Lab #1

Common Commands
Practice DQL Basics - Labs
CONTENTS
1. Introduction .......................................................................................................................................... 3
2. Command: Fetch ................................................................................................................................... 3
⚙ 2.1 Lab – Fetch logs for a Specified Timeframe ........................................................................................................... 4
2.2 Additional Practice ............................................................................................................................................................ 4
3. Chaining Commands ............................................................................................................................. 5
⚙ 3.1 Lab – Chain Commands – Fetch and Sort ................................................................................................................5
3.2 Additional Practice ............................................................................................................................................................ 6
4. Command: Filter ................................................................................................................................... 7
⚙ 4.1 Lab – Filter ....................................................................................................................................................................... 7
4.2 Additional Practice............................................................................................................................................................ 8
5. Command: Limit .................................................................................................................................. 8
⚙ 5.1 Lab – Limit ...................................................................................................................................................................... 9
5.2 Additional Practice ............................................................................................................................................................ 9

2
1. Introduction
This lab introduces you to building query strings using Dynatrace Query Language. Within this lab you will use
the following commands:
• Fetch
• Sort
• Filter
• Limit

2. Command: Fetch
The DQL fetch command defines which data to load from Dynatrace. The fetch command requires a reference
to the kind of data that should be retrieved by the initial processing pipeline. This is called a resource.

The fetch command should be associated with a

Resource Type, typically logs or business events.

By running the example query, fetch logs, Dynatrace will return all log records stored based on the global
timeframe specified within your environment.

A parameter is a named control offered by the user interface. Parameters can be added to a query to focus
your search. Here’s an example of a timeframe parameter. Based on this query, Dynatrace will query logs from
the last two hours.

3
Resources

� 🎥🎥 DQL Query Structure

How to use DQL Queries

⚙ 2.1 Lab – Fetch Logs for a Specified Timeframe

DQL statements allow you to override the UI selection by using the from or to parameter to specify your
intended time range. The goal of this lab is to use DQL to retrieve logs from the last 24 hours, excluding the
last two hours.

1. Navigate to Logs and Events.

2. Enter the following query: fetch logs, from:now() - 24h, to:now() - 2h
3. Run query.
The results will look something like this:

What do you think?

• What do you notice about the data?
• How is the data structured?
• Is it useful to query data this way? Why or why not?
• Is the data sorted?

2.2 Additional Practice

You can also use absolute time ranges with the timeframe parameter. For additional practice. Try out the
following query in your environment:
fetch logs, timeframe:"2023-03-01T00:00:00Z/2023-03-02T12:00:00Z"
• What data is returned?
• Which time range search works best for your use?

4
3. Chaining Commands
After each operation, DQL returns a table or collection of tables containing data. To make the most of each
query statement we can add additional commands. To do this, use the operator | called a pipe.

The pipe operator funnels the records from the first table
into the next operator, where they will be further processed
or manipulated based on the next command used. Pipes
allow you to chain commands until the final, intended result
is achieved.

Because the channeling of information from one operator to

another is sequential, the query operator order is important
and can have an affect both on results and performance.

⚙ 3.1 Lab – Chain Commands – Fetch and Sort

By default, Dynatrace sorts records into an ascending format. The goal of this lab is to use commands to fetch
logs from a specific time frame and sort them into descending order.
1. Navigate to Logs and Events.
2. Enter the following query: fetch logs, from:now() - 24h, to:now() - 2h
3. On the next line, enter the following query: | sort timestamp, direction:"descending"
4. Run query.
The results will look something like this:

5
3.2 Additional Practice

Did you know that you can adjust

your query for up to 365 days?

Timeframes can also be adjusted by

filtering Dynatrace data using the
global timeframe selector.

You can also adjust your query down to the nanosecond. This example shows logs for a one-minute interval:
fetch logs, from:now() -1m

6
4. Command: Filter
The filter command allows you to narrow down the requested record using Boolean expressions. You will use
additional operators with filters to include or exclude specific values.

For example, you can filter based on content.

Resources

�
Here are some useful hints:
• Command: filterOut
• Function: isNull
• Function: if
• Function: concat

⚙ 4.1 Lab – Filter

The goal of this lab is to use the filter command to adjust your records based on log level.
1. Navigate to Logs and Events
2. Enter the following query: fetch logs
3. On the next line, enter the following query: | filter loglevel ==”INFO”
4. Run query.

7
 The results will look something like this:

4.2 Additional Practice

Here’s another example for practice:
fetch logs
| filter contains(content, “RPCMessageReceiver”)

• What records were returned?

• How did adding the filter adjust the results?
• What other filters are available for use?

5. Command: Limit
The Limit command allows you to indicate the number of
records that should be returned by your query. This is useful
when there are a large number of records that satisfy the query
conditions.

Here is an example. If we use the query fetch logs, Dynatrace

will provide all log records executed within the global
timeframe indicated. Including a limit of three: | limit 3 on
the number of records returned, adjusts the results to the last
three log records returned during the global timeframe
indicated.

8
⚙ 5.1 Lab – Limit
The goal of this lab is to use the filter command to limit the number of records returned.
1. Navigate to Logs and Events
2. Enter the following query: fetch logs
3. On the next line, enter the following query: | limit 10
4. Run query.
The results will look something like this:

5.2 Additional Practice

The limit command can be used in combination with other commands. Here is a query that uses each command
within this lab guide:
fetch logs,timeframe:"2023-03-01T00:00:00Z/2023-03-02T12:00:00Z"
| filter loglevel =="INFO"
| sort timestamp, direction:"descending"
| limit 3

• What data is returned?

• What is the benefit of chaining commands?
• How does limiting help to simplify the records viewed?