dynatrace - dql with sql tracing examples
This is taken from Dynatrace playground notebook here which is quite good.
https://wkf10640.apps.dynatrace.com/ui/apps/dynatrace.notebooks/notebook/94d1e2b0-0d81-4803-8b5e-5b9614598d86#0db54f82-0594-4d04-a396-0fcb505d43c2
Get the most often used SQL statements
fetch spans
| filter isNotNull(db.query.text)
| parse db.query.text, "string:type"
| makeTimeseries count(), by:{upper(type)}
Get SQL with highest execution time
fetch spans
| filter isNotNull(db.query.text)
| summarize {minDuration = min(duration), avgDuration = avg(duration), maxDuration = max(duration)}, by:{db.query.text}
| fieldsAdd diffAvgMax = maxDuration - avgDuration
DQL tracing by exceptions
fetch spans
| filter iAny(span.events[][span_event.name] == "exception")
| expand span.events
| fieldsFlatten span.events, fields: {exception.type, exception.message}
| summarize count(), by: {service.name, exception.message}
Using time bin and time stamp filtering
fetch logs
| filter contains(dt.process_group.detected_name, "org.infinispan.server.loader.Loader infinispan-*") and status == "ERROR"
| filter timestamp >= toTimestamp("2025-12-10T01:00:00") and timestamp <= toTimestamp("2025-12-10T03:00:00")
| summarize count()
Joining span and logs together
fetch spans
| join [
fetch logs
| fieldsAdd trace.id = toUid(trace_id)
| summarize logCount=count(), by:{trace.id}
], on: {trace.id}
| filter isNotNull(http.url)
| summarize {requestCount = count(), logCount = sum(right.logCount)}, by:{http.url}
| fieldsAdd logPerRequest = logCount / requestCount
| sort logPerRequest desc
Nested Join example
fetch spans
| limit 10
| joinNested logs = [ fetch logs | fields timestamp, status, content, trace.id=toUid(trace_id)],
on:trace_id, executionOrder:leftFirst
Nested Join example with additional filters
| limit 10
| joinNested logs = [ fetch logs | filter contains(xxx, "") | fields timestamp, status, content, trace.id=toUid(trace_id)],
on:trace_id, executionOrder:leftFirst
Comments