Deep Search: Transform your data exploration and investigation with Dynatrace Grail

The highly performant Dynatrace Query Language (DQL) search command offers simple string-based filtering even in complex and nested data structures, including arrays and nested records. You can now easily perform deep search analysis on any data stored in Dynatrace Grail®, even if you don’t know anything about the data structure or the available fields and data types.

When you’re working with complex, multi-layered data, pinpointing the root cause of an issue or identifying anomalies can feel like trying to find a flickering light in a city skyline. Effective troubleshooting demands a deep understanding of data structures, filters, and query logic. But what happens when you’re staring at a mountain of logs or metrics and don’t even know what to look for? For instance, imagine you’re investigating a sudden spike in error rates across your application. Without knowing which service triggered the cascade or how to filter the noise, you’re left guessing where to begin.

With the introduction of deep search functionality in Grail, we’ve introduced a new way to cut through the noise of complex data. You can now explore data effortlessly without needing to understand every single layer of complexity in your data structure.

Investigating data is a time-consuming process

Difficult data investigations can be taxing. Examining data takes too long, and probing for issues is tricky for those who don’t know the complexities of the data structure. In the query example below, taken before the introduction of DQL search, we attempt to filter within spans where any event sent from an Oracle database contains the phrase “error”.

Search within complex structures

Grail’s unique data warping technology allows for index-free, schema-on-read, high-performance queries, enabling you to flexibly analyze diverse datasets. While Grail has long been capable of dynamically interpreting complex data structures at query time, with the addition of the DQL Search command, you can now deep dive into your metrics, logs, traces, and other data stored in Grail in a way more agile and intuitive way.

Simplified string-based filtering across multiple fields

You can now search across vast and complex data sets without needing to understand the underlying structure. By leveraging string-based search, the system offers intuitive exploration of deeply nested data—no manual filters or query syntax are required. This approach eliminates the traditional barriers of schema knowledge and filter construction, making data investigation accessible to everyone. (See Figure 2 below.)

Surface the needle in the haystack faster

You can search across all fields, not just indexed or predefined ones, making it easy to surface any data without needing to pre-tag or preprocess it. DQL search is optimized to be highly performant, even with terabytes of data.

Search in nested structures

Finding relevant data within nested elements or arrays is cumbersome, requiring a lot of effort to ensure you don’t exclude necessary parts of the data structure. With the new DQL Search command, you can search across complex data structures, including nested elements and arrays, to find exactly what you need.

Imagine a DevOps engineer troubleshooting a failed deployment in a development environment. Suspecting a misconfiguration or runtime error, the engineer needs to find traces containing the term “exception”—buried deep within the span.events array of nested records. The system scans across all nested fields and surfaces relevant spans instantly—saving time, reducing friction, and accelerating root cause analysis.

Now, consider another example with Dynatrace Security Investigator. You’re investigating a security incident in your Amazon cloud environment. You need to track a specific event from your AWS CloudFront logs, and you have the CloudTrail event ID value. You have no idea where to find the event ID. It could be buried in the content, tucked away in header values, or stored in an obscure field. The DQL Search command empowers you to search across all fields instantly—no filters, no field-mapping, just fast, accurate results when you need them the most.

As simple as using a search bar, inside DQL

Experience the flexibility and power of exploratory analytics in Dynatrace without worrying about indexes or schemas. The DQL Search command allows for deep, detailed investigations while maintaining simplicity, making it accessible to a wider range of users.