System events are used to store details about executed queries, auditing events, billing events and more. In order to query system events, you need the storage:system:read permission.
Query system events.
fetch dt.system.events
Analyzer execution events track all executions of analyzers.
List all analyzer executions.
fetch dt.system.events| filter event.kind == "ANALYZER_EXECUTION_EVENT"
List all analyzer executions that failed.
fetch dt.system.events, from:now()-24h| filter event.kind == "ANALYZER_EXECUTION_EVENT"| filter dt.analyzer.result_status == "FAILED"
Chart the number of result records for each task and user.
fetch dt.system.events| filter event.kind == "ANALYZER_EXECUTION_EVENT"| fieldsRename dt.settings.object_id = dt.task.id| makeTimeseries result_records = sum(dt.analyzer.result_records), by:{dt.settings.object_id, user.id}
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableA Dynatrace app ID. |
|
| string | stableName of the function that executed the query. |
|
| timestamp | experimentalEnd time (UNIX Epoch time in nanoseconds) of the analysis timeframe specified in the general parameters of the analyzer input. |
|
| timestamp | experimentalStart time (UNIX Epoch time in nanoseconds) of the analysis timeframe specified in the general parameters of the analyzer input. |
|
| string[] | experimentalErrors that occurred during analysis. |
|
| timestamp | experimentalTime (UNIX Epoch time in nanoseconds) when the analyzer execution stopped. |
|
| timestamp | experimentalTime (UNIX Epoch time in nanoseconds) when the analyzer execution started. |
|
| string | experimentalName of the executed analyzer. |
|
| long | experimentalNumber of output records from analysis. |
|
| string | experimentalIndicates whether the analyzer was successfully executed. |
|
| string[] | experimentalWarnings that occurred during analysis. |
|
| string | experimentalExplains why |
|
| string | experimentalGroup of the executed task. Tasks that share the same group usually share the same source. |
|
| string | experimentalIdentifier of the executed task. |
|
| string | experimentalName of the executed task. |
|
| string | experimentalIndicates whether the task was successfully executed. |
|
| string | experimentalExpression that defines the concrete task schedule. The expression syntax depends on the selected |
|
| string | experimentalScheduling method used for the task. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
The Anomaly Detector status events are used for Davis anomaly detection. They track errors and warnings during the execution of an anomaly detector. Examples:
Analyze anomaly detectors status events.
fetch dt.system.events| filter event.kind == "ANOMALY_DETECTOR_STATUS_EVENT"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableA Dynatrace app ID. |
|
| string | experimentalA string that identifies the Dynatrace service that triggered the query. |
|
| string | experimentalAdditional details about the anomaly detector status |
|
| string | experimentalSeverity of an anomaly detector status |
|
| string | experimentalThe object ID of a settings value. This corresponds to the 'objectId' field/parameter in the Settings API. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
Model describing a billing usage event of function invocations. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"| dedup event.id
Analyze billing usage of function invocations by their respective workflow ID.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"| dedup event.id| filter isNotNull(workflow.id)| summarize billed_invocations = sum(billed_invocations), by:{workflow.id}
Analyze billing usage of function invocations by the app and function that caused them.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "AppEngine Functions - Small"| filterOut isNull(dt.app.id) or isNull(function.id)| summarize billed_invocations = sum(billed_invocations), by:{dt.app.id, function.id}| sort billed_invocations desc
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableNumber of billed invocations. Unit is 1/4 GiB * min |
|
| string | stableThe entity/app invoking the function or not set when not invoked by an app. |
|
| string | stableThe service invoking the function or not set when not invoked by a service. |
|
| string | resource stableThe unique application identifier. Dynatrace apps are prefixed with 'dynatrace.', custom apps are prefixed with 'my.'. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| long | stableDuration of the function call in seconds. Measures not the actual execution time but the duration in the function proxy including network roundtrip to the Runtime. If the duration is bigger than the maximum allowed duration (which may happen due to technical reasons) the reported value is set to the maximum allowed duration. |
|
| string | stableIf the execution of a resumable function last for more than 2 minutes, there will be multiple |
|
| string | stableThe unique identifier of a function containing the app id and function id in the form of {app.id}.{function.id}. Missing for adhoc executions. |
|
| long | stableRuntime memory in MiB. Some of the memory is not available to the javascript code, because it is needed by the runtime itself. |
|
| string | stableThe identifier defining the function type. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
| string | stableThe unique identifier of a workflow execution as UUID. |
|
| string | stableThe unique identifier of a workflow as UUID. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| AppEngine Functions - Small |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
function.type MUST be one of the following:
| Value | Description |
|---|---|
| Adhoc function execution |
| App function execution |
| App function execution, but function is defined as an Action in the app manifest |
For every API access, Dynatrace stores an audit event in the dt.system.events table.
Additionally, the Audit Event allows to attach an arbitrary key/value map with string keys and string values to the event. Keys are prefixed with "details." during serialization.
Analyze audit events stored in the system event bucket.
fetch dt.system.events| filter event.kind == "AUDIT_EVENT"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe OAuth2 client id if of type 'CLIENT_CREDENTIALS'. |
|
| string | experimentalThe grant type used during OAuth2 authentication. |
|
| string | experimentalThe public token identifier of authentication.type 'TOKEN'. |
|
| string | experimentalThe method of authentication. |
|
| string | resource experimentalThe unique ID of the Dynatrace application function associated with the audit event in case the audited action was performed by a Dynatrace application function. |
|
| string | resource stableThe unique ID of the Dynatrace application associated with the audit event in case the audited action was performed by a Dynatrace application (either originating from the browser or a serverless function). Dynatrace applications are prefixed with 'dynatrace.' and custom apps are prefixed with 'my.'. If the ID is null, the audited action was not performed by a Dynatrace application, for example, a REST request coming from a customer script. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: | |
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableDenotes whether the event represents a success or a failure from the perspective of the entity that produced the event (for example an HTTP response code). |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableDescribes why a certain event.outcome was set. Typically, this is some form of error description in the case of a failure. |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | experimentalSource IP address of the request associated with this event. Must be set if origin.type is 'REST', must not be set otherwise. |
|
| string | experimentalThe ID of the browser session (if present) associated with the event. |
|
| string | experimentalOrigin type of the request associated with this event. |
|
| string | experimentalThe verbatim value of the X-Forwarded-For HTTP request header (if present) of the request associated with the event. |
|
| string | stableIn case of a REST call audit event, this field contains the request source. |
|
| string | stableGeneric reference to a resource like a REST resource URL or a settings ID. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
| string | experimentalin the context of audit events, the name of the user is always the email address of the user. |
|
| string | experimentalOrganization the user belongs to. |
|
Model describing a billing usage event of automation workflows. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for AutomationEngine workflows.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Automation Workflow"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableThe event end timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe event start timestamp in UTC (given in Grail preferred Linux timestamp nano precision format). |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableThe entity executing the workflow as UUID. |
|
| timestamp | stableThe time when the workflow was created. |
|
| string | stableThe description of the workflow. |
|
| string | stableThe unique identifier of a workflow as UUID. |
|
| string | stableThe boolean identifier denoting the visibility of the workflow. |
|
| string | stableThe entity owning the workflow as UUID. |
|
| string | stableThe title of the workflow. |
|
| string | stableThe identifier that describes the trigger of the workflow. |
|
| string | stableThe entity updating the workflow last. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Automation Workflow |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing an AutomationEngine action execution event. Action execution events are stored in the dt.system.events table.
