{"id":"1f1180fe-8836-47b6-89a9-0301da9b58f8","shortId":"rChkrW","kind":"skill","title":"dt-dql-essentials","tagline":">-","description":"# DQL Essentials Skill\n\nDQL is a pipeline-based query language. Queries chain commands with `|` to filter, transform, and aggregate data. DQL has unique syntax that differs from SQL — load this skill before writing any DQL query.\n\n______________________________________________________________________\n\n## When to Load References\n\nBefore working on specific tasks, load the relevant reference:\n\n| Task                                                                          | Required Reading                                                                             |\n| ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |\n| Field names, namespaces, data models, stability levels, query patterns        | [references/semantic-dictionary.md](references/semantic-dictionary.md)                       |\n| Query optimization (filter early, time ranges, field selection, performance)  | [references/optimization.md](references/optimization.md)                                     |\n| Smartscape topology navigation for discovering relationships between entities | [references/smartscape-topology-navigation.md](references/smartscape-topology-navigation.md) |\n| `summarize` and `makeTimeseries` patterns (bucketing, calendar months)        | [references/summarization.md](references/summarization.md)                                   |\n| Array and timeseries manipulation (`arrayFilter`, `collectArray`, iterative)  | [references/iterative-expressions.md](references/iterative-expressions.md)                   |\n| Conditional logic (`if/else` chains), `coalesce`, string/date helpers         | [references/useful-expressions.md](references/useful-expressions.md)                         |\n| `in` operator (subquery), full `@` time alignment unit table                  | [references/operators.md](references/operators.md)                                           |\n\n______________________________________________________________________\n\n## DQL Reference Index\n\nUse this index to route from a function group (e.g. time functions, conversions) to its detailed spec, or from a function name to its spec file.\n\n| Description | Items |\n|-------------|-------|\n| [Data Types](references/dql/dql-data-types.md) | `array`, `binary`, `boolean`, `double`, `duration`, `long`, `record`, `string`, `timeframe`, `timestamp`, `uid` |\n| [Parameter Value Types](references/dql/dql-parameter-value-types.md) | `bucket`, `dataObject`, `dplPattern`, `entityAttribute`, `entitySelector`, `entityType`, `enum`, `executionBlock`, `expressionTimeseriesAggregation`, `expressionWithConstantValue`, `expressionWithFieldAccess`, `fieldPattern`, `filePattern`, `identifierForAnyField`, `identifierForEdgeType`, `identifierForFieldOnRootLevel`, `identifierForNodeType`, `joinCondition`, `jsonPath`, `metricKey`, `metricTimeseriesAggregation`, `namelessDplPattern`, `nonEmptyExecutionBlock`, `prefix`, `primitiveValue`, `simpleIdentifier`, `tabularFileExisting`, `tabularFileNew`, `url` |\n| [Commands](references/dql/dql-commands.md) | `append`, `data`, `dedup`, `describe`, `expand`, `fetch`, `fields`, `fieldsAdd`, `fieldsFlatten`, `fieldsKeep`, `fieldsRemove`, `fieldsRename`, `fieldsSnapshot`, `fieldsSummary`, `filter`, `filterOut`, `join`, `joinNested`, `limit`, `load`, `lookup`, `makeTimeseries`, `metrics`, `parse`, `search`, `smartscapeEdges`, `smartscapeNodes`, `sort`, `summarize`, `timeseries`, `traverse` |\n| [Functions — Aggregation](references/dql/dql-functions-aggregation.md) | `avg`, `collectArray`, `collectDistinct`, `correlation`, `count`, `countDistinct`, `countDistinctApprox`, `countDistinctExact`, `countIf`, `max`, `median`, `min`, `percentRank`, `percentile`, `percentileFromSamples`, `percentiles`, `stddev`, `sum`, `takeAny`, `takeFirst`, `takeLast`, `takeMax`, `takeMin`, `variance` |\n| [Functions — Array](references/dql/dql-functions-array.md) | `arrayAvg`, `arrayConcat`, `arrayCumulativeSum`, `arrayDelta`, `arrayDiff`, `arrayDistinct`, `arrayFirst`, `arrayFlatten`, `arrayIndexOf`, `arrayLast`, `arrayLastIndexOf`, `arrayMax`, `arrayMedian`, `arrayMin`, `arrayMovingAvg`, `arrayMovingMax`, `arrayMovingMin`, `arrayMovingSum`, `arrayPercentile`, `arrayRemoveNulls`, `arrayReverse`, `arraySize`, `arraySlice`, `arraySort`, `arraySum`, `arrayToString`, `vectorCosineDistance`, `vectorInnerProductDistance`, `vectorL1Distance`, `vectorL2Distance` |\n| [Functions — Bitwise](references/dql/dql-functions-bitwise.md) | `bitwiseAnd`, `bitwiseCountOnes`, `bitwiseNot`, `bitwiseOr`, `bitwiseShiftLeft`, `bitwiseShiftRight`, `bitwiseXor` |\n| [Functions — Boolean](references/dql/dql-functions-boolean.md) | `exists`, `in`, `isFalseOrNull`, `isNotNull`, `isNull`, `isTrueOrNull`, `isUid128`, `isUid64`, `isUuid` |\n| [Functions — Cast](references/dql/dql-functions-cast.md) | `asArray`, `asBinary`, `asBoolean`, `asDouble`, `asDuration`, `asIp`, `asLong`, `asNumber`, `asRecord`, `asSmartscapeId`, `asString`, `asTimeframe`, `asTimestamp`, `asUid` |\n| [Functions — Constant](references/dql/dql-functions-constant.md) | `e`, `pi` |\n| [Functions — Conversion](references/dql/dql-functions-conversion.md) | `toArray`, `toBoolean`, `toDouble`, `toDuration`, `toIp`, `toLong`, `toSmartscapeId`, `toString`, `toTimeframe`, `toTimestamp`, `toUid`, `toVariant` |\n| [Functions — Create](references/dql/dql-functions-create.md) | `array`, `duration`, `ip`, `record`, `smartscapeId`, `timeframe`, `timestamp`, `timestampFromUnixMillis`, `timestampFromUnixNanos`, `timestampFromUnixSeconds`, `uid128`, `uid64`, `uuid` |\n| [Functions — Cryptographic](references/dql/dql-functions-cryptographic.md) | `hashCrc32`, `hashMd5`, `hashSha1`, `hashSha256`, `hashSha512`, `hashXxHash32`, `hashXxHash64` |\n| [Functions — Entities](references/dql/dql-functions-entities.md) | `classicEntitySelector`, `entityAttr`, `entityName` |\n| [Functions — Time series aggregation for expressions](references/dql/dql-functions-expression-timeseries.md) | `avg`, `count`, `countDistinct`, `countDistinctApprox`, `countDistinctExact`, `countIf`, `end`, `max`, `median`, `min`, `percentRank`, `percentile`, `percentileFromSamples`, `start`, `sum` |\n| [Functions — Flow](references/dql/dql-functions-flow.md) | `coalesce`, `if` |\n| [Functions — General](references/dql/dql-functions-general.md) | `jsonField`, `jsonPath`, `lookup`, `parse`, `parseAll`, `type` |\n| [Functions — Get](references/dql/dql-functions-get.md) | `arrayElement`, `getEnd`, `getHighBits`, `getLowBits`, `getStart` |\n| [Functions — Iterative](references/dql/dql-functions-iterative.md) | `iAny`, `iCollectArray`, `iIndex` |\n| [Functions — Mathematical](references/dql/dql-functions-mathematical.md) | `abs`, `acos`, `asin`, `atan`, `atan2`, `bin`, `cbrt`, `ceil`, `cos`, `cosh`, `degreeToRadian`, `exp`, `floor`, `hexStringToNumber`, `hypotenuse`, `log`, `log10`, `log1p`, `numberToHexString`, `power`, `radianToDegree`, `random`, `range`, `round`, `signum`, `sin`, `sinh`, `sqrt`, `tan`, `tanh` |\n| [Functions — Network](references/dql/dql-functions-network.md) | `ipIn`, `ipIsLinkLocal`, `ipIsLoopback`, `ipIsPrivate`, `ipIsPublic`, `ipMask`, `isIp`, `isIpV4`, `isIpV6` |\n| [Functions — Smartscape](references/dql/dql-functions-smartscape.md) | `getNodeField`, `getNodeName` |\n| [Functions — String](references/dql/dql-functions-string.md) | `concat`, `contains`, `decodeBase16ToBinary`, `decodeBase16ToString`, `decodeBase64ToBinary`, `decodeBase64ToString`, `decodeUrl`, `encodeBase16`, `encodeBase64`, `encodeUrl`, `endsWith`, `escape`, `getCharacter`, `indexOf`, `lastIndexOf`, `levenshteinDistance`, `like`, `lower`, `matchesPattern`, `matchesPhrase`, `matchesRegex`, `matchesValue`, `punctuation`, `replacePattern`, `replaceString`, `splitByPattern`, `splitString`, `startsWith`, `stringLength`, `substring`, `trim`, `unescape`, `unescapeHtml`, `upper` |\n| [Functions — Time](references/dql/dql-functions-time.md) | `formatTimestamp`, `getDayOfMonth`, `getDayOfWeek`, `getDayOfYear`, `getHour`, `getMinute`, `getMonth`, `getSecond`, `getWeekOfYear`, `getYear`, `now`, `unixMillisFromTimestamp`, `unixNanosFromTimestamp`, `unixSecondsFromTimestamp` |\n| [Functions — Time series aggregation for metrics](references/dql/dql-functions-timeseries.md) | `avg`, `count`, `countDistinct`, `end`, `max`, `median`, `min`, `percentRank`, `percentile`, `start`, `sum` |\n\n______________________________________________________________________\n\n## Syntax Pitfalls\n\n| ❌ Wrong | ✅ Right | Issue |\n| --- | --- | --- |\n| `filter field in [\"a\", \"b\"]` | `filter in(field, {\"a\", \"b\"})` | `[` and `]` wrap sub-queries in DQL but do not wrap **static** array literals. Use `{}` or `array()` for static values. |\n| `filter: { in(field, [sub-query]) }` (e.g. in `timeseries filter:`) | `filter: { field in [sub-query] }` | `in()` does not accept execution blocks as arguments. When the right-hand side is a sub-query (execution block), use the `in` operator: `field in [execution block]`. |\n| `by: severity, status` | `by: {severity, status}` | List of fields must be grouped by curly braces in `by:` clauses (`summarize`, `makeTimeseries`, etc.). |\n| `contains(toLowercase(field), \"err\")` | `contains(field, \"err\", false)` | Don't wrap in `lower()` for case-insensitive matching. `contains()` has a built-in third positional `caseSensitive` parameter (default `true`). |\n| `filter name == \"*serv*9*\"` | `filter matchesValue(name, \"*serv*\") and matchesValue(name, \"*9*\")` | `==` does not support wildcards. `matchesValue()` supports `*` wildcards but only at the beginning and/or end of the pattern—split mid-string wildcard intent into multiple calls combined with `and`. |\n| `matchesValue(field, \"prod\")` on string field | `contains(field, \"prod\")` | Without wildcards, `matchesValue()` performs an exact (case-insensitive) match — it will not find `\"production\"`. Use `contains()` for substring matching (or `matchesValue(field, \"*prod*\")` for wildcard matching). |\n| `toLowercase(field)` | `lower(field)` | The function is `lower()`, not `toLowercase()`. Only type-casting functions use the `to` prefix (`toString()`, `toLong()`, etc.). |\n| `arrayAvg(field[])` or `arraySum(field[])` | `arrayAvg(field)` or `field[]` | `field[]` = element-wise iterative expression (array→array); `arrayAvg(field)` = collapse to scalar (array→single value). Never mix both — `arrayAvg(field[])` is semantically wrong. |\n| `my_field` after `lookup` or `join` | `lookup.my_field` / `right.my_field` | `lookup` prefixes added fields with `lookup.` by default (configurable via `prefix:`). `join` prefixes right-side fields with `right.`. |\n| `substring(field, 0, 200)` | `substring(field, from: 0, to: 200)` | The first parameter (expression) is positional, but `from:` and `to:` are named optional parameters and must include their names. |\n| `filter host = \"A\"` | `filter host == \"A\"` | DQL uses `==` for equality comparison, not `=`. Single `=` is assignment (e.g., in `fieldsAdd`, summarize aliases). |\n| `fetch logs, from: toTimestamp('2026-01-01')` | `fetch logs, from: -24h` | `from:` / `to:` accept duration literals (e.g., `-24h`, `-7d`) or `now()` expressions — not `toTimestamp()`. For absolute ranges use `timeframe: \"start/end\"` (ISO 8601). |\n| `filter log.level == \"ERROR\"` | `filter loglevel == \"ERROR\"` | Log severity field is `loglevel` (no dot) — `log.level` does not exist. |\n| `sort count() desc` | `` sort `count()` desc `` | Fields with special characters (like parentheses) must be wrapped in backticks. |\n| `length(field)` | `stringLength(field)` | DQL string length function is `stringLength` — there is no `length()`. |\n| `metrics dt.host.cpu.usage` | `timeseries avg(dt.host.cpu.usage)` | `metrics` loads metric metadata, not values — use `timeseries` for data. |\n| `join [...], on:{left.a.b == right.a.b}` | `` join [...], on:{left[`a.b`] == right[`a.b`]} `` | Dotted field names in join/lookup conditions require bracket notation with backticks. |\n| `fieldsSummary` (no arguments) | `fieldsSummary field1, field2` | `fieldsSummary` requires at least one field parameter. |\n| `timeseries` with `percentile`/`median`/`percentRank` — no results | Add `rollup: avg` (or `min`/`max`/`sum`) to the `timeseries` command | These three functions **require `rollup:`** on gauge/count metrics — without it the query silently returns empty. |\n| `` lookup [...], fields: {`dotted.name`} `` | `lookup [...], fields: {dotted.name}` | Do not backtick field names inside the `fields:` parameter of `lookup` — causes PARSE_ERROR. |\n| `data record(key: \"val\")` | `data record(key = \"val\")` | `record()` uses `=` for named fields, not `:` — `:` is for command parameters like `rollup:`. |\n| `getNodeField(dt.smartscape.host, \"tags\")[\"tag.key\"]` | `getNodeField(dt.smartscape.host, \"tags\")[tag.key]` | In this tag-map access pattern, bracket keys must use unquoted identifier syntax; quoted keys cause a parse error. |\n| `by: {dt.entity.host}` or `dt.entity.*` | `by: {dt.smartscape.host}` or `dt.smartscape.*` | `dt.entity.*` is **deprecated** — always use `dt.smartscape.*` in new queries. |\n\n______________________________________________________________________\n\n## Fetch Command → Data Model\n\nDQL queries start with `fetch <data_object>` or `timeseries`. There is **no `fetch dt.metric`** — metrics use `timeseries`.\n\n| Fetch Command | Data Model | Key Fields / Notes |\n|---------------|------------|--------------------|\n| `fetch spans` | Distributed tracing | `span.*`, `service.*`, `http.*`, `db.*`, `code.*`, `exception.*` |\n| `fetch logs` | Log events | `log.