Maintenance window events track scheduled maintenance periods in your environment.
These events are generated when a maintenance window starts or ends, allowing you to
correlate alerts and incidents with planned maintenance activities.
Query
Query all maintenance window events.
fetch dt.maintenance.windows
Maintenance window events
Maintenance window events are generated when a scheduled maintenance window starts or ends.
These events track planned maintenance periods for entities matching specific filters.
Query
Query maintenance window start events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
|filter event.type == "MAINTENANCE_WINDOW_START"
Query maintenance window end events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
|filter event.type == "MAINTENANCE_WINDOW_END"
Query maintenance window error events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
|filter event.type == "MAINTENANCE_WINDOW_ERROR"
Query maintenance window events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
Maintenance window event fields
Attribute
Type
Description
Examples
dt.settings.object_id
string
stable The settings object identifier for the maintenance window configuration.
vu9U3hXa3q0A....NjIxvu9U3hXa3q0
end_time
timestamp
stable Display name: End time End time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
event.description
string
stable Display name: Event description Human-readable description of an event.
Occurs on BlackFriday for all hosts in Ireland
event.id
string
stable Display name: Event ID Unique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stable Display name: Event kind Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission
MAINTENANCE_WINDOW
event.name
string
stable Display name: Event name The human readable display name of an event type.
stable Entity filter expression defining which entities are affected by the maintenance window.
matchesValue(cloud.provider, "aws")
maintenance_window.instance_id
string
stable The instance identifier for the maintenance window.
5547782627070661074_1647601320000
maintenance_window.owner
string
stable The uuid of the user who created the maintenance window.
6790cb48-f8e9-4773-bcea-001469de0599
maintenance_window.title
string
stable Title of the maintenance window.
BlackFriday Maintenance Window
start_time
timestamp
stable Display name: Start time Start time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time.
1649822520123123123
timestamp
timestamp
stable Display name: Timestamp The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
MAINTENANCE_WINDOW
Maintenance Window Event
event.provider MUST be one of the following:
Value
Description
MW_SERVICE
Maintenance Window Service
event.type MUST be one of the following:
Value
Description
MAINTENANCE_WINDOW_START
Indicates the start of a scheduled maintenance window.
MAINTENANCE_WINDOW_END
Indicates the end of a scheduled maintenance window.