AutomationEngine action execution state change.
fetch dt.system.events| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="ACTION_EXECUTION"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe app ID of the app containing the executed action. |
|
| string | experimentalName of the function implementing the action. |
|
| string | experimentalThe unique identifier of a action execution as UUID. |
|
| long | experimentalLoop index of the action execution. | |
| long | experimentalRetry count of the action execution. | |
| boolean | experimentalIndicates whether the triggered workflow execution is based on a workflow draft. |
|
| string | experimentalThe unique identifier of the root workflow. |
|
| string | experimentalThe unique identifier of the execution of the root workflow. |
|
| string | experimentalThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution). |
|
| boolean | experimentalIndicates if |
|
| string | experimentalAdditional info about current state of execution. Typically holds error details. |
|
| string | experimentalThe identifier of a task within a workflow. |
|
| string | experimentalThe unique identifier of a workflow as UUID. |
|
| string | experimentalThe title of the workflow. |
|
| string | experimentalThe unique identifier of a workflow execution as UUID. |
|
| string[] | resource experimentalCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey. |
|
| string | resource experimentalIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline. |
|
| duration | stableThe difference between |
|
| timestamp | stableEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| timestamp | stableStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Event in context of a workflow |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| Event produced by AutomationEngine |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Task execution state change event |
dt.automation_engine.state MUST be one of the following:
| Value | Description |
|---|---|
| Action execution started. |
| Action execution finished successfully. |
| Action execution failed. |
Model describing an AutomationEngine task execution event. Task execution events are stored in the dt.system.events table.
AutomationEngine task execution state change.
fetch dt.system.events| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="TASK_EXECUTION"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalIndicates whether the triggered workflow execution is based on a workflow draft. |
|
| string | experimentalThe unique identifier of the root workflow. |
|
| string | experimentalThe unique identifier of the execution of the root workflow. |
|
| string | experimentalThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution). |
|
| boolean | experimentalIndicates if |
|
| string | experimentalAdditional info about current state of execution. Typically holds error details. |
|
| string | experimentalThe identifier of a task within a workflow. |
|
| string | experimentalThe unique identifier of a workflow as UUID. |
|
| string | experimentalThe title of the workflow. |
|
| string | experimentalThe unique identifier of a workflow execution as UUID. |
|
| string[] | resource experimentalCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey. |
|
| string | resource experimentalIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline. |
|
| duration | stableThe difference between |
|
| timestamp | stableEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| timestamp | stableStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Event in context of a workflow |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| Event produced by AutomationEngine |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Task execution state change event |
dt.automation_engine.state MUST be one of the following:
| Value | Description |
|---|---|
| Task skipped due to task conditions evaluation or task is disabled. |
| Task discarded due to predecessor task conditions evaluation. |
| Task waiting due to e.g. task option configuration. |
| Task execution has running action execution. |
| Task execution finished successfully. |
| Task execution cancelled manually/by API request. |
| Task execution finished due to at least one failed action execution and no retries configured/left to process. |
Model describing an AutomationEngine workflow execution event. Workflow execution events are stored in the dt.system.events table.
AutomationEngine workflow execution state change.
fetch dt.system.events| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_EXECUTION"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| boolean | experimentalIndicates whether the triggered workflow execution is based on a workflow draft. |
|
| string | experimentalThe unique identifier of the root workflow. |
|
| string | experimentalThe unique identifier of the execution of the root workflow. |
|
| string | experimentalThe state of an execution. Values depend on type of execution (workflow-, task-, or action execution). |
|
| boolean | experimentalIndicates if |
|
| string | experimentalAdditional info about current state of execution. Typically holds error details. |
|
| string | experimentalThe unique identifier of a workflow as UUID. |
|
| boolean | experimentalIndicates if the workflow execution state has changed since the last execution, ignoring draft executions. Always false for draft executions. |
|
| string | experimentalThe title of the workflow. |
|
| string | experimentalWorkflow type, either SIMPLE or STANDARD, where SIMPLE comes with restrictions. |
|
| string | experimentalThe unique identifier of the actor as defined in the workflow. |
|
| string | experimentalThe unique identifier of a workflow execution as UUID. |
|
| string | experimentalUnique identifier string ( |
|
| timestamp | experimentalThe timestamp of the event that triggered the workflow execution. |
|
| string | experimentalThe identifier that describes the trigger of the workflow. |
|
| string | experimentalThe unique identifier of the user who triggered the workflow execution manually/via API. |
|
| string | experimentalThe unique identifier of the workflow that triggered the workflow execution. |
|
| string[] | resource experimentalCollects the identifiers of all pipelines through which a record has passed during the ingestion process in OpenPipeline, providing a complete trace of its journey. |
|
| string | resource experimentalIdentifies the source (such as API endpoints or OneAgent) used for ingesting the record into OpenPipeline. |
|
| duration | stableThe difference between |
|
| timestamp | stableEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| timestamp | stableStart time of a data point. Value is a UNIX Epoch time in nanoseconds and less than or equal to the |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Event in context of a workflow |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| Event produced by AutomationEngine |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Workflow execution state change event |
dt.automation_engine.state MUST be one of the following:
| Value | Description |
|---|---|
| Workflow execution started. |
| Workflow execution finished successfully. |
| Workflow execution failed due to at least one branch with a failed task without an on error successor. |
| Workflow execution cancelled manually/by API request. |
Model describing an AutomationEngine workflow lifecycle event. Workflow lifecycle events are stored in the dt.system.events table.