*`, `k8s.*`, `host.*` — message body is `content`, severity is `loglevel` (NOT `log.level`) |\n| `fetch events` | DAVIS / infra events | `event.*`, `dt.smartscape.*` |\n| `fetch bizevents` | Business events | `event.*`, custom fields |\n| `fetch security.events` | Security events | `vulnerability.*`, `event.*` |\n| `fetch user.sessions` | RUM sessions | `dt.rum.*`, `browser.*`, `geo.*` |\n| `fetch user.events` | RUM individual events | page views, clicks, requests, errors |\n| `fetch user.replays` | Session replay recordings | |\n| `fetch application.snapshots` | Application snapshots | |\n| `fetch dt.davis.events` | Davis-detected events | |\n| `fetch dt.davis.problems` | Davis-detected problems | |\n| `timeseries avg(metric.key)` | Metrics | NOT `fetch` — hyphenated keys need backticks: `` timeseries sum(`my.metric-name`) `` |\n| `smartscapeNodes \"HOST\"` | Topology | NOT `fetch` — types: `HOST`, `SERVICE`, `K8S_CLUSTER`, etc. |\n\n`dt.entity.*` is deprecated — use `dt.smartscape.*` and `smartscapeNodes` for new queries.\n\nDiscover all available data objects: `fetch dt.system.data_objects | fields name, display_name, type`\n\n→ [references/semantic-dictionary.md](references/semantic-dictionary.md) for full field namespaces\n\n______________________________________________________________________\n\n## `samplingRatio` Parameter\n\n`fetch` supports a `samplingRatio:` parameter to reduce the volume of data read — useful for improving query performance on large datasets.\n\n```dql\nfetch spans, samplingRatio:100   // reads ~1% of data\n```\n\n**Allowed values:** depend on the concrete data object and range from `1`, `10`, `100`, `1000`, `10000` to `100000`, the highest level only available for `logs` and `spans`.\n\n\nSampling is **hierarchical** for `spans`, `user.events` and `user.sessions`: a record included at a higher ratio (e.g. `100`) is guaranteed to also appear at lower ratios (e.g. `10`, `1`), but not vice versa. This means results at different ratios are  subsets of each other. All other non-metric data objects are sampled independently per record, so results at different ratios are not subsets.\n\nThe actual ratio applied is accessible via the `dt.system.sampling_ratio` field. Use it to extrapolate sampled counts back to true totals:\n\n```dql\nfetch logs, samplingRatio:10\n| summarize count_extrapolated = sum(dt.system.sampling_ratio)\n```\n\n______________________________________________________________________\n\n## Metric Discovery\n\nTo search for available metrics by keyword, use the command `metrics`:\n\n```dql\nmetrics from: now() - 1h\n| filter contains(metric.key, \"replay\")\n| summarize count(), by: {metric.key}\n| sort `count()` desc\n```\n\nThere is **no `fetch dt.metric`** or `fetch dt.metrics` or `fetch dt.system.metrics` — those data objects do not exist.\n\n______________________________________________________________________\n\n## Timeseries Aggregation Functions\n\nThe `timeseries` command supports only these aggregation functions:\n\n| Function | Description |\n|----------|-------------|\n| `sum` | Sum of metric data points per time slot |\n| `avg` | Average of metric data points per time slot |\n| `min` | Minimum of metric data points per time slot |\n| `max` | Maximum of metric data points per time slot |\n| `count` | Count of metric data points per time slot |\n| `percentile(metric, N)` | Nth percentile per time slot. **Requires `rollup:`** — see below. |\n| `median(metric)` | 50th percentile per time slot (= `percentile(metric, 50)`). **Requires `rollup:`**. |\n| `percentRank(metric, value)` | Percentile rank of a value per time slot. **Requires `rollup:`**. |\n| `countDistinct(metric)` | Approximate distinct count per time slot (cardinality metrics only; does NOT accept `rollup:`). |\n\nHelpers (use alongside an aggregation): `start()`, `end()`.\n\n**Not supported by `timeseries`:** `countIf`, `collectArray`, `stddev`, `variance`, `takeAny`, `takeFirst`, `takeLast` — use `summarize` or `makeTimeseries`.\n\n### The `rollup:` parameter\n\nMetrics are pre-aggregated at ingest time. `rollup:` controls how raw data points are combined per time slot. Required for `percentile`, `median`, `percentRank` — without it the query silently returns no results. `avg`/`min`/`max`/`sum`/`count` work without `rollup:`.\n\nSingle aggregation — `rollup:` at command level. Multiple aggregations in `{}` — `rollup:` must go **inside each function call** (command-level `rollup:` causes `UNKNOWN_PARAMETER_DEFINED`):\n\n```dql\ntimeseries p90 = percentile(dt.process.handles.file_descriptors_percent_used, 90), rollup: avg\n```\n\n```dql\ntimeseries {\n  p90 = percentile(dt.process.handles.file_descriptors_percent_used, 90, rollup: avg),\n  med = median(dt.process.handles.file_descriptors_percent_used, rollup: avg),\n  avg_val = avg(dt.process.handles.file_descriptors_percent_used)\n}, by: {dt.smartscape.host}\n```\n\nValues: `avg` (gauges), `min`, `max`, `sum` (counters), `total`.\n\n### Timeseries-to-scalar conversion\n\nThere are two ways to collapse a timeseries to a scalar. Prefer the `scalar:true` parameter when you only need the single aggregated value — it is more efficient because no array is materialized. Fall back to array functions when you need both the full series and a derived scalar in the same query.\n\n**Preferred: `scalar:true` on the aggregation function**\n\nPass `scalar:true` to any timeseries aggregation function. The result field contains a single value instead of an array, and no intermediate array is allocated:\n\n```dql\ntimeseries avg_cpu = avg(dt.host.cpu.usage, scalar:true), by:{dt.smartscape.host}\n```\n\n```dql\ntimeseries {\n  avg_cpu = avg(dt.host.cpu.usage, scalar:true),\n  max_cpu = max(dt.host.cpu.usage, scalar:true)\n}, by:{dt.smartscape.host}\n```\n\n**Fallback: array functions in `fieldsAdd`**\n\nWhen you need the full time series array alongside a derived scalar, use array functions in a subsequent `| fieldsAdd`:\n\n| Function | Description |\n|----------|-------------|\n| `arrayAvg(arr)` | Average of all values in the array |\n| `arraySum(arr)` | Sum of all values |\n| `arrayMin(arr)` | Minimum value |\n| `arrayMax(arr)` | Maximum value |\n| `arrayMedian(arr)` | Median value |\n| `arrayPercentile(arr, N)` | Nth percentile (0–100) |\n| `arrayLast(arr)` | Last non-null value (latest data point) |\n| `arrayFirst(arr)` | First non-null value (earliest data point) |\n\n```dql\ntimeseries cpu = avg(dt.host.cpu.usage), by:{dt.smartscape.host}\n| fieldsAdd avg_cpu = arrayAvg(cpu), max_cpu = arrayMax(cpu)\n```\n\n______________________________________________________________________\n\n## Time Alignment (@-operator)\n\nThe `@` operator aligns timestamps to a boundary — agents often get this wrong.