Language

English Français 日本語 한국어 Español

Datadog Site

Site help
US1 US3 US5 EU AP1 AP2 UK1 US1-FED US2-FED

Investigate a timeseries anomaly

copy Copy pageCopied

Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.

POST https://api.ap1.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.ap2.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.datadoghq.eu/api/v2/timeseries-anomaly-investigationshttps://api.ddog-gov.com/api/v2/timeseries-anomaly-investigationshttps://api.us2.ddog-gov.com/api/v2/timeseries-anomaly-investigationshttps://api.uk1.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.us3.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.us5.datadoghq.com/api/v2/timeseries-anomaly-investigations

Overview

Investigates a metrics timeseries request for its most significant anomalies and returns deterministic findings. Metrics queries with or without grouping are supported. This API version accepts exactly one request and returns at most three anomalies. This endpoint requires all of the following permissions:

  • timeseries_query
  • metrics_read

    • OAuth apps require the timeseries_query, metrics_read authorization scope to access this endpoint.

    Request

    Body Data (required)

    Metrics timeseries request to investigate. The request body must not exceed 2 MiB.

    Expand All

    Field

    Type

    Description

    data [required]

    object

    JSON:API resource containing an anomaly investigation request.

    attributes [required]

    object

    Attributes of an anomaly investigation request.

    requests [required]

    [object]

    Timeseries requests to investigate. This API version accepts exactly one request.

    formulas [required]

    [object]

    Formulas to evaluate. Each formula may contain an explicit anomalies() call or a supported metrics expression.

    formula [required]

    string

    Formula expression referencing one or more named queries. When the expression does not contain an explicit anomalies() call, the endpoint applies the default Watchdog Explains anomaly detection configuration.

    limit

    object

    Optional formula limit accepted for compatibility with Timeseries API requests. Formula limits have no effect on timeseries queries.

    count

    int64

    Requested result limit. This field has no effect on a timeseries anomaly investigation.

    order

    enum

    Sort order used when applying a formula series limit. Allowed enum values: asc,desc

    from [required]

    int64

    Start of the investigation time window in milliseconds since the Unix epoch.

    interval

    int64

    Optional requested aggregation interval in milliseconds.

    queries [required]

    [object]

    Metrics queries referenced by the formulas.

    aggregator

    string

    Optional scalar aggregator accepted for request compatibility. This field is ignored for timeseries queries.

    cross_org_uuids

    [string]

    Optional organization UUID used for a cross-organization query. Each query accepts at most one UUID; use separate queries for separate organizations. Influential-tag analysis is currently unsupported for cross-organization queries, but anomaly detection still runs.

    data_source [required]

    enum

    Data source for an anomaly investigation query. Allowed enum values: metrics

    name [required]

    string

    Name used to reference this query from formulas.

    query [required]

    string

    Datadog metrics query expression.

    to [required]

    int64

    End of the investigation time window in milliseconds since the Unix epoch. Must be later than from.

    type [required]

    enum

    Resource type for a timeseries anomaly investigation. Allowed enum values: timeseries_anomaly_investigation

    {
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1",
              "limit": {
                "count": 10,
                "order": "desc"
              }
            }
          ],
          "from": 1754406000000,
          "interval": 60000,
          "queries": [
            {
              "aggregator": "avg",
              "cross_org_uuids": [
                "00000000-0000-0000-0000-000000000000"
              ],
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}

    Response

    OK

    Response containing the anomaly investigation results and timeseries metadata.

    Expand All

    Field

    Type

    Description

    data [required]

    object

    JSON:API resource containing anomaly investigation results.

    attributes [required]

    object

    Attributes of an anomaly investigation response.

    results [required]

    [object]

    Results returned in the same order as the submitted requests. This API version returns exactly one result.

    anomalies [required]

    [object]

    Detected anomalies, ordered by significance. This API version returns at most three anomalies across the submitted request.

    anomaly_detection [required]

    object

    Anomaly detection configuration used for the result.

    configuration_source [required]

    enum

    Source of the anomaly detection configuration. Allowed enum values: request_formula,watchdog_explains_default

    profile [required]

    string

    Applied Watchdog Explains profile, or null when the request supplied an explicit anomalies() formula. The current Watchdog profile is watchdog_explains_v1.

    detected_interval [required]

    object

    Inclusive time interval in milliseconds since the Unix epoch.

    end [required]

    int64

    Timestamp of the final point in the interval.

    start [required]

    int64

    Inclusive start of the interval.

    display_interval [required]

    object

    Inclusive time interval in milliseconds since the Unix epoch.

    end [required]

    int64

    Timestamp of the final point in the interval.

    start [required]

    int64

    Inclusive start of the interval.

    findings [required]

    [ <oneOf>]

    Deterministic explanations for the anomaly, ordered by importance.

