Maintenance window events track scheduled maintenance periods in your environment.
These events are generated when a maintenance window starts or ends, allowing you to
correlate alerts and incidents with planned maintenance activities.
Query
Query all maintenance window events.
fetch dt.maintenance.windows
Maintenance window events
Maintenance window events are generated when a scheduled maintenance window starts or ends.
These events track planned maintenance periods for entities matching specific filters.
Query
Query maintenance window start events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
|filter event.type == "MAINTENANCE_WINDOW_START"
Query maintenance window end events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
|filter event.type == "MAINTENANCE_WINDOW_END"
Query maintenance window error events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
|filter event.type == "MAINTENANCE_WINDOW_ERROR"
Query maintenance window events.
fetch events
|filter event.kind == "MAINTENANCE_WINDOW"
Maintenance window event fields
Attribute
Type
Description
Examples
dt.settings.object_id
string
stableThe settings object identifier for the maintenance window configuration.
vu9U3hXa3q0A....NjIxvu9U3hXa3q0
end_time
timestamp
stableDisplay name: End timeEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time.
1649822520123123165
event.description
string
stableDisplay name: Event descriptionHuman-readable description of an event.
Occurs on BlackFriday for all hosts in Ireland
event.id
string
stableDisplay name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates.
5547782627070661074_1647601320000
event.kind
string
stableDisplay name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: permission
MAINTENANCE_WINDOW
event.name
string
stableDisplay name: Event nameThe human readable display name of an event type.
stableEntity filter expression defining which entities are affected by the maintenance window.
matchesValue(cloud.provider, "aws")
maintenance_window.instance_id
string
stableThe instance identifier for the maintenance window.
5547782627070661074_1647601320000
maintenance_window.owner
string
stableThe uuid of the user who created the maintenance window.
6790cb48-f8e9-4773-bcea-001469de0599
maintenance_window.title
string
stableTitle of the maintenance window.
BlackFriday Maintenance Window
start_time
timestamp
stableDisplay name: Start timeStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time.
1649822520123123123
timestamp
timestamp
stableDisplay name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created.
1649822520123123123
Values
event.kind MUST be one of the following:
Value
Description
MAINTENANCE_WINDOW
Maintenance Window Event
event.provider MUST be one of the following:
Value
Description
MW_SERVICE
Maintenance Window Service
event.type MUST be one of the following:
Value
Description
MAINTENANCE_WINDOW_START
Indicates the start of a scheduled maintenance window.
MAINTENANCE_WINDOW_END
Indicates the end of a scheduled maintenance window.