\n\n| Expression   | Meaning                                                     |\n| ------------ | ----------------------------------------------------------- |\n| `now()@h`    | Current time, aligned to the hour boundary                  |\n| `now()@d`    | Midnight today                                              |\n| `now()@w1`   | Monday this week                                            |\n| `now()-2h@h` | 2 hours ago, aligned to the hour (offset first, then align) |\n\n**Rules:**\n\n- Order: offset before alignment — `now()-2h@h`, not `now()@h-2h`\n- No space between `@` and the unit — `now()@h` not `now() @h`\n- `m` = minutes, `M` = months — do not confuse them\n\n→ [references/dql/dql-functions-timeseries.md](references/dql/dql-functions-timeseries.md) for the full list of `timeseries` aggregations and `rollup:` rules\n→ [references/dql/dql-functions-array.md](references/dql/dql-functions-array.md) for `arrayAvg` / `arrayMax` / `arrayPercentile` / … spec\n\n______________________________________________________________________\n\n## Entity & Smartscape Patterns\n\nEntity fields are scoped per type — `entity.id` does not exist. Use `smartscapeNodes` for topology queries.\n\n| Entity      | ID field in data             | `smartscapeNodes` type |\n| ----------- | ---------------------------- | ---------------------- |\n| Host        | `dt.smartscape.host`         | `\"HOST\"`               |\n| Service     | `dt.smartscape.service`      | `\"SERVICE\"`            |\n| Process     | `dt.smartscape.process`      | `\"PROCESS\"`            |\n| K8s cluster | `dt.smartscape.k8s_cluster`  | `\"K8S_CLUSTER\"`        |\n\nUse `toSmartscapeId()` for ID conversion from strings (required!).\n\n→ [references/smartscape-topology-navigation.md](references/smartscape-topology-navigation.md)\n\n______________________________________________________________________\n\n## makeTimeseries Command\n\n`makeTimeseries` builds a time-bucketed series from event data (logs, spans, bizevents). Unlike `timeseries` (which queries pre-ingested metrics), `makeTimeseries` aggregates data in a pipeline.\n\n**Do not pipe `timeseries` directly into `makeTimeseries`** — it fails with `INVALID_IMPLICIT_TIME_DEFAULT`. To re-aggregate metric data, use `start()` + expand (see [references/summarization.md](references/summarization.md)).\n\n```dql\nfetch logs\n| makeTimeseries\n    total = count(),\n    errors = countIf(loglevel == \"ERROR\"),\n    interval: 5m,\n    by: {k8s.cluster.name}\n| fieldsAdd error_rate = errors / total * 100\n```\n\nKey parameters: `interval:`, `by:{}`, `from:`/`to:`, `bins:`, `time:` (timestamp field), `spread:` (for `count`/`countIf` only), `nonempty:`.\n\n→ [references/summarization.md](references/summarization.md) for full `makeTimeseries` patterns and `summarize` bucketing\n→ [references/iterative-expressions.md](references/iterative-expressions.md) for timeseries array manipulation\n\n______________________________________________________________________\n\n## matchesValue() Usage\n\nUse `matchesValue()` for **array fields** such as `dt.tags`:\n\n```dql-snippet\n| filter matchesValue(dt.tags, \"env:production\")\n```\n\n- **Not** for string fields with special characters — use `contains()` for those\n- `matchesValue()` on a scalar string field does not behave like a wildcard or fuzzy match\n\n______________________________________________________________________\n\n## Chained Lookup Pattern\n\n\nEach `lookup` command without a `fields` parameter **removes all existing fields starting with the prefix (default: `lookup.`)** before adding new ones. When chaining multiple lookups, use `fields` parameter or custom prefixes to preserve the result:\n\n**Option 1 (default)**: the desired fields are known.\n```dql\nfetch bizevents\n// Step 1: First lookup — enrich orders with product info\n| lookup [fetch bizevents\n    | filter event.type == \"product_catalog\"\n    | fields product_id, category],\n  sourceField: product_id, lookupField: product_id, fields: {product_id, product_category = category}\n\n// Step 2: Second lookup — specify fields with a different name\n| lookup [fetch bizevents\n    | filter event.type == \"warehouse_stock\"\n    | fields category, warehouse_region],\n  sourceField: product_category, lookupField: category, fields: {warehouse_region, warehouse_category = category}\n\n```\nAll 4 lookup fields product_id, product_category, warehouse_region, and warehouse_category are available.\nWithout the `fields:{...}` parameter, the fields would be prefixed with `lookup.` and the second lookup command would delete the fields added by the first lookup.\n\n**Option 2**: keep all fields from the lookup.\n```dql\nfetch bizevents\n// Step 1: First lookup — enrich orders with product info\n| lookup [fetch bizevents\n    | filter event.type == \"product_catalog\"\n    | fields product_id, category],\n  sourceField: product_id, lookupField: product_id, prefix: \"product.\"\n\n// Step 2: Second lookup — specify fields with a different prefix\n| lookup [fetch bizevents\n    | filter event.type == \"warehouse_stock\"\n    | fields category, warehouse_region],\n  sourceField: product_category, lookupField: category, prefix: \"warehouse.\"\n\n```\nThe new fields are: `product.product_id`, `product.category`, `warehouse.category`, `warehouse.warehouse_region`.\nAll fields starting with `product.` or `warehouse.` are removed from the original source.\nWithout the dedicated `prefix`, both `lookup` commands would use the same prefix (`lookup.`) and the second `lookup` drops the first lookup's results — producing empty fields.\n\n______________________________________________________________________\n\n## makeTimeseries Command\n\n`makeTimeseries` builds a time-bucketed series from event data (logs, spans, bizevents). Unlike `timeseries` (which queries pre-ingested metrics), `makeTimeseries` aggregates data in a pipeline.\n\n**Do not pipe `timeseries` directly into `makeTimeseries`** — it fails with `INVALID_IMPLICIT_TIME_DEFAULT`. To re-aggregate metric data, use `start()` + expand (see [references/summarization.md](references/summarization.md)).\n\n```dql\nfetch logs\n| makeTimeseries\n    {total = count(),\n    errors = countIf(loglevel == \"ERROR\")},\n    interval: 5m,\n    by: {k8s.cluster.name}\n| fieldsAdd error_rate = errors[] * 100.0 / total[]\n```\n\nKey parameters: `interval:`, `by:{}`, `from:`/`to:`, `bins:`, `time:` (timestamp field), `spread:` (for `count`/`countIf` only), `nonempty:`. → [references/dql/dql-commands.md](references/dql/dql-commands.md) for full spec.\n\nEntity existence timeline using `spread:`:\n\n```dql\nsmartscapeNodes \"HOST\"\n| makeTimeseries concurrently_existing_hosts = count(), spread: lifetime\n```\n\n→ [references/iterative-expressions.md](references/iterative-expressions.md) for timeseries array manipulation\n\n______________________________________________________________________\n\n## Timeframe Specification\n\nAccess to data requires specification of a timeframe.