    <type=influential_tag>

    object

    Finding that attributes an anomaly to an influential tag.

    description [required]

    string

    Deterministic explanation of the finding.

    headline [required]

    string

    Concise, deterministic finding title.

    tag [required]

    object

    Structured tag evidence for an influential-tag finding.

    influence_type [required]

    enum

    Kind of influence a tag has on a series. Allowed enum values: shape,value

    key [required]

    string

    Influential tag key.

    rating [required]

    double

    Influence rating from 1 through 5.

    synonyms [required]

    [object]

    Tags grouped with this tag by Variation of Influence synonym analysis.

    key [required]

    string

    Synonymous tag key.

    values [required]

    [string]

    Values associated with the synonymous tag.

    values [required]

    [string]

    Influential values for the tag key.

    type [required]

    enum

    Finding category for an influential tag. Allowed enum values: influential_tag

    <type=anomaly>

    object

    Finding that describes the anomaly when completed analysis produces no displayable influential tags.

    description [required]

    string

    Deterministic explanation of the finding.

    headline [required]

    string

    Concise, deterministic finding title.

    type [required]

    enum

    Finding category for an anomaly without a displayable influential tag. Allowed enum values: anomaly

    maximum_deviation [required]

    object

    Most anomalous point within the detected interval.

    delta_from_boundary [required]

    double

    Absolute distance between the observed value and the nearest anomaly boundary.

    timestamp [required]

    int64

    Point timestamp in milliseconds since the Unix epoch.

    value [required]

    double

    Observed value at the point.

    series [required]

    object

    Logical series on which the anomaly was detected.

    group_tags [required]

    [string]

    Tags identifying the selected group. Empty for a query without grouping.

    label [required]

    string

    Display label for the selected series.

    query_index [required]

    int64

    Zero-based index of the caller's formula that produced the series.

    tag_analysis [required]

    object

    Summary of optional influential-tag enrichment. Count and key fields are present only when analysis completes; enrichment availability does not affect completion of the investigation result.

    analyzed_tag_keys

    [string]

    Tag keys analyzed. Present only when analysis completes.

    status [required]

    enum

    Outcome of optional influential-tag enrichment. Allowed enum values: complete,unsupported,failed

    tag_keys_analyzed

    int64

    Number of tag keys analyzed. Present only when analysis completes.

    tag_values_analyzed

    int64

    Number of tag values analyzed. Present only when analysis completes.

    type [required]

    enum

    Direction of an anomaly relative to its expected range. Allowed enum values: spike,dip

    status [required]

    enum

    Status value indicating successful completion. Allowed enum values: complete

    id [required]

    enum

    Stable identifier for an anomaly investigation response resource. Allowed enum values: 0

    type [required]

    enum

    Resource type for a timeseries anomaly investigation. Allowed enum values: timeseries_anomaly_investigation

    meta [required]

    object

    Timeseries execution metadata for the single request accepted by this API version.

    from_date [required]

    int64

    Effective start of the timeseries query in milliseconds since the Unix epoch.

    interval [required]

    int64

    Effective timeseries interval in milliseconds.

    queries [required]

    [object]

    Execution status for the request's queries.

    name [required]

    string

    Query name from the request.

    status [required]

    enum

    Current execution status for a named query. Allowed enum values: running,done

    res_type [required]

    enum

    Response metadata type for a timeseries anomaly investigation. Allowed enum values: timeseries_anomaly_investigation

    results_warnings [required]

    [object]

    Non-fatal warnings produced while executing the investigation.

    message [required]

    string

    Human-readable warning message.

    name [required]

    string

    Machine-readable warning name.

    to_date [required]

    int64

    Effective end of the timeseries query in milliseconds since the Unix epoch.

    {
  "data": {
    "attributes": {
      "results": [
        {
          "anomalies": [
            {
              "anomaly_detection": {
                "configuration_source": "request_formula",
                "profile": null
              },
              "detected_interval": {
                "end": 1754406120000,
                "start": 1754406060000
              },
              "display_interval": {
                "end": 1754406120000,
                "start": 1754406060000
              },
              "findings": [
                []
              ],
              "maximum_deviation": {
                "delta_from_boundary": 7,
                "timestamp": 1754406090000,
                "value": 42
              },
              "series": {
                "group_tags": [
                  "service:api"
                ],
                "label": "api",
                "query_index": 0
              },
              "tag_analysis": {
                "analyzed_tag_keys": [
                  "service",
                  "env"
                ],
                "status": "complete",
                "tag_keys_analyzed": 2,
                "tag_values_analyzed": 4
              },
              "type": "spike"
            }
          ],
          "status": "complete"
        }
      ]
    },
    "id": "0",
    "type": "timeseries_anomaly_investigation"
  },
  "meta": {
    "from_date": 1754406000000,
    "interval": 60000,
    "queries": [
      {
        "name": "query1",
        "status": "done"
      }
    ],
    "res_type": "timeseries_anomaly_investigation",
    "results_warnings": [
      {
        "message": "Influential tag analysis failed for at least one detected anomaly.",
        "name": "tag_analysis_failed"
      }
    ],
    "to_date": 1754423940000
  }
}