AutomationEngine workflow lifecycle events.
fetch dt.system.events| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and in(event.type, array("WORKFLOW_CREATED", "WORKFLOW_UPDATED", "WORKFLOW_DELETED"))
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalThe unique identifier of a workflow as UUID. |
|
| string | experimentalThe title of the workflow. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Event in context of a workflow |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| Event produced by AutomationEngine |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Workflow created event |
| Workflow updated event |
| Workflow deleted event |
Model describing an AutomationEngine workflow throttle event. Workflow throttle events are stored in the dt.system.events table.
AutomationEngine workflow throttle events.
fetch dt.system.events| filter event.kind == "WORKFLOW_EVENT" and event.provider == "AUTOMATION_ENGINE" and event.type =="WORKFLOW_THROTTLED"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe workflow execution per hour limit that has been reached. |
|
| string | experimentalThe unique identifier of a workflow as UUID. |
|
| string | experimentalThe title of the workflow. |
|
| timestamp | stableEnd time of a data point. Value is a UNIX Epoch time in nanoseconds and greater than or equal to the |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Event in context of a workflow |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| Event produced by AutomationEngine |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Workflow throttled event |
Model describing a billing usage event for "Browser Monitor or Clickpath". Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Browser Monitor or Clickpath" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Browser Monitor or Clickpath"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of synthetic actions which trigger a web request that includes a page load, navigation event, or action that triggers an XHR or Fetch request. Scroll downs, keystrokes, or clicks that don't trigger web requests aren't counted as such actions. This is the billable unit related to the rate card of this capability. |
|
| string | resource stableAn entity ID of an entity of type SYNTHETIC_TEST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Browser Monitor or Clickpath |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Classic Feature Tracking events capture usage and compatibility of Dynatrace Classic features across your environment. They help administrators understand which classic features are actively used and which items are compatible with Latest Dynatrace.
Two types of events are defined:
Events do not include personal data or detailed payload content. Only data necessary for usage analysis or compatibility review is reported.
Retrieve all Classic Feature Tracking events.
fetch dt.system.events| filter event.kind == "CLASSIC_TRACKING_EVENT"
Count classic feature usage events per feature area.
fetch dt.system.events| filter event.kind == "CLASSIC_TRACKING_EVENT"| filter event.type == "CLASSIC_USAGE"| summarize usages=count(), by: { classic.feature }| sort usages desc
List all items requiring attention, with their reasons and guidance links.
fetch dt.system.events| filter event.kind == "CLASSIC_TRACKING_EVENT"| filter event.type == "COMPATIBILITY"| filter classic.is_ready == false| fields classic.feature, classic.object_id, classic.object_name, classic.reason, classic.action.url
Classic Feature Tracking event attributes
| Attribute | Type | Description | Examples |
|---|---|---|---|
audit.identity | string | stable Present for CLASSIC_USAGE events. The anonymized identifier of the user or API token that triggered the usage. Must not include personal data beyond a pseudonymous identifier. | b5998ff1-26fd-4aec-80c4-6c59633b5d66; dt0c01.EXAMPLE |
classic.action.url | string | experimental Present for COMPATIBILITY events. Optional link to documentation or guidance for resolving the issue described in classic.reason. | https://docs.dynatrace.com/docs/oneagent/upgrade; https://dt.com/hub/extensions/upgrade |
classic.context | string | experimental Present for CLASSIC_USAGE events. Optional additional detail such as a query string or user agent. Must not include personal data or sensitive payload content. | Mozilla/5.0 (compatible; DynatraceBot) |
classic.feature | string | experimental The classic feature or capability that was used or configured. Identifies the product area, for example "Dashboards Classic", "Management Zone", "Extension v2", or "OneAgent". | Dashboards Classic; Management Zone; Extension v2; OneAgent |
classic.is_ready | boolean | experimental Present for COMPATIBILITY events. true if the item is compatible with Latest Dynatrace; false if action is required. | true; false |
classic.object_id | string | experimental For CLASSIC_USAGE events: the specific object that was accessed, such as a dashboard ID or API endpoint path. For COMPATIBILITY events: the identifier of the item being assessed, such as an extension ID, host ID, or integration name. | 57f8bbf5-f05a-435c-b77c-1003c6b9ddd9; /api/v2/entities; host-1a2b3c4d; my-extension-v2 |
classic.object_name | string | experimental Present for COMPATIBILITY events. Optional human-readable name of the item identified by classic.object_id. | Frontend Team MZ; My Auto-tag Rule |
classic.reason | string | experimental Present for COMPATIBILITY events when classic.is_ready is false. Explains why the item requires attention. | OneAgent version 1.325 below required 1.331; Extension major version too low; Unsupported configuration type |
event.kind | string | stable Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | CLASSIC_TRACKING_EVENT |
event.type | string | stable The unique type identifier of a given event. Tags: permission | CLASSIC_USAGE; COMPATIBILITY |
timestamp | timestamp | stable The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
Model describing a billing usage event of Code Monitoring. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the Code Monitoring capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Code Monitoring"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalIdentifier of the app-only containerization type. |
|
| string | resource stableThe 12-digit number, such as 123456789012, that uniquely identifies an AWS account.Tags: |
|
| string | resource stableAn Azure subscription is a logical container used to provision resources in Azure.Tags: |
|
| long | experimentalThe number of code monitoring container hours consumed by the host. |
|
| string | resource experimental | |
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | resource stableIdentifier of the GCP project associated with this resource.Tags: |
|
| string | resource stableA pseudo-ID for the cluster, by default set to the UID of the kube-system namespace. |
|
| string | resource stableThe name of the namespace that the pod is running in.Tags: |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Code Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for data egress. Billing usage events are stored in the dt.system.events table.