\nIt can be specified in the UI, as REST API parameters, or in a DQL query explicitly using a pair of parameters: `from:` and `to:` (if one is omitted it defaults to `now()`), or alternatively using a single `timeframe:` parameter.\nTimeframe can be expressed using absolute values or relative expressions vs. current time. The time alignment operator (`@`) can be used to round timestamps to time unit boundaries — see [references/operators.md](references/operators.md) for full details.\n\n### Examples\n\n```dql-snippet\nfrom:now()-1h@h, to:now()@h     // last complete hour\n```\n```dql-snippet\nfrom:now()-1d@d, to:now()@d     // yesterday complete\n```\n```dql-snippet\nfrom:now()@M                    // this month so far, till now\n```\n```dql-snippet\nfrom:now()-2h@h                 // go back 2 hours, then align to hour boundary\n```\n\nSee [references/operators.md](references/operators.md) for the full `@` alignment-unit table (including `m` vs. `M`, week-day variants `w1`–`w7`, and factor rules like `@3h`).\n\n### Absolute timestamps\n\nUse ISO 8601 format:\n\n```dql-snippet\nfrom:\"2024-01-15T08:00:00Z\", to:\"2024-01-15T09:00:00Z\"\n```\n\n______________________________________________________________________\n\n## Modifying Time\n\n### Key concepts\n\n- DQL has 3 specialized types related to time:\n    - **timestamp** — internally kept as number of nanoseconds since epoch, but exposed as date/time in a particular timezone\n    - **timeframe** — a pair of 2 timestamps (start and end)\n    - **duration** — internally kept as number of nanoseconds, but exposed as duration scaled to a reasonable factor (e.g. ms, minutes, days)\n\n### Rules\n\n- Subtracting timestamps yields a duration: `timestamp - timestamp → duration`\n- Duration divided by duration yields a double: e.g. `2h / 1m` = `120.0`\n- Scalar times duration yields a duration: e.g. `no_of_h * 1h → duration`\n- For extraction of time elements (hours, days of month, etc):\n    - ✅ Use [time functions](references/dql/dql-functions-time.md). They support calendar and time zones properly including DST.\n    - ❌ Avoid using `formatTimestamp` for extracting time components.\n    - ❌ Avoid converting timestamps and durations to double/long and using division, modulo, and constants expressing time units as nanoseconds.\n\n## References\n\n- **[references/useful-expressions.md](references/useful-expressions.md)** — Useful expressions in DQL\n- **[references/semantic-dictionary.md](references/semantic-dictionary.md)** — Dynatrace Semantic Dictionary: field namespaces, data models, stability levels, query patterns, and best practices\n- **[references/summarization.md](references/summarization.md)** — Various applications of summarize and makeTimeseries commands\n- **[references/iterative-expressions.md](references/iterative-expressions.md)** — Array and timeseries manipulation (creation, modifications, use in filters) using DQL\n- **[references/smartscape-topology-navigation.md](references/smartscape-topology-navigation.md)** — Smartscape topology navigation syntax and patterns\n- **[references/optimization.md](references/optimization.md)** — DQL query optimization: filter placement, time ranges, field selection, and performance best practices\n- **[references/operators.md](references/operators.md)** — `in` operator (subquery syntax) and full `@` time alignment unit reference","tags":["dql","essentials","dynatrace","for","agent-skills","ai-agents","claude-code","devops","mcp","observability"],"capabilities":["skill","source-dynatrace","skill-dt-dql-essentials","topic-agent-skills","topic-ai-agents","topic-claude-code","topic-devops","topic-dql","topic-dynatrace","topic-mcp","topic-observability"],"categories":["dynatrace-for-ai"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/Dynatrace/dynatrace-for-ai/dt-dql-essentials","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add Dynatrace/dynatrace-for-ai","source_repo":"https://github.com/Dynatrace/dynatrace-for-ai","install_from":"skills.sh"}},"qualityScore":"0.489","qualityRationale":"deterministic score 0.49 from registry signals: · indexed on github topic:agent-skills · 78 github stars · SKILL.md body (30,395 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:56:47.546Z","embedding":null,"createdAt":"2026-05-11T18:57:13.434Z","updatedAt":"2026-05-18T18:56:47.546Z","lastSeenAt":"2026-05-18T18:56:47.546Z","tsv":"'-01':907,908,2838,2845 '-1':2751,2765 '-15':2839,2846 '-2':2009,2029,2790 '-24':912,920 '-7':922 '0':855,860,1935 '00':2841,2848 '00z':2842,2849 '1':1344,1358,1401,2315,2326,2441 '10':1359,1400,1462 '100':1342,1360,1390,1936,2200 '100.0':2618 '1000':1361 '10000':1362 '100000':1364 '120.0':2927 '1h':1486,2938 '1m':2926 '2':2012,2358,2430,2469,2795,2883 '200':856,862 '2024':2837,2844 '2026':906 '2h':2036,2925 '3':2856 '3h':2826 '4':2390 '50':1594 '50th':1587 '5m':2192,2611 '8601':936,2831 '9':695,703 '90':1722,1733 'a.b':1007,1009 'ab':442 'absolut':930,2717,2827 'accept':615,916,1623 'access':1120,1442,2664 'aco':443 'actual':1438 'ad':836,2297,2424 'add':1041 'agent':1983 'aggreg':24,239,392,546,1516,1524,1629,1654,1691,1697,1788,1824,1832,2064,2150,2172,2569,2591 'ago':2014 'alias':901 'align':122,1974,1978,1994,2015,2022,2027,2727,2798,2809,3065 'alignment-unit':2808 'alloc':1850 'allow':1347 'alongsid':1627,1890 'also':1394 'altern':2706 'alway':1146 'and/or':716 'api':2681 'appear':1395 'append':207 'appli':1440 'applic':1248,3014 'application.snapshots':1247 'approxim':1612 'argument':619,1023 'arr':1904,1913,1919,1923,1927,1931,1938,1948 'array':99,161,266,360,588,592,806,807,813,1796,1802,1844,1848,1878,1889,1895,1911,2230,2237,2660,3022 'arrayavg':268,791,796,808,819,1903,1967,2071 'arrayconcat':269 'arraycumulativesum':270 'arraydelta':271 'arraydiff':272 'arraydistinct':273 'arrayel':428 'arrayfilt':103 'arrayfirst':274,1947 'arrayflatten':275 'arrayindexof':276 'arraylast':277,1937 'arraylastindexof':278 'arraymax':279,1922,1971,2072 'arraymedian':280,1926 'arraymin':281,1918 'arraymovingavg':282 'arraymovingmax':283 'arraymovingmin':284 'arraymovingsum':285 'arraypercentil':286,1930,2073 'arrayremovenul':287 'arrayrevers':288 'arrays':289 'arrayslic':290 'arraysort':291 'arraysum':292,794,1912 'arraytostr':293 'asarray':323 'asbinari':324 'asboolean':325 'asdoubl':326 'asdur':327 'asin':444 'asip':328 'aslong':329 'asnumb':330 'asrecord':331 'assign':896 'assmartscapeid':332 'asstr':333 'astimefram':334 'astimestamp':335 'asuid':336 'atan':445 'atan2':446 'avail':1299,1369,1474,2403 'averag':1538,1905 'avg':241,396,550,988,1043,1263,1537,1682,1724,1735,1743,1744,1746,1754,1853,1855,1863,1865,1960,1965 'avoid':2963,2970 'b':570,575 'back':1454,1800,2794 'backtick':970,1020,1075,1271 'base':13 'begin':715 'behav':2269 'best':3009,3054 