    Bad Request

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

    Unauthorized

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

    Forbidden

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

    Payload Too Large

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

    Unprocessable Entity

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
  "errors": [
    {
      "detail": "Missing required attribute in body",
      "meta": {},
      "source": {
        "header": "Authorization",
        "parameter": "limit",
        "pointer": "/data/attributes/title"
      },
      "status": "400",
      "title": "Bad Request"
    }
  ]
}

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
  "errors": [
    "Bad Request"
  ]
}

    Code Example

                      ## default
# 

    # Use a Personal Access Token or Service Access Token
    export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

    # Curl command
    curl -X POST "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.uk1.datadoghq.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
    
                
    """
Investigate a timeseries anomaly returns "OK" response
"""

from os import environ
from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.timeseries_anomaly_investigations_api import TimeseriesAnomalyInvestigationsApi
from datadog_api_client.v2.model.timeseries_anomaly_investigation_data_source import (
    TimeseriesAnomalyInvestigationDataSource,
)
from datadog_api_client.v2.model.timeseries_anomaly_investigation_formula import TimeseriesAnomalyInvestigationFormula
from datadog_api_client.v2.model.timeseries_anomaly_investigation_metric_query import (
    TimeseriesAnomalyInvestigationMetricQuery,
)
from datadog_api_client.v2.model.timeseries_anomaly_investigation_request import TimeseriesAnomalyInvestigationRequest
from datadog_api_client.v2.model.timeseries_anomaly_investigation_request_attributes import (
    TimeseriesAnomalyInvestigationRequestAttributes,
)
from datadog_api_client.v2.model.timeseries_anomaly_investigation_request_data import (
    TimeseriesAnomalyInvestigationRequestData,
)
from datadog_api_client.v2.model.timeseries_anomaly_investigation_timeseries_request import (
    TimeseriesAnomalyInvestigationTimeseriesRequest,
)
from datadog_api_client.v2.model.timeseries_anomaly_investigation_type import TimeseriesAnomalyInvestigationType

body = TimeseriesAnomalyInvestigationRequest(
    data=TimeseriesAnomalyInvestigationRequestData(
        attributes=TimeseriesAnomalyInvestigationRequestAttributes(
            requests=[
                TimeseriesAnomalyInvestigationTimeseriesRequest(
                    formulas=[
                        TimeseriesAnomalyInvestigationFormula(
                            formula="query1",
                        ),
                    ],
                    _from=1754406000000,
                    queries=[
                        TimeseriesAnomalyInvestigationMetricQuery(
                            data_source=TimeseriesAnomalyInvestigationDataSource.METRICS,
                            name="query1",
                            query="avg:system.cpu.user{env:prod} by {service}",
                        ),
                    ],
                    to=1754423940000,
                ),
            ],
        ),
        type=TimeseriesAnomalyInvestigationType.TIMESERIES_ANOMALY_INVESTIGATION,
    ),
)

configuration = Configuration()
configuration.access_token = environ["DD_BEARER_TOKEN"]
configuration.unstable_operations["create_timeseries_anomaly_investigation"] = True
with ApiClient(configuration) as api_client:
    api_instance = TimeseriesAnomalyInvestigationsApi(api_client)
    response = api_instance.create_timeseries_anomaly_investigation(body=body)

    print(response)

