DQL Query¶

Click the Shortcut > Explorer at the bottom left corner of the console, or directly open the Explorer using the shortcut keys Alt+Q or option+Q.

Options¶

Return Results¶

Enter the query statement in the DQL Query window and click Execute to view the query results in Return Results.

The query results will be displayed in a table format, and the system will return a maximum of 2,000 data entries by default. You can also export these data as a CSV file.

Note: When using DQL query statements, you can control the number of query results returned by using the slimit parameter.

JSON¶

Query results can be viewed in JSON format. If the DQL query returns an error result, the error message will be directly prompted in JSON.

Query History¶

Query History supports viewing the last 100 query history data within the recent 7 days, and supports fuzzy search for query statements.

Click the execute button on the right side of the query history data to directly display the corresponding query statement and its results.

DQL Syntax¶

DQL Query follows the following syntax paradigm. The relative order of each part cannot be changed. From a syntax perspective, data-source is mandatory (similar to the FROM clause in SQL), while other parts are optional.

For more DQL syntax introduction, refer to the document DQL Definition.

namespace::
    data-source
    target-clause
    filter-clause
    time-expr
    by-clause
    limit-clause
    offset-clause
    slimit-clause
    soffset-clause

Example Explanation¶

Below is a simple example. Use DQL to query the time series Measurement cpu's field usage_idle (CPU idle rate), filter by host, and display the results grouped by host. Here, #{host} is a view variable set in the TrueWatch dashboard, used for filtering.

Apply the above statement to the chart query in the TrueWatch scenario dashboard. The figure below combines expression query and DQL query to display the CPU usage rate for the last 15 minutes.

DQL Functions¶

In addition to being used in scenario dashboards, DQL queries can also be used to query various data collected by DataKit through DQL functions, such as data sources, fields, tags, etc.

SHOW Functions¶

SHOW functions are used to display various types of data. If you are not clear about the data sources, fields, tags, etc., collected by DataKit, you can query them through SHOW functions in the DQL Query Explorer.

Below, use SHOW functions to query the sources, fields, etc., of "object" and "logging" data.

For more function introductions, refer to the documents DQL Functions and DQL Outer Functions.

show_object_source()¶

Display the Measurement set of object data.

show_object_field()¶

Display the fileds list of objects.

show_object_label()¶

Display the tag information contained in objects.

show_logging_source()¶

Display the Measurement set of logging data.

show_logging_field()¶

Display all fileds lists under the specified source.

Time Query¶

In DQL query statements, you can specify time parameters such as [today], [yesterday], [this week], [last week], [this month], [last month].

today: From 0:00 today to the current time;

yesterday: From 0:00 yesterday to 0:00 today;

this week: From 0:00 on Monday this week to the current time;

last week: From 0:00 on Monday last week to 0:00 on Monday this week;

this month: From 0:00 on the 1st of this month to the current time;

last month: From 0:00 on the 1st of last month to 0:00 on the 1st of this month;

Writing Examples¶

Query data from 0:00 today to now, with no time interval, returning one data point:

M::cpu:(avg(`useage`)) [today]

For example: Query data from 0:00 today to now, returning aggregated data points at 5-minute intervals:

M::cpu:(avg(`usage`)) [today:5m]

Expression calculations can also support querying data from two different time periods for final result calculations. If there are multiple different time parameter definitions in the expression, such as subquery A and subquery B defining time parameters as [today] and [yesterday] respectively, the final data return time will be filled according to the now() time at the time of query, and finally, one data will be returned.

If the expression defines a time interval and there are multiple query times with inconsistent time points, such as subquery A and subquery B defining time parameters as [today:5m] and [yesterday:5m] respectively. At this time, the data point times do not match, and addition, subtraction, multiplication, and division cannot be performed. TrueWatch will return an empty value by default.