Retrieves billing usage events related to the "Data Egress" capability and returns only unique events by removing duplicates based on event.id.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Data Egress"| dedup event.id
Charts how Data Egress usage evolves by summing billed bytes and grouping the usage by forwarding data type.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Data Egress"| makeTimeseries usage_bytes = sum(billed_bytes), by:{dt.openpipeline.forwarding.datatype}
Calculates the total Data Egress usage by summing billed bytes and grouping the result by forwarding configuration.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Data Egress"| summarize total_usage_bytes = sum(billed_bytes), by:{dt.openpipeline.forwarding.config_id}
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource experimentalID of the forwarding configuration in OpenPipeline. |
|
| string | resource experimentalForwarded datatype |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Tracker Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Data Egress |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Dynatrace stores a data deletion event for each segment that got rewritten in the dt.system.events table.
Analyze data deletion events.
fetch dt.system.events| filter event.kind == "DATA_DELETION_EVENT"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalA Dynatrace Grail bucket name. |
|
| string | stableThe REST API version used by the client to perform the request. |
|
| long | experimentalEnd of a particular deletion. |
|
| string | experimentalInternal deletion request UUID. |
|
| long | experimentalStart of a particular deletion. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: | |
| string | experimentalA Dynatrace environment/tenant ID. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | experimentalAdditional information if query execution has 'FAILED'. |
|
| string | experimentalThe query string. |
|
| long | experimentalThe number of rewritten bytes in the context of record deletion. |
|
| string | experimentalThe outcome of the query. |
|
| string | experimentalDeletion task UUID returned by API. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
| string | resource deprecatedUsed in Extension Framework 2.0The SNMP version. |
|
Model describing a billing usage event for the Database Monitoring capability. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the Database Monitoring capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"| dedup event.id
Summarize total database instance hours per monitored database instance.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"| dedup event.id| summarize total_instance_hours = sum(`database-instance-hours`), by: { dt.smartscape_source.id, dt.smartscape_source.type }| sort total_instance_hours desc
Show top monitored database instances by unique query count.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Database Monitoring"| dedup event.id| summarize total_queries = sum(database_queries), by: { dt.smartscape_source.id, dt.smartscape_source.type }| sort total_queries desc
| Attribute | Type | Description | Examples |
|---|---|---|---|
database-instance-hours | double | experimental Database instance hours consumed during the usage window. Each 1,000 unique queries count as 0.25 hours, with a minimum of 0.25 hours per window. | 0.25; 0.5; 1.0 |
database_queries | long | experimental Count of unique database queries executed during the 15-minute usage window. | 500; 1001; 5000 |
dt.cost.costcenter | string | resource stable Can be used to assign usage to a Cost Center. | Team A |
dt.cost.product | string | resource stable Can be used to assign usage to a Product or Application ID. | Product A |
dt.security_context | string | resource stable The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: permission | BILLING_USAGE_EVENT |
dt.smartscape_source.id | smartscapeId | resource experimental The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id | DB_INSTANCE_POSTGRES-0000000000000001 |
dt.smartscape_source.type | string | resource stable The entity type of the entity whose identifier is held in dt.smartscape_source.id. | DB_INSTANCE_POSTGRES |
event.id | string | stable Unique identifier string of an event; is stable across multiple refreshes and updates. | 5547782627070661074_1647601320000 |
event.kind | string | stable Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | BILLING_USAGE_EVENT |
event.provider | string | stable Source of the event, for example, the name of the component or system that generated the event. Tags: permission | LIMA_USAGE_TRACKER |
event.type | string | stable The unique type identifier of a given event. Tags: permission | Database Monitoring |
event.version | string | stable Describes the version of the event. | 1.0.0 |
timestamp | timestamp | stable The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
usage.end | timestamp | stable End time of the usage timeframe (exclusive). | 2023-05-22T11:30:00.000000Z |
usage.start | timestamp | stable Start time of the usage timeframe (inclusive). | 2023-05-22T11:15:00.000000Z |
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
event.kind MUST be one of the following:
| Value | Description |
|---|---|
BILLING_USAGE_EVENT | Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
LIMA_USAGE_TRACKER | Lima Usage Tracker |
event.type MUST be one of the following:
| Value | Description |
|---|---|
Database Monitoring | Database Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
BILLING_USAGE_EVENT | Billing usage event |
Model describing a billing usage event of a Digital Experience Monitoring query execution. Billing usage events are stored in the dt.system.events table.
Retrieves billing usage events related to the Digital Experience Monitoring - Query capability and returns only unique events by removing duplicates based on event.id.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Digital Experience Monitoring - Query"| dedup event.id
Charts how Digital Experience Monitoring - Query usage evolves by summing billed bytes and grouping the result by usage.bucket.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Digital Experience Monitoring - Query"| dedup event.id| makeTimeseries usage_bytes = sum(billed_bytes), by:{usage.bucket}
Calculates the total Digital Experience Monitoring - Query usage by summing billed bytes and grouping the result by usage.bucket.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Digital Experience Monitoring - Query"| dedup event.id| summarize total_usage_bytes = sum(billed_bytes), by:{usage.bucket}
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableIndicates if the query was executed to fetch records or to delete them. |
|
| long | stableThe number of bytes that will be billed. |
|
| string | stableA Dynatrace app ID. |
|
| string | stableName of the function that executed the query. |
|
| string | stableDynatrace application that executed the query. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableDisplay name for usage details. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | stableThe UUID identifying a particular query. |
|
| long | stableQuery start time. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Tracker Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Digital Experience Monitoring Query Execution |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing the billing usage event for retention of DEM events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Retrieves billing usage events related to the Digital Experience Monitoring - Retain capability and returns only unique events by removing duplicates based on event.id.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Digital Experience Monitoring - Retain"| dedup event.id
Charts how Digital Experience Monitoring - Retain usage evolves by summing billed bytes and grouping the result by usage.bucket.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Digital Experience Monitoring - Retain"| dedup event.id| makeTimeseries usage_bytes = sum(billed_bytes), by:{usage.bucket}
Calculates the total Digital Experience Monitoring - Retain usage by summing billed bytes and grouping the result by usage.bucket.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT"| filter event.type == "Digital Experience Monitoring - Retain"| dedup event.id| summarize total_usage_bytes = sum(billed_bytes), by:{usage.bucket}
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableDisplay name for usage details. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Digital Experience Monitoring - Retain |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Events that are generated by Dynatrace components with self-monitoring information (health, status, unexpected situations)
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | experimentalUnstructured content of the record. It should contain a human-readable message. Often it is the raw version of a record read from a source. |
|
| string | resource experimentalThe name of a group that the ActiveGate instance belongs to. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | experimentalPreregistered event key for self-monitoring events whitelisting. |
|
| string | resource experimentalExtension's monitoring configuration identifier. |
|
| string | resource experimentalName of the data source. |
|
| string | resource experimentalName of the extension. |
|
| string | resource experimentalThe status of the component reporting a self-monitoring event. |
|
| string | resource stableThe ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the classic entity storage. 1Tags: |
|
| string | stableHuman-readable attribute that identifies a log stream. 2Tags: |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
The value of this field will be based on the value of one of the dt.entity.<type> fields. This means that the dt.source_entity and dt.entity.<type> fields will both be set to the same ID.