    Instructions

    First install the library and its dependencies and then save the example to example.py and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" python3 "example.py"
    # Investigate a timeseries anomaly returns "OK" response

require "datadog_api_client"
DatadogAPIClient.configure do |config|
  config.access_token = ENV["DD_BEARER_TOKEN"]
  config.unstable_operations["v2.create_timeseries_anomaly_investigation".to_sym] = true
end
api_instance = DatadogAPIClient::V2::TimeseriesAnomalyInvestigationsAPI.new

body = DatadogAPIClient::V2::TimeseriesAnomalyInvestigationRequest.new({
  data: DatadogAPIClient::V2::TimeseriesAnomalyInvestigationRequestData.new({
    attributes: DatadogAPIClient::V2::TimeseriesAnomalyInvestigationRequestAttributes.new({
      requests: [
        DatadogAPIClient::V2::TimeseriesAnomalyInvestigationTimeseriesRequest.new({
          formulas: [
            DatadogAPIClient::V2::TimeseriesAnomalyInvestigationFormula.new({
              formula: "query1",
            }),
          ],
          from: 1754406000000,
          queries: [
            DatadogAPIClient::V2::TimeseriesAnomalyInvestigationMetricQuery.new({
              data_source: DatadogAPIClient::V2::TimeseriesAnomalyInvestigationDataSource::METRICS,
              name: "query1",
              query: "avg:system.cpu.user{env:prod} by {service}",
            }),
          ],
          to: 1754423940000,
        }),
      ],
    }),
    type: DatadogAPIClient::V2::TimeseriesAnomalyInvestigationType::TIMESERIES_ANOMALY_INVESTIGATION,
  }),
})
p api_instance.create_timeseries_anomaly_investigation(body)

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" rb "example.rb"
    // Investigate a timeseries anomaly returns "OK" response

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)

func main() {
	body := datadogV2.TimeseriesAnomalyInvestigationRequest{
		Data: datadogV2.TimeseriesAnomalyInvestigationRequestData{
			Attributes: datadogV2.TimeseriesAnomalyInvestigationRequestAttributes{
				Requests: []datadogV2.TimeseriesAnomalyInvestigationTimeseriesRequest{
					{
						Formulas: []datadogV2.TimeseriesAnomalyInvestigationFormula{
							{
								Formula: "query1",
							},
						},
						From: 1754406000000,
						Queries: []datadogV2.TimeseriesAnomalyInvestigationMetricQuery{
							{
								DataSource: datadogV2.TIMESERIESANOMALYINVESTIGATIONDATASOURCE_METRICS,
								Name:       "query1",
								Query:      "avg:system.cpu.user{env:prod} by {service}",
							},
						},
						To: 1754423940000,
					},
				},
			},
			Type: datadogV2.TIMESERIESANOMALYINVESTIGATIONTYPE_TIMESERIES_ANOMALY_INVESTIGATION,
		},
	}
	ctx := datadog.NewDefaultContext(context.Background())
	ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN"))
	configuration := datadog.NewConfiguration()
	configuration.SetUnstableOperationEnabled("v2.CreateTimeseriesAnomalyInvestigation", true)
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewTimeseriesAnomalyInvestigationsApi(apiClient)
	resp, r, err := api.CreateTimeseriesAnomalyInvestigation(ctx, body)

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `TimeseriesAnomalyInvestigationsApi.CreateTimeseriesAnomalyInvestigation`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}

	responseContent, _ := json.MarshalIndent(resp, "", "  ")
	fmt.Fprintf(os.Stdout, "Response from `TimeseriesAnomalyInvestigationsApi.CreateTimeseriesAnomalyInvestigation`:\n%s\n", responseContent)
}

    Instructions

    First install the library and its dependencies and then save the example to main.go and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" go run "main.go"
    // Investigate a timeseries anomaly returns "OK" response

import com.datadog.api.client.ApiClient;
import com.datadog.api.client.ApiException;
import com.datadog.api.client.v2.api.TimeseriesAnomalyInvestigationsApi;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationDataSource;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationFormula;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationMetricQuery;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationRequest;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationRequestAttributes;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationRequestData;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationResponse;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationTimeseriesRequest;
import com.datadog.api.client.v2.model.TimeseriesAnomalyInvestigationType;
import java.util.Collections;

public class Example {
  public static void main(String[] args) {
    ApiClient defaultClient = ApiClient.getDefaultApiClient();
    defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN"));
    defaultClient.setUnstableOperationEnabled("v2.createTimeseriesAnomalyInvestigation", true);
    TimeseriesAnomalyInvestigationsApi apiInstance =
        new TimeseriesAnomalyInvestigationsApi(defaultClient);