'bin':447,2207,2626 'binari':162 'bitwis':299 'bitwiseand':301 'bitwisecounton':302 'bitwisenot':303 'bitwiseor':304 'bitwiseshiftleft':305 'bitwiseshiftright':306 'bitwisexor':307 'bizev':1212,2140,2324,2336,2369,2439,2451,2480,2559 'block':617,632,640 'bodi':1196 'boolean':163,309 'boundari':1982,1998,2738,2801 'brace':655 'bracket':1017,1122 'browser':1229 'bucket':94,176,2133,2225,2552 'build':2129,2548 'built':684 'built-in':683 'busi':1213 'calendar':95,2956 'call':729,1705 'cardin':1618 'case':677,749 'case-insensit':676,748 'casesensit':688 'cast':321,782 'catalog':2340,2455 'categori':2344,2355,2356,2375,2380,2382,2387,2388,2396,2401,2459,2486,2491,2493 'caus':1084,1131,1710 'cbrt':448 'ceil':449 'chain':17,111,2276,2301 'charact':963,2256 'classicentityselector':386 'claus':658 'click':1238 'cluster':1285,2110,2113,2115 'coalesc':112,414 'code':1186 'collaps':810,1771 'collectarray':104,242,1637 'collectdistinct':243 'combin':730,1665 'command':18,205,1051,1103,1153,1172,1480,1520,1694,1707,2127,2281,2419,2525,2546,3019 'command-level':1706 'comparison':892 'complet':2758,2772 'compon':2969 'concat':492 'concept':2853 'concret':1352 'concurr':2650 'condit':108,1015 'configur':842 'confus':2054 'constant':338,2982 'contain':493,662,666,680,739,758,1488,1837,2258 'content':1198 'control':1659 'convers':142,343,1765,2120 'convert':2971 'correl':244 'cos':450 'cosh':451 'count':245,397,551,955,958,1453,1464,1492,1496,1564,1565,1614,1686,2186,2213,2605,2632,2653 'countdistinct':246,398,552,1610 'countdistinctapprox':247,399 'countdistinctexact':248,400 'counter':1759 'countif':249,401,1636,2188,2214,2607,2633 'cpu':1854,1864,1870,1959,1966,1968,1970,1972 'creat':358 'creation':3026 'cryptograph':374 'cur':654 'current':1992,2723 'custom':1216,2308 'd':923,2000,2766,2767,2770 'data':25,61,158,208,999,1087,1091,1154,1173,1300,1328,1346,1353,1422,1510,1532,1541,1550,1559,1568,1662,1945,1955,2097,2137,2151,2174,2556,2570,2593,2666,3002 'dataobject':177 'dataset':1337 'date/time':2874 'davi':1206,1253,1259 'davis-detect':1252,1258 'day':2818,2907,2946 'db':1185 'decodebase16tobinary':494 'decodebase16tostring':495 'decodebase64tobinary':496 'decodebase64tostring':497 'decodeurl':498 'dedic':2521 'dedup':209 'default':690,841,2168,2294,2316,2587,2702 'defin':1713 'degreetoradian':452 'delet':2421 'depend':1349 'deprec':1145,1289 'deriv':1813,1892 'desc':956,959,1497 'describ':210 'descript':156,1527,1902 'descriptor':1719,1730,1739,1748 'desir':2318 'detail':145,2744 'detect':1254,1260 'dictionari':2999 'differ':31,1410,1432,2365,2476 'direct':2159,2578 'discov':84,1297 'discoveri':1470 'display':1307 'distinct':1613 'distribut':1180 'divid':2918 'divis':2979 'dot':949,1010 'dotted.name':1069,1072 'doubl':164,2923 'double/long':2976 'dplpattern':178 'dql':3,5,8,26,40,127,582,888,975,1156,1338,1458,1482,1714,1725,1851,1861,1957,2181,2243,2322,2437,2600,2646,2686,2747,2761,2774,2786,2834,2854,2994,3032,3043 'dql-snippet':2242,2746,2760,2773,2785,2833 'drop':2536 'dst':2962 'dt':2 'dt-dql-essenti':1 'dt.davis.events':1251 'dt.davis.problems':1257 'dt.entity':1138,1143,1287 'dt.entity.host':1136 'dt.host.cpu.usage':986,989,1856,1866,1872,1961 'dt.metric':1167,1502 'dt.metrics':1505 'dt.process.handles.file':1718,1729,1738,1747 'dt.rum':1228 'dt.smartscape':1142,1148,1210,1291,2111 'dt.smartscape.host':1108,1112,1140,1752,1860,1876,1963,2101 'dt.smartscape.process':2107 'dt.smartscape.service':2104 'dt.system.data':1303 'dt.system.metrics':1508 'dt.system.sampling':1445,1467 'dt.tags':2241,2247 'durat':165,361,917,2888,2898,2913,2916,2917,2920,2930,2933,2939,2974 'dynatrac':2997 'e':340 'e.g':139,602,897,919,1389,1399,2904,2924,2934 'earli':72 'earliest':1954 'effici':1793 'element':802,2944 'element-wis':801 'empti':1066,2543 'encodebase16':499 'encodebase64':500 'encodeurl':501 'end':402,553,717,1631,2887 'endswith':502 'enrich':2329,2444 'entiti':87,384,2075,2078,2093,2641 'entity.id':2084 'entityattr':387 'entityattribut':179 'entitynam':388 'entityselector':180 'entitytyp':181 'enum':182 'env':2248 'epoch':2870 'equal':891 'err':665,668 'error':939,942,1086,1134,1240,2187,2190,2196,2198,2606,2609,2615,2617 'escap':503 'essenti':4,6 'etc':661,790,1286,2949 'event':1191,1205,1208,1209,1214,1215,1221,1223,1235,1255,2136,2555 'event.type':2338,2371,2453,2482 'exact':747 'exampl':2745 'except':1187 'execut':616,631,639 'executionblock':183 'exist':311,953,1514,2087,2288,2642,2651 'exp':453 'expand':211,2177,2596 'explicit':2688 'expos':2872,2896 'express':394,805,866,926,1988,2715,2721,2983,2992 'expressiontimeseriesaggreg':184 'expressionwithconstantvalu':185 'expressionwithfieldaccess':186 'extract':2941,2967 'extrapol':1451,1465 'factor':2823,2903 'fail':2163,2582 'fall':1799 'fallback':1877 'fals':669 'far':2782 'fetch':212,902,909,1152,1160,1166,1171,1178,1188,1204,1211,1218,1224,1231,1241,1246,1250,1256,1267,1280,1302,1318,1339,1459,1501,1504,1507,2182,2323,2335,2368,2438,2450,2479,2601 'field':58,75,213,567,573,598,607,637,649,664,667,734,738,740,764,770,772,792,795,797,799,800,809,820,825,831,833,837,850,854,858,945,960,972,974,1011,1032,1068,1071,1076,1080,1099,1176,1217,1305,1314,1447,1836,2079,2095,2210,2238,2253,2266,2284,2289,2305,2319,2341,2351,2362,2374,2383,2392,2406,2409,2423,2433,2456,2473,2485,2498,2507,2544,2629,3000,3050 'field1':1025 'field2':1026 'fieldpattern':187 'fieldsadd':214,899,1881,1900,1964,2195,2614 'fieldsflatten':215 'fieldskeep':216 'fieldsremov':217 'fieldsrenam':218 'fieldssnapshot':219 'fieldssummari':220,1021,1024,1027 'file':155 'filepattern':188 'filter':21,71,221,566,571,596,605,606,692,696,882,885,937,940,1487,2245,2337,2370,2452,2481,3030,3046 'filterout':222 'find':755 'first':864,1949,2020,2327,2427,2442,2538 'floor':454 'flow':412 'format':2832 'formattimestamp':529,2965 'full':120,1313,1809,1886,2060,2220,2639,2743,2807,3063 'function':137,141,150,238,265,298,308,320,337,342,357,373,383,389,411,416,425,433,439,472,484,489,526,543,774,783,978,1054,1517,1525,1526,1704,1803,1825,1833,1879,1896,1901,2952 'fuzzi':2274 'gaug':1755 'gauge/count':1058 'general':417 'geo':1230 'get':426,1985 'getcharact':504 'getdayofmonth':530 'getdayofweek':531 'getdayofyear':532 'getend':429 'gethighbit':430 'gethour':533 'getlowbit':431 'getminut':534 'getmonth':535 'getnodefield':487,1107,1111 'getnodenam':488 'getsecond':536 'getstart':432 'getweekofyear':537 'getyear':538 'go':1701,2793 'group':138,652 'guarante':1392 'h':913,921,1991,2010,2011,2030,2031,2035,2044,2047,2752,2753,2756,2791,2792,2937 'h-2h':2034 'hand':624 'hashcrc32':376 'hashmd5':377 'hashsha1':378 'hashsha256':379 'hashsha512':380 'hashxxhash32':381 'hashxxhash64':382 'helper':114,1625 'hexstringtonumb':455 'hierarch':1376 'higher':1387 'highest':1366 'host':883,886,1194,1277,1282,2100,2102,2648,2652 'hour':1997,2013,2018,2759,2796,2800,2945 