For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/es/api/latest/timeseries-anomaly-investigations/investigate-a-timeseries-anomaly.md. A documentation index is available at /llms.txt.
Language
Datadog site

Investigate a timeseries anomaly

ADVERTENCIANote: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.
POSThttps://api.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.us3.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.us5.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.datadoghq.eu/api/v2/timeseries-anomaly-investigationshttps://api.ap1.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.ap2.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.uk1.datadoghq.com/api/v2/timeseries-anomaly-investigationshttps://api.ddog-gov.com/api/v2/timeseries-anomaly-investigationshttps://api.us2.ddog-gov.com/api/v2/timeseries-anomaly-investigations

Descripción general

Investigates a metrics timeseries request for its most significant anomalies and returns deterministic findings. Metrics queries with or without grouping are supported. This API version accepts exactly one request and returns at most three anomalies.

This endpoint requires all of the following permissions:

  • timeseries_query
  • metrics_read

OAuth apps require the timeseries_query, metrics_read authorization scope to access this endpoint.

Solicitud

Body Data (required)

Metrics timeseries request to investigate. The request body must not exceed 2 MiB.

Campo
Type
Descripción
data [required]
object

JSON:API resource containing an anomaly investigation request.

Respuesta

OK

Response containing the anomaly investigation results and timeseries metadata.

Campo
Type
Descripción
data [required]
object

JSON:API resource containing anomaly investigation results.

meta [required]
object

Timeseries execution metadata for the single request accepted by this API version.

Ejemplo de código

Investigate a timeseries anomaly
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/timeseries-anomaly-investigations" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "requests": [
        {
          "formulas": [
            {
              "formula": "query1"
            }
          ],
          "from": 1754406000000,
          "queries": [
            {
              "data_source": "metrics",
              "name": "query1",
              "query": "avg:system.cpu.user{env:prod} by {service}"
            }
          ],
          "to": 1754423940000
        }
      ]
    },
    "type": "timeseries_anomaly_investigation"
  }
}
EOF