Maintenance window events track scheduled maintenance periods in your environment. These events are generated when a maintenance window starts or ends, allowing you to correlate alerts and incidents with planned maintenance activities.
Query all maintenance window events.
fetch dt.maintenance.windows
Maintenance window events are generated when a scheduled maintenance window starts or ends. These events track planned maintenance periods for entities matching specific filters.
Query maintenance window start events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"| filter event.type == "MAINTENANCE_WINDOW_START"
Query maintenance window end events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"| filter event.type == "MAINTENANCE_WINDOW_END"
Query maintenance window error events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"| filter event.type == "MAINTENANCE_WINDOW_ERROR"
Query maintenance window events.
fetch events| filter event.kind == "MAINTENANCE_WINDOW"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableThe settings object identifier for the maintenance window configuration. |
|
| timestamp | stableEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the |
|
| string | stableHuman-readable description of an event. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableThe human readable display name of an event type. |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableEntity filter expression defining which entities are affected by the maintenance window. |
|
| string | stableThe instance identifier for the maintenance window. |
|
| string | stableThe uuid of the user who created the maintenance window. |
|
| string | stableTitle of the maintenance window. |
|
| timestamp | stableStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Maintenance Window Event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| Maintenance Window Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Indicates the start of a scheduled maintenance window. |
| Indicates the end of a scheduled maintenance window. |