'http':1184 'hyphen':1268 'hypotenus':456 'iani':436 'icollectarray':437 'id':2094,2119,2343,2347,2350,2353,2394,2458,2462,2465,2501 'identifi':1127 'identifierforanyfield':189 'identifierforedgetyp':190 'identifierforfieldonrootlevel':191 'identifierfornodetyp':192 'if/else':110 'iindex':438 'implicit':2166,2585 'improv':1332 'includ':879,1384,2812,2961 'independ':1426 'index':129,132 'indexof':505 'individu':1234 'info':2333,2448 'infra':1207 'ingest':1656,2147,2566 'insensit':678,750 'insid':1078,1702 'instead':1841 'intent':726 'intermedi':1847 'intern':2863,2889 'interv':2191,2203,2610,2622 'invalid':2165,2584 'ip':362 'ipin':475 'ipislinkloc':476 'ipisloopback':477 'ipispriv':478 'ipispubl':479 'ipmask':480 'isfalseornul':313 'isip':481 'isipv4':482 'isipv6':483 'isnotnul':314 'isnul':315 'iso':935,2830 'issu':565 'istrueornul':316 'isuid128':317 'isuid64':318 'isuuid':319 'item':157 'iter':105,434,804 'join':223,829,845,1000,1004 'join/lookup':1014 'joincondit':193 'joinnest':224 'jsonfield':419 'jsonpath':194,420 'k8s':1193,1284,2109,2112,2114 'k8s.cluster.name':2194,2613 'keep':2431 'kept':2864,2890 'key':1089,1093,1123,1130,1175,1269,2201,2620,2852 'keyword':1477 'known':2321 'languag':15 'larg':1336 'last':1939,2757 'lastindexof':506 'latest':1944 'least':1030 'left':1006 'left.a.b':1002 'length':971,977,984 'level':64,1367,1695,1708,3005 'levenshteindist':507 'lifetim':2655 'like':508,964,1105,2270,2825 'limit':225 'list':647,2061 'liter':589,918 'load':34,44,51,226,991 'log':457,903,910,943,1189,1190,1192,1371,1460,2138,2183,2557,2602 'log.level':938,950,1203 'log10':458 'log1p':459 'logic':109 'loglevel':941,947,1201,2189,2608 'long':166 'lookup':227,421,827,834,839,1067,1070,1083,2277,2280,2295,2303,2328,2334,2360,2367,2391,2414,2418,2428,2436,2443,2449,2471,2478,2524,2531,2535,2539 'lookup.my':830 'lookupfield':2348,2381,2463,2492 'lower':509,674,771,776,1397 'm':2048,2050,2778,2813,2815 'maketimeseri':92,228,660,1646,2126,2128,2149,2161,2184,2221,2545,2547,2568,2580,2603,2649,3018 'manipul':102,2231,2661,3025 'map':1119 'match':679,751,761,768,2275 'matchespattern':510 'matchesphras':511 'matchesregex':512 'matchesvalu':513,697,701,708,733,744,763,2232,2235,2246,2261 'materi':1798 'mathemat':440 'max':250,403,554,1046,1555,1684,1757,1869,1871,1969 'maximum':1556,1924 'mean':1407,1989 'med':1736 'median':251,404,555,1037,1585,1672,1737,1928 'messag':1195 'metadata':993 'metric':229,548,985,990,992,1059,1168,1265,1421,1469,1475,1481,1483,1531,1540,1549,1558,1567,1574,1586,1593,1598,1611,1619,1650,2148,2173,2567,2592 'metric.key':1264,1489,1494 'metrickey':195 'metrictimeseriesaggreg':196 'mid':723 'mid-str':722 'midnight':2001 'min':252,405,556,1045,1546,1683,1756 'minimum':1547,1920 'minut':2049,2906 'mix':817 'model':62,1155,1174,3003 'modif':3027 'modifi':2850 'modulo':2980 'monday':2005 'month':96,2051,2780,2948 'ms':2905 'multipl':728,1696,2302 'must':650,878,966,1124,1700 'my.metric':1274 'n':1575,1932 'name':59,151,693,698,702,874,881,1012,1077,1098,1275,1306,1308,2366 'namelessdplpattern':197 'namespac':60,1315,3001 'nanosecond':2868,2894,2987 'navig':82,3037 'need':1270,1785,1806,1884 'network':473 'never':816 'new':1150,1295,2298,2497 'non':1420,1941,1951 'non-metr':1419 'non-nul':1940,1950 'nonempti':2216,2635 'nonemptyexecutionblock':198 'notat':1018 'note':1177 'nth':1576,1933 'null':1942,1952 'number':2866,2892 'numbertohexstr':460 'object':1301,1304,1354,1423,1511 'offset':2019,2025 'often':1984 'omit':2700 'one':1031,2299,2698 'oper':118,636,1975,1977,2728,3059 'optim':70,3045 'option':875,2314,2429 'order':2024,2330,2445 'origin':2517 'p90':1716,1727 'page':1236 'pair':2691,2881 'paramet':172,689,865,876,1033,1081,1104,1317,1322,1649,1712,1781,2202,2285,2306,2407,2621,2682,2693,2711 'parenthes':965 'pars':230,422,1085,1133 'parseal':423 'particular':2877 'pass':1826 'pattern':66,93,720,1121,2077,2222,2278,3007,3040 'per':1427,1534,1543,1552,1561,1570,1578,1589,1605,1615,1666,2082 'percent':1720,1731,1740,1749 'percentil':254,256,407,558,1036,1573,1577,1588,1592,1600,1671,1717,1728,1934 'percentilefromsampl':255,408 'percentrank':253,406,557,1038,1597,1673 'perform':77,745,1334,3053 'pi':341 'pipe':2157,2576 'pipelin':12,2154,2573 'pipeline-bas':11 'pitfal':562 'placement':3047 'point':1533,1542,1551,1560,1569,1663,1946,1956 'posit':687,868 'power':461 'practic':3010,3055 'pre':1653,2146,2565 'pre-aggreg':1652 'pre-ingest':2145,2564 'prefer':1777,1819 'prefix':199,787,835,844,846,2293,2309,2412,2466,2477,2494,2522,2530 'preserv':2311 'primitivevalu':200 'problem':1261 'process':2106,2108 'prod':735,741,765 'produc':2542 'product':756,2249,2332,2339,2342,2346,2349,2352,2354,2379,2393,2395,2447,2454,2457,2461,2464,2467,2490,2510 'product.category':2502 'product.product':2500 'proper':2960 'punctuat':514 'queri':14,16,41,65,69,580,601,611,630,1063,1151,1157,1296,1333,1677,1818,2092,2144,2563,2687,3006,3044 'quot':1129 'radiantodegre':462 'random':463 'rang':74,464,931,1356,3049 'rank':1601 'rate':2197,2616 'ratio':1388,1398,1411,1433,1439,1446,1468 'raw':1661 're':2171,2590 're-aggreg':2170,2589 'read':57,1329,1343 'reason':2902 'record':167,363,1088,1092,1095,1245,1383,1428 'reduc':1324 'refer':45,54,128,2988,3067 'references/dql/dql-commands.md':206,2636,2637 'references/dql/dql-data-types.md':160 'references/dql/dql-functions-aggregation.md':240 'references/dql/dql-functions-array.md':267,2068,2069 'references/dql/dql-functions-bitwise.md':300 'references/dql/dql-functions-boolean.md':310 'references/dql/dql-functions-cast.md':322 'references/dql/dql-functions-constant.md':339 'references/dql/dql-functions-conversion.md':344 'references/dql/dql-functions-create.md':359 'references/dql/dql-functions-cryptographic.md':375 'references/dql/dql-functions-entities.md':385 'references/dql/dql-functions-expression-timeseries.md':395 'references/dql/dql-functions-flow.md':413 'references/dql/dql-functions-general.md':418 'references/dql/dql-functions-get.md':427 'references/dql/dql-functions-iterative.md':435 'references/dql/dql-functions-mathematical.md':441 'references/dql/dql-functions-network.md':474 'references/dql/dql-functions-smartscape.md':486 'references/dql/dql-functions-string.md':491 'references/dql/dql-functions-time.md':528,2953 'references/dql/dql-functions-timeseries.md':549,2056,2057 'references/dql/dql-parameter-value-types.md':175 'references/iterative-expressions.md':106,107,2226,2227,2656,2657,3020,3021 'references/operators.md':125,126,2740,2741,2803,2804,3056,3057 'references/optimization.md':78,79,3041,3042 'references/semantic-dictionary.md':67,68,1310,1311,2995,2996 'references/smartscape-topology-navigation.md':88,89,2124,2125,3033,3034 'references/summarization.md':97,98,2179,2180,2217,2218,2598,2599,3011,3012 'references/useful-expressions.md':115,116,2989,2990 'region':2377,2385,2398,2488,2505 