This documentation and the Cisco Observability Platform functionalities it describes are subject to change. Data saved on the platform may disappear and APIs may change without notice.

Data Query Examples

The following are some examples and corresponding outputs of UQL queries.

Fetch container ID for a given entity (ID).

Query - Container ID

SINCE 1653661440071 UNTIL 1653665040071
FROM
    entities(apm:service_instance:x5DyCl3hPiaV0oLeGCfRhg).in(common:has).from(infra:container) FETCH id

Output

[
 {
  "type" : "model",
  "model" : {
    "name" : "m:main",
    "fields" : [ {
      "alias" : "id",
      "type" : "string",
      "hints" : {
        "kind" : "entity",
        "field" : "id",
        "type" : "infra:container"
      }
    } ]
   }
 },
 {
  "type" : "data",
  "model" : {
    "$jsonPath" : "$..[?(@.type == 'model')]..[?(@.name == 'm:main')]",
    "$model" : "m:main"
  },
  "dataset" : "d:main",
  "data" : [ [ "infra:container:oOQVlwSPNISmUWHGzG+ZEw" ] ]
}
]

Fetch events aggregated for every minute and grouped by the attribute _ds.pattern_id for entities within a container with ID infra:container:8YbDFX2PMfiE45liUVI5rA. `

Query - Time, Aggregation

FETCH mergedEvents(logs:generic_record)
{timeBucket("1m"), attributes("_ds.pattern_id"), count}
FROM entities(infra:container:8YbDFX2PMfiE45liUVI5rA)
limits events.count(1)
since -10m

Output

[
  {
    "type": "model",
    "model": {
      "name": "m:main",
      "fields": [
        {
          "alias": "mergedEvents(logs:generic_record)\n{timeBucket(\"1m\"), attributes(\"_ds.pattern_id\"), count}",
          "type": "timeseries",
          "hints": {
            "kind": "event",
            "type": "logs:generic_record"
          },
          "form": "reference",
          "model": {
            "name": "m:mergedEvents-logs-generic_record-{timeBucket--1m--,attributes--_ds-pattern_id--,count}",
            "fields": [
              {
                "alias": "timeBucket(\"1m\")",
                "type": "string",
                "hints": {}
              },
              {
                "alias": "attributes(\"_ds.pattern_id\")",
                "type": "string",
                "hints": {}
              },
              {
                "alias": "count",
                "type": "number",
                "hints": {}
              }
            ]
          }
        }
      ]
    }
  },
  {
    "type": "data",
    "model": {
      "$jsonPath": "$..[?(@.type == 'model')]..[?(@.name == 'm:main')]",
      "$model": "m:main"
    },
    "dataset": "d:main",
    "data": [
      [
        {
          "$dataset": "d:mergedEvents-1",
          "$jsonPath": "$..[?(@.type == 'data' && @.dataset == 'd:mergedEvents-1')]"
        }
      ]
    ]
  },
  {
    "type": "data",
    "model": {
      "$jsonPath": "$..[?(@.type == 'model')]..[?(@.name == 'm:mergedEvents-logs-generic_record-{timeBucket--1m--,attributes--_ds-pattern_id--,count}')]",
      "$model": "m:mergedEvents-logs-generic_record-{timeBucket--1m--,attributes--_ds-pattern_id--,count}"
    },
    "metadata": {
      "statistics": {
        "totalDocs": 618209696,
        "numDocs": 26748,
        "numHits": 0,
        "numDocsProcessed": 26748,
        "numHitsProcessed": 2909
      }
    },
    "dataset": "d:mergedEvents-1",
    "data": [
      [
        "2022-05-26T02:26Z",
        "8YbDFX2PMfiE45liUVI5rA_2_2022-05-26T01:48:30.992288",
        184
      ],
      [
        "2022-05-26T02:26Z",
        "8YbDFX2PMfiE45liUVI5rA_1_2022-05-26T01:48:30.992208",
        46
      ],
      [
        "2022-05-26T02:26Z",
        "8YbDFX2PMfiE45liUVI5rA_3_2022-05-26T01:48:30.992538",
        46
      ],
      [
        "2022-05-26T02:34Z",
        "8YbDFX2PMfiE45liUVI5rA_1_2022-05-26T01:48:30.992208",
        19
      ]
    ]
  }
]

Fetch the apm:calls\_per\_minute metric and common:logs event for the entity apm:service.

Query - Metric, Event
```
FETCH
  metrics(apm:calls_per_minute),
  events(common:logs)
FROM entities(apm:service)
```
Fetch the spans and span details reported by a container filtered by spans named HTTP GET.

Query - Spans
```
FETCH
   spans
      [name = 'HTTP GET']
      {spanId, duration}
FROM
   entities(container)
```