape_source.type }
| sort total_queries desc

Database Monitoring billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Digital Experience Monitoring - Query billing usage

Model describing a billing usage event of a Digital Experience Monitoring query execution. Billing usage events are stored in the dt.system.events table.

Query

Retrieves billing usage events related to the Digital Experience Monitoring - Query capability and returns only unique events by removing duplicates based on event.id.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Digital Experience Monitoring - Query"
| dedup event.id

Charts how Digital Experience Monitoring - Query usage evolves by summing billed bytes and grouping the result by usage.bucket.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Digital Experience Monitoring - Query"
| dedup event.id
| makeTimeseries usage_bytes = sum(billed_bytes), by:{usage.bucket}

Calculates the total Digital Experience Monitoring - Query usage by summing billed bytes and grouping the result by usage.bucket.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Digital Experience Monitoring - Query"
| dedup event.id
| summarize total_usage_bytes = sum(billed_bytes), by:{usage.bucket}

Digital Experience Monitoring - Query billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Digital Experience Monitoring - Retain billing usage

Model describing the billing usage event for retention of DEM events per Grail bucket. Billing usage events are stored in the dt.system.events table.

Query

Retrieves billing usage events related to the Digital Experience Monitoring - Retain capability and returns only unique events by removing duplicates based on event.id.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Digital Experience Monitoring - Retain"
| dedup event.id

Charts how Digital Experience Monitoring - Retain usage evolves by summing billed bytes and grouping the result by usage.bucket.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Digital Experience Monitoring - Retain"
| dedup event.id
| makeTimeseries usage_bytes = sum(billed_bytes), by:{usage.bucket}

Calculates the total Digital Experience Monitoring - Retain usage by summing billed bytes and grouping the result by usage.bucket.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT"
| filter event.type == "Digital Experience Monitoring - Retain"
| dedup event.id
| summarize total_usage_bytes = sum(billed_bytes), by:{usage.bucket}

Digital Experience Monitoring - Retain billing usage fields

Values

event.kind MUST be one of the following:

event.provider MUST be one of the following:

event.type MUST be one of the following:

dt.security_context MUST be one of the following:

Dynatrace self-monitoring event

Events that are generated by Dynatrace components with self-monitoring information (health, status, unexpected situations)

Dynatrace self-monitoring event fields

Events - Ingest & Process billing usage

Model describing a billing usage event of ingest for events. Billing usage events are stored in the dt.system.events table.

Query

Analyze billing usage events for the "Events - Ingest & Process" capability.

fetch dt.system.events
| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Ingest & Process"
| dedup event.id

Events - Ingest & Process billing usage fields