dt-platform

Query dt.system.events with event.kind == "QUERY_EXECUTION_EVENT" and filter status == "FAILED". The events include timestamp, table, query_pool, query_string, user.email, and execution_duration_ms for each failed query.

Filter dt.system.events by event.kind == "AUDIT_EVENT" and narrow scope with event.provider such as API_GATEWAY, CLASSIC_API, or SETTINGS. Settings changes include details.json_patch showing exactly what changed and details.json_after with the final state.

Each workflow execution emits at least two events, one at RUNNING and one at the final state. Always filter dt.automation_engine.state.is_final == true when counting executions to avoid doubling the numbers.

Yes, parse client.client_context as JSON on ALERTING pool queries and match dt.task.id to the detector's settings objectId. Note that user.id is a shared service account and cannot be used for per-detector attribution.

You need access to a Dynatrace environment and DQL query permissions on the dt.system.events table. All platform operational data lives in that table, segmented by the event.kind field.

Use dt-platform-costs when the question involves billing, usage, or cost attribution based on BILLING_USAGE_EVENT data. This skill covers operational health and performance telemetry, not cost analysis.