Can contain, for example, a file path, standard output, or an URI etc., depending on the log stream type. The value should be stable for one logical source (for example, not affected by log file rotation digits).
Dynatrace stores an enrichment execution event for the enrichment of threat observables in the dt.system.events table.
Analyze enrichment execution events.
fetch dt.system.events| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"
The number of successful enrichments.
fetch dt.system.events| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"| filter event.outcome == "success"| summarize count()
The number of failed enrichments.
fetch dt.system.events| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"| filter event.outcome == "failure"| summarize count()
The number of enrichments by integration app.
fetch dt.system.events| filter event.kind == "ENRICHMENT_EXECUTION_EVENT"| summarize count(), by: {dt.enrichment.integration.id}
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableThe unique application identifier of the app that triggered the enrichment. Dynatrace apps are prefixed with 'dynatrace.', custom apps are prefixed with 'my.'. |
|
| duration | experimentalThe duration of the enrichment execution in nanoseconds. |
|
| string | experimentalThe identifier of the connection settings object used to execute the enrichment. The connection settings object ID refers to the connection in the settings section of the integration app. |
|
| string | experimentalThe unique application identifier of the integration app that provided the enrichment functionality. Dynatrace apps are prefixed with 'dynatrace.', custom apps are prefixed with 'my.'. |
|
| string | experimentalThe integration method ID of the integration app used to execute the enrichment. |
|
| boolean | experimentalIndicates whether the enrichment execution result was retrieved from the cache. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableDenotes whether the event represents a success or a failure from the perspective of the entity that produced the event (for example an HTTP response code). |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableDescribes why a certain event.outcome was set. Typically, this is some form of error description in the case of a failure. |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
Model describing a billing usage event of ingest for events. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Events - Ingest & Process" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Ingest & Process"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableDisplay name for usage details. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Events - Ingest & Process |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event of a events query execution. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Query"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableIndicates if the query was executed to fetch records or to delete them. |
|
| long | stableThe number of bytes that will be billed. |
|
| string | stableA Dynatrace app ID. |
|
| string | stableName of the function that executed the query. |
|
| string | stableDynatrace application that executed the query. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableDisplay name for usage details. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | stableThe UUID identifying a particular query. |
|
| long | stableQuery start time. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Tracker Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Events Query Execution |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Events - Retain"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableDisplay name for usage details. |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Events Retain |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event of ingest for files. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Files - Ingest & Process" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Files - Ingest & Process"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Files - Ingest & Process |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event of a files query execution. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Files - Query"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableIndicates if the query was executed to fetch records or to delete them. |
|
| long | stableThe number of bytes that will be billed. |
|
| string | stableA Dynatrace app ID. |
|
| string | stableName of the function that executed the query. |
|
| string | stableDynatrace application that executed the query. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | stableThe UUID identifying a particular query. |
|
| long | stableQuery start time. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
Model describing the billing usage event for the retention of files. Billing usage events are stored in the dt.system.events table.
Fetch Files - Retain billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Files - Retain"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
billed_bytes | long | stable The number of bytes that will be billed. | 1113359256 |
dt.cost.costcenter | record[] | resource stable Can be used to assign usage to a Cost Center. | [{'key': 'my-cost-center', 'billed_bytes': '1048576'}] |
dt.cost.product | record[] | resource stable Can be used to assign usage to a Product or Application ID. | [{'key': 'my-product', 'billed_bytes': '1048576'}] |
dt.security_context | string | resource stable The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: permission | BILLING_USAGE_EVENT |
event.id | string | stable Unique identifier string of an event; is stable across multiple refreshes and updates. | 5547782627070661074_1647601320000 |
event.kind | string | stable Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | BILLING_USAGE_EVENT |
event.provider | string | stable Source of the event, for example, the name of the component or system that generated the event. Tags: permission | LIMA_USAGE_STREAM |
event.type | string | stable The unique type identifier of a given event. Tags: permission | Files - Retain |
event.version | string | stable Describes the version of the event. | 1.0.0 |
file.category | string | stable Contains the value of the File Category. | Custom files |
timestamp | timestamp | stable The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
event.kind MUST be one of the following:
| Value | Description |
|---|---|
BILLING_USAGE_EVENT | Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
LIMA_USAGE_STREAM | LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
Files - Retain | Files Retain |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
BILLING_USAGE_EVENT | Billing usage event |
Model describing a billing usage event for the Foundation & Discovery DPS capability.
Billing usage events are stored in the dt.system.events table.
Analyze billing usage for Foundation & Discovery on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Foundation & Discovery"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableHow many host hours of the capability have been consumed by the host. |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Foundation & Discovery |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for the Full-Stack Monitoring DPS capability.
Billing usage events are stored in the dt.system.events table.