    TimeseriesAnomalyInvestigationRequest body =
        new TimeseriesAnomalyInvestigationRequest()
            .data(
                new TimeseriesAnomalyInvestigationRequestData()
                    .attributes(
                        new TimeseriesAnomalyInvestigationRequestAttributes()
                            .requests(
                                Collections.singletonList(
                                    new TimeseriesAnomalyInvestigationTimeseriesRequest()
                                        .formulas(
                                            Collections.singletonList(
                                                new TimeseriesAnomalyInvestigationFormula()
                                                    .formula("query1")))
                                        .from(1754406000000L)
                                        .queries(
                                            Collections.singletonList(
                                                new TimeseriesAnomalyInvestigationMetricQuery()
                                                    .dataSource(
                                                        TimeseriesAnomalyInvestigationDataSource
                                                            .METRICS)
                                                    .name("query1")
                                                    .query(
                                                        "avg:system.cpu.user{env:prod} by"
                                                            + " {service}")))
                                        .to(1754423940000L))))
                    .type(TimeseriesAnomalyInvestigationType.TIMESERIES_ANOMALY_INVESTIGATION));

    try {
      TimeseriesAnomalyInvestigationResponse result =
          apiInstance.createTimeseriesAnomalyInvestigation(body);
      System.out.println(result);
    } catch (ApiException e) {
      System.err.println(
          "Exception when calling"
              + " TimeseriesAnomalyInvestigationsApi#createTimeseriesAnomalyInvestigation");
      System.err.println("Status code: " + e.getCode());
      System.err.println("Reason: " + e.getResponseBody());
      System.err.println("Response headers: " + e.getResponseHeaders());
      e.printStackTrace();
    }
  }
}

    Instructions

    First install the library and its dependencies and then save the example to Example.java and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" java "Example.java"
    // Investigate a timeseries anomaly returns "OK" response
use datadog_api_client::datadog;
use datadog_api_client::datadogV2::api_timeseries_anomaly_investigations::TimeseriesAnomalyInvestigationsAPI;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationDataSource;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationFormula;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationMetricQuery;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationRequest;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationRequestAttributes;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationRequestData;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationTimeseriesRequest;
use datadog_api_client::datadogV2::model::TimeseriesAnomalyInvestigationType;

#[tokio::main]
async fn main() {
    let body =
        TimeseriesAnomalyInvestigationRequest::new(TimeseriesAnomalyInvestigationRequestData::new(
            TimeseriesAnomalyInvestigationRequestAttributes::new(vec![
                TimeseriesAnomalyInvestigationTimeseriesRequest::new(
                    vec![TimeseriesAnomalyInvestigationFormula::new(
                        "query1".to_string(),
                    )],
                    1754406000000,
                    vec![TimeseriesAnomalyInvestigationMetricQuery::new(
                        TimeseriesAnomalyInvestigationDataSource::METRICS,
                        "query1".to_string(),
                        "avg:system.cpu.user{env:prod} by {service}".to_string(),
                    )],
                    1754423940000,
                ),
            ]),
            TimeseriesAnomalyInvestigationType::TIMESERIES_ANOMALY_INVESTIGATION,
        ));
    let mut configuration = datadog::Configuration::new();
    configuration.set_unstable_operation_enabled("v2.CreateTimeseriesAnomalyInvestigation", true);
    let api = TimeseriesAnomalyInvestigationsAPI::with_config(configuration);
    let resp = api.create_timeseries_anomaly_investigation(body).await;
    if let Ok(value) = resp {
        println!("{:#?}", value);
    } else {
        println!("{:#?}", resp.unwrap_err());
    }
}

    Instructions

    First install the library and its dependencies and then save the example to src/main.rs and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run
    /**
 * Investigate a timeseries anomaly returns "OK" response
 */

import { client, v2 } from "@datadog/datadog-api-client";

const configuration = client.createConfiguration({
  authMethods: {
    AuthZ: {
      accessToken: process.env.DD_BEARER_TOKEN as string,
    },
  },
});
configuration.unstableOperations["v2.createTimeseriesAnomalyInvestigation"] =
  true;
const apiInstance = new v2.TimeseriesAnomalyInvestigationsApi(configuration);

const params: v2.TimeseriesAnomalyInvestigationsApiCreateTimeseriesAnomalyInvestigationRequest =
  {
    body: {
      data: {
        attributes: {
          requests: [
            {
              formulas: [
                {
                  formula: "query1",
                },
              ],
              from: 1754406000000,
              queries: [
                {
                  dataSource: "metrics",
                  name: "query1",
                  query: "avg:system.cpu.user{env:prod} by {service}",
                },
              ],
              to: 1754423940000,
            },
          ],
        },
        type: "timeseries_anomaly_investigation",
      },
    },
  };

apiInstance
  .createTimeseriesAnomalyInvestigation(params)
  .then((data: v2.TimeseriesAnomalyInvestigationResponse) => {
    console.log(
      "API called successfully. Returned data: " + JSON.stringify(data)
    );
  })
  .catch((error: any) => console.error(error));

    Instructions

    First install the library and its dependencies and then save the example to example.ts and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comuk1.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>" tsc "example.ts"