dynatrace-dql-kb: Instructions file for GitHub Copilot

DQL Query Syntax Instructions

When writing or editing DQL queries, use ONLY the syntax documented here.

Query Structure

DQL queries are pipe-based. A starting command feeds into pipe commands:

<starting_command>
| <pipe_command>
| <pipe_command>
| ...

Starting Commands (no pipe before these)

• fetch <source> — logs, events, bizevents, spans, dt.davis.problems (problems, a.k.a. issues or alerts), dt.entity.*, dt.system.data_objects
• timeseries <aggregation>(metricKey) — metric time series data
• metrics — list available metric keys
• data record(...) — inline test data
• load <resource> — load lookup table data
• describe <source> — show schema
• smartscapeNodes <type> — load topology nodes (smartscapeNodes HOST, smartscapeNodes "*")
• smartscapeEdges <type> — load topology edges (smartscapeEdges calls, smartscapeEdges "*")

Pipe Commands

• filter <condition> — keep matching records
• filterOut <condition> — remove matching records
• search "text" — case-insensitive text search (after fetch only)
• fields <field1>, <field2> — keep only these fields (can create new computed fields)
• fieldsAdd <name> = <expression> — add/replace a field
• fieldsKeep <field1>, <field2> — keep existing fields only (won't create new ones)
• fieldsRemove <field> — drop a field
• fieldsRename <new> = <old> — rename a field
• fieldsFlatten <record_field> — flatten nested record into columns
• sort <field> asc|desc — sort records (default asc, place at end for performance)
• limit <n> — cap result count (don't use before aggregation)
• summarize <agg>(), by:{<field>} — group and aggregate
• dedup <field> — deduplicate (keep first occurrence)
• parse <field>, "<DPL_pattern>" — extract fields using Dynatrace Pattern Language
• expand <array_field> — explode array into rows
• lookup [<subquery>], sourceField:<f>, lookupField:<f> — enrich (first match only)
• join [<subquery>], on:{<field>}, fields:{<field>} — join with subquery
• append [<subquery>] — union results from subquery
• joinNested [<subquery>], on:{<field>} — join as nested array of records
• makeTimeseries <agg>(), interval:<duration> — chart non-metric data over time
• fieldsSummary <field> — field cardinality stats