Analyze billing usage for Full-Stack Monitoring on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Full-Stack Monitoring"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| double | stableHow many gibibyte hours of the capability has been consumed by the host |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Full-Stack Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
GenAI events are emitted when a GenAI skill is invoked or feedback is provided. They provide tracking data for skill usage and user feedback. Examples:
Retrieve all GenAI events.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"
Count of GenAI skill invocations.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "GenAi Skill Invocation"| summarize count()
Count the GenAI invocations per skill.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "GenAi Skill Invocation"| summarize invocations=count(), by: skill
Count of the GenAI feedback type per skill.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "GenAi Feedback"| summarize count(), by: {feedback.type, skill}
Time series of the GenAI execution duration per skill.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "GenAi Skill Invocation"| makeTimeseries avg(execution_duration_ms), by: {skill}
Count of MCP initializations.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "MCP Init"| summarize count()
Count the MCP initializations per client.application_context.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "MCP Init"| summarize invocations=count(), by: client.application_context
Count of MCP Tool Invocations.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "MCP Tool Invocation"| summarize count()
Count the MCP Tool Invocations per tool.
fetch dt.system.events| filter event.kind == "GENAI_EVENT"| filter event.type == "MCP Tool Invocation"| summarize invocations=count(), by: tool
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableA Dynatrace app ID. |
|
| string | experimentalName of the originating application if the conversation started from another app. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| long | deprecatedThe duration of the query in milliseconds. |
|
| string | experimentalDetailed error message or justification for failure, intended for end users. |
|
| string | experimentalAdditional information if query execution has 'FAILED'. |
|
| string | experimentalCategory of feedback, selected by the user. |
|
| string | experimentalUnmasked free-text feedback provided by the user. |
|
| string | experimentalType of feedback provided by the user, such as positive or negative. |
|
| string | experimentalAn MCP Client name |
|
| string | experimentalAn MCP Client version |
|
| string | experimentalThe response was generated by the skill. |
|
| string | experimentalThe name of the MCP server that was invoked. |
|
| string | experimentalThe name of the skill that was executed. |
|
| string | experimentalThe outcome of the query. |
|
| string | experimentalAdditional context information was provided for the skill (chat only). |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | experimentalThe name of the MCP server tool that was invoked. |
|
| string | experimentalGeneral topic addressed by the user input (for chat events only). |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
| string | experimentalThe user input was provided for the skill. |
|
| string | stableThe unique identifier of a workflow as UUID. |
|
event.type MUST be one of the following:
| Value | Description |
|---|---|
| GenAI skill was invoked. |
| Feedback for a GenAI skill was provided. |
skill MAY be one of the following:
| Value | Description |
|---|---|
| Events associated with the conversations skill also used in the Davis CoPilot Chat App. |
| Events associated with the skill translating natural language into DQL queries. |
| Events associated with the skill explaining DQL queries in natural text. |
status MUST be one of the following:
| Value | Description |
|---|---|
| Skill invocation succeeded. |
| Skill invocation failed. |
| Skill invocation was blocked by guardrail or content filter. |
failure_reason MAY be one of the following:
| Value | Description |
|---|---|
| There was a technical problem. |
| Content filter check failed. |
| Guardrail check failed. |
| Generated DQL was invalid. |
feedback.type MUST be one of the following:
| Value | Description |
|---|---|
| Positive feedback. |
| Negative feedback. |
feedback.category MAY be one of the following:
| Value | Description |
|---|---|
| The execution of the skill did not work. |
| The response was incomplete. |
| The response was incorrect. |
| The response misunderstood the question. |
| No provided feedback category fits. |
Model describing a billing usage event for HTTP Monitor. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "HTTP Monitor" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "HTTP Monitor"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of HTTP requests performed. This is the billable unit related to the rate card of this capability. |
|
| string | resource stableAn entity ID of an entity of type HTTP_CHECK.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| HTTP Monitor |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for the Infrastructure Monitoring DPS capability.
Billing usage events are stored in the dt.system.events table.
Analyze billing usage for Infrastructure Monitoring on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Infrastructure Monitoring"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableHow many host hours of the capability have been consumed by the host. |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Infrastructure Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for Kubernetes Platform Monitoring. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Kubernetes Platform Monitoring" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Kubernetes Platform Monitoring"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| double | stableThe number of pod-hours billed per namespace in a Kubernetes cluster |
|
| string | resource stableAn entity ID of an entity of type CLOUD_APPLICATION_NAMESPACE. A CLOUD_APPLICATION_NAMESPACE is a Kubernetes namespace.Tags: |
|
| string | resource stableAn entity ID of an entity of type KUBERNETES_CLUSTER.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Kubernetes Platform Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for ingest and process of logs. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Log Management & Analytics - Ingest & Process" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Ingest & Process"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Log Management & Analytics - Ingest & Process |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event of a logs query execution. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Query"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableIndicates if the query was executed to fetch records or to delete them. |
|
| long | stableThe number of bytes that will be billed. |
|
| string | stableA Dynatrace app ID. |
|
| string | stableName of the function that executed the query. |
|
| string | stableDynatrace application that executed the query. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | stableThe UUID identifying a particular query. |
|
| long | stableQuery start time. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Tracker Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Logs Query Execution |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Fetch Log Management & Analytics - Retain billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Retain"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| record[] | resource stableCan be used to assign usage to a Cost Center. |
|
| record[] | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage log bucket name. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Logs Retain |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Fetch Log Management & Analytics - Retain with Included Queries usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Log Management & Analytics - Retain with Included Queries"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| record[] | resource stableCan be used to assign usage to a Cost Center. |
|
| record[] | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage log bucket name. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Retain with Included Queries |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for Mainframe Monitoring. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Mainframe Monitoring" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Mainframe Monitoring"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| double | stableThe number of msu-hours billed for the mainframe host. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Mainframe Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event of ingest & process for metrics. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Metrics - Ingest & Process"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of billable metrics data points. |
|
| record[] | resource stableCan be used to assign usage to a Cost Center. |
|
| record[] | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | stableIdentifies the type of metric and therefore the timeseries rollup functions it supports. |
|
| string | stableMonitoring source that originally reported the data. See 'dt.system.monitoring_source'. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage metrics bucket name. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Metrics - Ingest & Process |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing the billing usage event for retention of metrics per Grail bucket. Billing usage events are stored in the dt.system.events table.
Fetch Metrics Retain billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Metrics - Retain"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage metric bucket name. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Metrics Retain |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Dynatrace stores a query execution event for each query that got executed in the dt.system.events table.