'relat':2720,2859 'relationship':85 'relev':53 'remov':2286,2514 'replacepattern':515 'replacestr':516 'replay':1244,1490 'request':1239 'requir':56,1016,1028,1055,1581,1595,1608,1669,2123,2667 'rest':2680 'result':1040,1408,1430,1681,1835,2313,2541 'return':1065,1679 'right':564,623,848,852,1008 'right-hand':622 'right-sid':847 'right.a.b':1003 'right.my':832 'rollup':1042,1056,1106,1582,1596,1609,1624,1648,1658,1689,1692,1699,1709,1723,1734,1742,2066 'round':465,2733 'rout':134 'rule':2023,2067,2824,2908 'rum':1226,1233 'sampl':1374,1425,1452 'samplingratio':1316,1321,1341,1461 'scalar':812,1764,1776,1779,1814,1820,1827,1857,1867,1873,1893,2264,2928 'scale':2899 'scope':2081 'search':231,1472 'second':2359,2417,2470,2534 'secur':1220 'security.events':1219 'see':1583,2178,2597,2739,2802 'select':76,3051 'semant':822,2998 'seri':391,545,1810,1888,2134,2553 'serv':694,699 'servic':1183,1283,2103,2105 'session':1227,1243 'sever':642,645,944,1199 'side':625,849 'signum':466 'silent':1064,1678 'simpleidentifi':201 'sin':467 'sinc':2869 'singl':814,894,1690,1787,1839,2709 'sinh':468 'skill':7,36 'skill-dt-dql-essentials' 'slot':1536,1545,1554,1563,1572,1580,1591,1607,1617,1668 'smartscap':80,485,2076,3035 'smartscapeedg':232 'smartscapeid':364 'smartscapenod':233,1276,1293,2089,2098,2647 'snapshot':1249 'snippet':2244,2748,2762,2775,2787,2835 'sort':234,954,957,1495 'sourc':2518 'source-dynatrace' 'sourcefield':2345,2378,2460,2489 'space':2038 'span':1179,1182,1340,1373,1378,2139,2558 'spec':146,154,2074,2640 'special':962,2255,2857 'specif':49,2663,2668 'specifi':2361,2472,2675 'split':721 'splitbypattern':517 'splitstr':518 'spread':2211,2630,2645,2654 'sql':33 'sqrt':469 'stabil':63,3004 'start':409,559,1158,1630,2176,2290,2508,2595,2885 'start/end':934 'startswith':519 'static':587,594 'status':643,646 'stddev':257,1638 'step':2325,2357,2440,2468 'stock':2373,2484 'string':168,490,724,737,976,2122,2252,2265 'string/date':113 'stringlength':520,973,980 'sub':579,600,610,629 'sub-queri':578,599,609,628 'subqueri':119,3060 'subsequ':1899 'subset':1413,1436 'substr':521,760,853,857 'subtract':2909 'sum':258,410,560,1047,1273,1466,1528,1529,1685,1758,1914 'summar':90,235,659,900,1463,1491,1644,2224,3016 'support':706,709,1319,1521,1633,2955 'syntax':29,561,1128,3038,3061 't08':2840 't09':2847 'tabl':124,2811 'tabularfileexist':202 'tabularfilenew':203 'tag':1109,1113,1118 'tag-map':1117 'tag.key':1110,1114 'takeani':259,1640 'takefirst':260,1641 'takelast':261,1642 'takemax':262 'takemin':263 'tan':470 'tanh':471 'task':50,55 'third':686 'three':1053 'till':2783 'time':73,121,140,390,527,544,1535,1544,1553,1562,1571,1579,1590,1606,1616,1657,1667,1887,1973,1993,2132,2167,2208,2551,2586,2627,2724,2726,2736,2851,2861,2929,2943,2951,2958,2968,2984,3048,3064 'time-bucket':2131,2550 'timefram':169,365,933,2662,2671,2710,2712,2879 'timelin':2643 'timeseri':101,236,604,987,997,1034,1050,1162,1170,1262,1272,1515,1519,1635,1715,1726,1762,1773,1831,1852,1862,1958,2063,2142,2158,2229,2561,2577,2659,3024 'timeseries-to-scalar':1761 'timestamp':170,366,1979,2209,2628,2734,2828,2862,2884,2910,2914,2915,2972 'timestampfromunixmilli':367 'timestampfromunixnano':368 'timestampfromunixsecond':369 'timezon':2878 'toarray':345 'toboolean':346 'today':2002 'todoubl':347 'todur':348 'toip':349 'tolong':350,789 'tolowercas':663,769,778 'topic-agent-skills' 'topic-ai-agents' 'topic-claude-code' 'topic-devops' 'topic-dql' 'topic-dynatrace' 'topic-mcp' 'topic-observability' 'topolog':81,1278,2091,3036 'tosmartscapeid':351,2117 'tostr':352,788 'total':1457,1760,2185,2199,2604,2619 'totimefram':353 'totimestamp':354,905,928 'touid':355 'tovari':356 'trace':1181 'transform':22 'travers':237 'trim':522 'true':691,1456,1780,1821,1828,1858,1868,1874 'two':1768 'type':159,174,424,781,1281,1309,2083,2099,2858 'type-cast':780 'ui':2678 'uid':171 'uid128':370 'uid64':371 'unescap':523 'unescapehtml':524 'uniqu':28 'unit':123,2042,2737,2810,2985,3066 'unixmillisfromtimestamp':540 'unixnanosfromtimestamp':541 'unixsecondsfromtimestamp':542 'unknown':1711 'unlik':2141,2560 'unquot':1126 'upper':525 'url':204 'usag':2233 'use':130,590,633,757,784,889,932,996,1096,1125,1147,1169,1290,1330,1448,1478,1626,1643,1721,1732,1741,1750,1894,2088,2116,2175,2234,2257,2304,2527,2594,2644,2689,2707,2716,2731,2829,2950,2964,2978,2991,3028,3031 'user.events':1232,1379 'user.replays':1242 'user.sessions':1225,1381 'uuid':372 'val':1090,1094,1745 'valu':173,595,815,995,1348,1599,1604,1753,1789,1840,1908,1917,1921,1925,1929,1943,1953,2718 'varianc':264,1639 'variant':2819 'various':3013 'vectorcosinedist':294 'vectorinnerproductdist':295 'vectorl1distance':296 'vectorl2distance':297 'versa':1405 'via':843,1443 'vice':1404 'view':1237 'volum':1326 'vs':2722,2814 'vulner':1222 'w1':2004,2820 'w7':2821 'warehous':2372,2376,2384,2386,2397,2400,2483,2487,2495,2512 'warehouse.category':2503 'warehouse.warehouse':2504 'way':1769 'week':2007,2817 'week-day':2816 'wildcard':707,710,725,743,767,2272 'wise':803 'without':742,1060,1674,1688,2282,2404,2519 'work':47,1687 'would':2410,2420,2526 'wrap':577,586,672,968 'write':38 'wrong':563,823,1987 'yesterday':2771 'yield':2911,2921,2931 'zone':2959","prices":[{"id":"ed85c92c-166f-494d-8a5c-d1092c2a568c","listingId":"1f1180fe-8836-47b6-89a9-0301da9b58f8","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"Dynatrace","category":"dynatrace-for-ai","install_from":"skills.sh"},"createdAt":"2026-05-11T18:57:13.434Z"}],"sources":[{"listingId":"1f1180fe-8836-47b6-89a9-0301da9b58f8","source":"github","sourceId":"Dynatrace/dynatrace-for-ai/dt-dql-essentials","sourceUrl":"https://github.com/Dynatrace/dynatrace-for-ai/tree/main/skills/dt-dql-essentials","isPrimary":false,"firstSeenAt":"2026-05-11T18:57:13.434Z","lastSeenAt":"2026-05-18T18:56:47.546Z"}],"details":{"listingId":"1f1180fe-8836-47b6-89a9-0301da9b58f8","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"Dynatrace","slug":"dt-dql-essentials","github":{"repo":"Dynatrace/dynatrace-for-ai","stars":78,"topics":["agent-skills","ai-agents","claude-code","devops","dql","dynatrace","mcp","observability"],"license":"apache-2.0","html_url":"https://github.com/Dynatrace/dynatrace-for-ai","pushed_at":"2026-05-15T16:06:09Z","description":"Skills, prompts, and instructions for building AI agents on top of Dynatrace production context","skill_md_sha":"347d803181fbf753f8230771a96b438f05d2f841","skill_md_path":"skills/dt-dql-essentials/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/Dynatrace/dynatrace-for-ai/tree/main/skills/dt-dql-essentials"},"layout":"multi","source":"github","category":"dynatrace-for-ai","frontmatter":{"name":"dt-dql-essentials","license":"Apache-2.0","description":">-"},"skills_sh_url":"https://skills.sh/Dynatrace/dynatrace-for-ai/dt-dql-essentials"},"updatedAt":"2026-05-18T18:56:47.546Z"}}