Maintenance window events track scheduled maintenance periods in your environment. These events are generated when a maintenance window starts or ends, allowing you to correlate alerts and incidents with planned maintenance activities.
Query all maintenance window events.
fetch dt.maintenance.windows
Maintenance window events are generated when a scheduled maintenance window starts or ends. These events track planned maintenance periods for entities matching specific filters.
Query maintenance window start events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"| filter event.type == "MAINTENANCE_WINDOW_START"
Query maintenance window end events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"| filter event.type == "MAINTENANCE_WINDOW_END"
Query maintenance window error events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"| filter event.type == "MAINTENANCE_WINDOW_ERROR"
Query maintenance window events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"
| Attribute | Type | Description | Examples |
|---|---|---|---|
dt.settings.object_id | string | stable The settings object identifier for the maintenance window configuration. | vu9U3hXa3q0A....NjIxvu9U3hXa3q0 |
end_time | timestamp | stable Display name: End timeEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the start_time. | 1649822520123123165 |
event.description | string | stable Display name: Event descriptionHuman-readable description of an event. | Occurs on BlackFriday for all hosts in Ireland |
event.id | string | stable Display name: Event IDUnique identifier string of an event; is stable across multiple refreshes and updates. | 5547782627070661074_1647601320000 |
event.kind | string | stable Display name: Event kindGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | MAINTENANCE_WINDOW |
event.name | string | stable Display name: Event nameThe human readable display name of an event type. | Maintenance Window Start; Maintenance Window End; Maintenance Window Error |
event.provider | string | stable Display name: Event providerSource of the event, for example, the name of the component or system that generated the event. Tags: permission | MW_SERVICE |
event.type | string | stable Display name: Event typeThe unique type identifier of a given event. Tags: permission | MAINTENANCE_WINDOW_START; MAINTENANCE_WINDOW_END; MAINTENANCE_WINDOW_ERROR |
maintenance_window.filter | string | stable Entity filter expression defining which entities are affected by the maintenance window. | matchesValue(cloud.provider, "aws") |
maintenance_window.instance_id | string | stable The instance identifier for the maintenance window. | 5547782627070661074_1647601320000 |
maintenance_window.owner | string | stable The uuid of the user who created the maintenance window. | 6790cb48-f8e9-4773-bcea-001469de0599 |
maintenance_window.title | string | stable Title of the maintenance window. | BlackFriday Maintenance Window |
start_time | timestamp | stable Display name: Start timeStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the end_time. | 1649822520123123123 |
timestamp | timestamp | stable Display name: TimestampThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
event.kind MUST be one of the following:
| Value | Description |
|---|---|
MAINTENANCE_WINDOW | Maintenance Window Event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
MW_SERVICE | Maintenance Window Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
MAINTENANCE_WINDOW_START | Indicates the start of a scheduled maintenance window. |
MAINTENANCE_WINDOW_END | Indicates the end of a scheduled maintenance window. |