Analyze query execution events.
fetch dt.system.events| filter event.kind == "QUERY_EXECUTION_EVENT"
The amount of succeeded queries.
fetch dt.system.events| filter event.kind == "QUERY_EXECUTION_EVENT"| filter status == "SUCCEEDED"| summarize countDistinct(query_id)
The amount of failed queries.
fetch dt.system.events| filter event.kind == "QUERY_EXECUTION_EVENT"| summarize sum(failed_count)
| Attribute | Type | Description | Examples |
|---|---|---|---|
analysis_timeframe.end | timestamp | experimental End time of query analysis timeframe. | 2023-05-22T13:15:57.416654000 |
analysis_timeframe.start | timestamp | experimental Start time of query analysis timeframe. | 2023-05-22T11:15:57.416654000 |
bucket | string | experimental A Dynatrace Grail bucket name. | default_logs; default_events |
client.api_version | string | stable The REST API version used by the client to perform the request. | 1 |
client.application_context | string | stable A Dynatrace app ID. | local-dev-mode; dynatrace.notebooks; my.biz.carbon |
client.function_context | string | stable Name of the function that executed the query. | api/execute-dql-query; my/function |
client.internal_service_context | string | experimental A string that identifies the Dynatrace service that triggered the query. | dt.davis.datadriver |
client.source | string | stable Dynatrace application that executed the query. | https://tenant.apps.dynatracelabs.com/ui/notebook/a0321331-795c-43e7-87cd-890e4bfa8a09 |
delivered_records | long | experimental The number of records returned by the query. Might differ from actual number of records delivered to the client due to the additional response size limits (max result bytes, max result records, etc.). | 1000 |
dt.security_context | string | resource stable The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: permission | |
environment | string | experimental A Dynatrace environment/tenant ID. | umsaywsjuo |
event.kind | string | stable Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | QUERY_EXECUTION_EVENT |
execution_duration_ms | long | deprecated The duration of the query in milliseconds. | 123 |
failed_count | long | experimental Number of failed queries represented by the record. failed_count > 1 represents cases like 'failure_reason=THROTTLED' with individual queries aggregated into a single record. | 1; 321 |
failure_reason | string | experimental Additional information if query execution has 'FAILED'. | QUEUE_TIMEOUT; THROTTLED |
flags | string[] | experimental Advisory flags attached to the query result by the query execution engine. | ['CLASSIC_ENTITY_MIGRATION_ADVISED'] |
matched_records_ratio | double | experimental The ratio of records that matched the query filter conditions out of the total number of scanned records. A value of 1.0 means all scanned records matched; 0.0 means none matched. | 0.42 |
query_end | long | stable Query end time. For aggregated events the query end time may be zero and not reflect the exact end time. | 1683012271413 |
query_id | string | stable The UUID identifying a particular query. For aggregated events this field is null. | e68e5cc8-c31e-4e57-90d7-c6dde20b19d5 |
query_pool | string | experimental The resource pool of the query. | DASHBOARDS |
query_queue_time_ms | long | deprecated The time query spent in queued state (in milliseconds). | 456 |
query_start | long | stable Query start time. For failed queries the start time may be aggregated and not reflect the exact start time but rather the aggregation time. | 1683012271413 |
query_string | string | experimental The query string. For aggregated events this field is null. | fetch bizevents, from:-30m | limit 1 |
sampling_ratio | long | experimental The sampling ratio of the executed query. | 1 |
scanned_bytes | long | experimental The number of scanned bytes. | 1113359256 |
scanned_data_points | long | experimental Number of scanned data points for metric queries. | 20 |
scanned_records | long | experimental The number of scanned records. | 9209037 |
status | string | experimental The outcome of the query. | SUCCEEDED |
table | string | experimental A Dynatrace Grail table name. | logs; metrics |
timestamp | timestamp | stable The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
user | string | experimental The user ID that triggered the query. For aggregated events this field is null. | b5998ff1-26fd-4aec-80c4-6c59633b5d66 |
user.email | string | stable The user email that triggered the query. For aggregated events this field is null. | john.doe@dynatrace.com |
user.id | string | stable The user UUID that triggered the query. For aggregated events this field is null. | b5998ff1-26fd-4aec-80c4-6c59633b5d66 |
version | string | resource deprecated Used in Extension Framework 2.0 The record version | 1 |
failure_reason MUST be one of the following:
| Value | Description |
|---|---|
| Query timed out before execution due to resource or tenant quota limit. |
| Query was rejected due to too many queries waiting in the queue. Reported either as records with full details or as aggregated batches with limited metadata. |
| Query cannot be parsed due to a syntax error. |
| Query cannot be parsed because it exceeds the complexity limit of the parser. |
| Query cannot be parsed due to an internal error. |
| Execution of the submitted query failed because of internal an error. |
| Query cannot be executed because the requester doesn't have permissions to a queried table. |
| Query execution was canceled because it exceeded the allowed running time. |
| Query execution was canceled because the memory usage limit was exceeded. |
| Query execution was canceled because the disk space limit was exceeded. |
| Query execution was canceled because the user-defined functions limit was exceeded. |
| Query execution was canceled because the record size limit was exceeded. |
| Query execution was canceled because the table size limit was exceeded. |
| Query execution was canceled because the condition of a failIf command was met. |
Model describing a billing usage event for Real User Monitoring Property. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Real User Monitoring Property" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Real User Monitoring Property"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalUser action and session properties counted by application. |
|
| string | resource experimentalThe type of the device. |
|
| string | resource stableThe ME ID of a web application.Tags: |
|
| string | resource experimentalThe ME ID of a device application. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Real User Monitoring Property |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for Real User Monitoring. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Real User Monitoring" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Real User Monitoring"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalSession count without Session Replay counted by application. |
|
| string | resource experimentalThe type of the device. |
|
| string | resource stableThe ME ID of a web application.Tags: |
|
| string | resource experimentalThe ME ID of a device application. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Real User Monitoring |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for Real User Monitoring with Session Replay. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Real User Monitoring with Session Replay" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Real User Monitoring with Session Replay"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalSession count with Session Replay counted by application. |
|
| string | resource experimentalThe type of the device. |
|
| string | resource stableThe ME ID of a web application.Tags: |
|
| string | resource experimentalThe ME ID of a device application. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Real User Monitoring with Session Replay |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for the Runtime Application Protection DPS capability.
Billing usage events are stored in the dt.system.events table.
Analyze billing usage for Runtime Application Protection on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Runtime Application Protection"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| double | stableHow many gibibyte hours of the capability has been consumed by the host |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Runtime Application Protection |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for the Runtime Vulnerability Analytics DPS capability.
Billing usage events are stored in the dt.system.events table.
Analyze billing usage for Runtime Vulnerability Analytics on 15-minute billing intervals.
Note that complete usage for events is displayed only for Dynatrace versions 1.312+. Earlier versions will display partial usage.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Runtime Vulnerability Analytics"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| double | stableHow many gibibyte hours of the capability has been consumed by the host |
|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableAn entity ID of an entity of type HOST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Runtime Vulnerability Protection |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for Security Posture Management. Billing usage events are stored in the dt.system.events table.
Analyze usage events for the "Security Posture Management" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Security Posture Management"| dedup event.id
Analyze Security Posture Management billing usage events for a specific Kubernetes cluster.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Security Posture Management"| filter k8s.cluster.name == "my-cluster"| dedup event.id
Analyze Security Posture Management billing usage in the last 24 hours grouped by Smartscape source entity to identify which entities drive the most usage.
fetch dt.system.events, from:now()-24h| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Security Posture Management"| dedup event.id| summarize billed_host_hours = count(), by: {dt.smartscape_source.id, dt.smartscape_source.type, k8s.cluster.name}| sort billed_host_hours desc
| Attribute | Type | Description | Examples |
|---|---|---|---|
dt.entity.kubernetes_cluster | string | resource deprecated Will be replaced by an equivalent dt.smartscape_source attribute.An entity ID of an entity of type KUBERNETES_CLUSTER. Tags: entity-id | KUBERNETES_CLUSTER-E0D8F94D9065F24F |
dt.entity.kubernetes_node | string | resource deprecated Will be replaced by an equivalent dt.smartscape_source attribute.An entity ID of an entity of type KUBERNETES_NODE. Tags: entity-id | KUBERNETES_NODE-874C66B68CE15070 |
dt.security_context | string | resource stable The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: permission | BILLING_USAGE_EVENT |
dt.smartscape_source.id | smartscapeId | resource experimental The ID of the entity considered the source of the signal. The string represents an entity ID of an entity that is stored in the Smartscape storage. 1 Tags: smartscape-id | K8S_CLUSTER-E0D8F94D9065F24F; AWS_LAMBDA_FUNCTION-E0D8F94D9065F24F |
dt.smartscape_source.type | string | resource stable The entity type of the entity whose identifier is held in dt.smartscape_source.id. | K8S_CLUSTER; AWS_LAMBDA_FUNCTION |
event.id | string | stable Unique identifier string of an event; is stable across multiple refreshes and updates. | 5547782627070661074_1647601320000 |
event.kind | string | stable Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: permission | BILLING_USAGE_EVENT |
event.provider | string | stable Source of the event, for example, the name of the component or system that generated the event. Tags: permission | LIMA_USAGE_STREAM |
event.type | string | stable The unique type identifier of a given event. Tags: permission | Security Posture Management |
event.version | string | stable Describes the version of the event. | 1.0.0 |
k8s.cluster.name | string | resource stable The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: permission primary-field | unguard-dev; acme-prod10 |
timestamp | timestamp | stable The time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. | 1649822520123123123 |
The value of this field will be based on the value of one of the dt.smartscape.<type> fields. That means that the dt.smartscape_source.id and dt.smartscape.<type> fields will both be set to the same ID.
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Security Posture Management |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for Third-Party Synthetic API Ingestion. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Third-Party Synthetic API Ingestion" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Third-Party Synthetic API Ingestion"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | experimentalThe number of synthetic test results pushed into Dynatrace with Synthetic 3rd party API. This is the billable unit related to the rate card of this capability. |
|
| string | resource stableAn entity ID of an entity of type EXTERNAL_SYNTHETIC_TEST.Tags: |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Third-Party Synthetic API Ingestion |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing a billing usage event for ingest and process of traces. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events for the "Traces - Ingest & Process" capability.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Traces - Ingest & Process"| dedup event.id
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | resource stableCan be used to assign usage to a Cost Center. |
|
| string | resource stableCan be used to assign usage to a Product or Application ID. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| long | experimentalThe size in bytes of ingested spans. |
|
| long | experimentalThe number of ingested spans. |
|
| string | experimentalThe origin/type of the ingested spans. |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
| string | stableA Dynatrace Grail usage event bucket name. |
|
| timestamp | stableEnd time of the usage timeframe (exclusive). |
|
| timestamp | stableStart time of the usage timeframe (inclusive). |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Client Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Traces - Ingest & Process |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
licensing_type MUST be one of the following:
| Value | Description |
|---|---|
| The |
| The |
| The |
| The |
Model describing a billing usage event of a traces query execution. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Traces - Query"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| string | stableIndicates if the query was executed to fetch records or to delete them. |
|
| long | stableThe number of bytes that will be billed. |
|
| string | stableA Dynatrace app ID. |
|
| string | stableName of the function that executed the query. |
|
| string | stableDynatrace application that executed the query. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| string | stableThe UUID identifying a particular query. |
|
| long | stableQuery start time. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableEmail of the user. |
|
| string | stableUnique UUID of a human user. If the system itself has to be represented, the constant 'system' is used. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Tracker Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Traces Query Execution |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
Model describing the billing usage event for retention of events per Grail bucket. Billing usage events are stored in the dt.system.events table.
Analyze billing usage events.
fetch dt.system.events| filter event.kind == "BILLING_USAGE_EVENT" and event.type == "Traces - Retain"
| Attribute | Type | Description | Examples |
|---|---|---|---|
| long | stableThe number of bytes that will be billed. |
|
| string | resource stableThe security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission modelTags: |
|
| string | stableUnique identifier string of an event; is stable across multiple refreshes and updates. |
|
| string | stableGives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event.Tags: |
|
| string | stableSource of the event, for example, the name of the component or system that generated the event.Tags: |
|
| string | stableThe unique type identifier of a given event.Tags: |
|
| string | stableDescribes the version of the event. |
|
| timestamp | stableThe time (UNIX Epoch time in nanoseconds) when the event originated, typically when the source created it. If no original timestamp is available, it will be populated at ingest time and required for all events. In the case of a correlated event (for example, ITIL events), this time could be different from the event.start time, as this time represents the actual timestamp when the "update" for the event was created. |
|
| string | stableA Dynatrace Grail usage span bucket name. |
|
event.kind MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |
event.provider MUST be one of the following:
| Value | Description |
|---|---|
| LIMA Usage Stream Service |
event.type MUST be one of the following:
| Value | Description |
|---|---|
| Traces Retain |
dt.security_context MUST be one of the following:
| Value | Description |
|---|---|
| Billing usage event |