Data quality

ℹ️
Private preview
Composable dashboards and the metrics API are in private preview: available to invited accounts, and features may change. See Integration and feature lifecycles for what this means, and reach out to your account representative to request access.

Overview

How healthy your tables are, and your alerts and incidents: how many, how fast your team responds and fixes them.

What it answers

How healthy are our assets.
Which data products or domains are least healthy.
Health per data quality dimension or monitor type.
How many alerts, open alerts and incidents, by type, severity, status, owner or team.
Median time to fixed or to response.
Which tables or monitors alert most.
Who changed alert statuses.

🚧
Not covered here

Coverage and monitor counts (Coverage metrics).

Monitor runs and breaches (Monitor runs metrics).

Alerts or events older than 13 full months.

Spend.

Health as of a past date or its trend (health is current state).

Predictions.

Notifications per channel and whether they were delivered: recorded, not served yet.

Try asking

How healthy are our assets this week?

The query your agent runs:

Metrics: asset_health_score_7d
Grouped by: account__account_name

Request (JSON)

{
  "metrics": ["asset_health_score_7d"],
  "group_by": ["account__account_name"]
}

Metrics

Metric	What it counts
`alerted_event_count`	Events that raised an alert. One alert can group several events, so this is not the number of alerts: that is `incident_count`. Group by: Event, Alert, Monitor, Monitored metric, Segment, Warehouse, time. Also per asset, asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_alerted_event_count`, `asset_tag_alerted_event_count`, `audience_alerted_event_count`, `data_product_alerted_event_count`, `domain_alerted_event_count`, `monitor_domain_alerted_event_count`, `monitor_tag_alerted_event_count`.
`anomaly_count`	Anomalies: alerted events not marked as normal and not a monitor failing to run. An anomaly that several Table Monitors flagged counts once, if any of its events counts. Group by: Event, Alert, Monitor, Monitored metric, Segment, Warehouse, time. Also per asset, asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_anomaly_count`, `asset_tag_anomaly_count`, `audience_anomaly_count`, `data_product_anomaly_count`, `domain_anomaly_count`, `monitor_domain_anomaly_count`, `monitor_tag_anomaly_count`.
`asset_health_score_1d`	Share of tables with a result in the last 24 hours up to the last data refresh that had no data quality alert. In the product: not the Data quality dashboard score, which counts monitors. Group by: Asset, time. Also per asset tag, data product, domain, monitor: `asset_tag_asset_health_score_1d`, `data_product_asset_health_score_1d`, `domain_asset_health_score_1d`, `monitor_asset_health_score_1d`.
`asset_health_score_30d`	Share of tables with a result in the last 30 days up to the last data refresh that had no data quality alert. In the product: not the Data quality dashboard score, which counts monitors. Group by: Asset, time. Also per asset tag, data product, domain, monitor: `asset_tag_asset_health_score_30d`, `data_product_asset_health_score_30d`, `domain_asset_health_score_30d`, `monitor_asset_health_score_30d`.
`asset_health_score_7d`	Share of tables with a result in the last 7 days up to the last data refresh that had no data quality alert. In the product: not the Data quality dashboard score, which counts monitors. Group by: Asset, time. Also per asset tag, data product, domain, monitor: `asset_tag_asset_health_score_7d`, `data_product_asset_health_score_7d`, `domain_asset_health_score_7d`, `monitor_asset_health_score_7d`.
`asset_health_score_90d`	Share of tables with a result in the last 90 days up to the last data refresh that had no data quality alert. In the product: not the Data quality dashboard score, which counts monitors. Group by: Asset, time. Also per asset tag, data product, domain, monitor: `asset_tag_asset_health_score_90d`, `data_product_asset_health_score_90d`, `domain_asset_health_score_90d`, `monitor_asset_health_score_90d`.
`event_count`	Events (single detections), alerted or not, dated by when they were detected. Group by: Event, Alert, Monitor, Monitored metric, Segment, Warehouse, time. Also per asset, asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_event_count`, `asset_tag_event_count`, `audience_event_count`, `data_product_event_count`, `domain_event_count`, `monitor_domain_event_count`, `monitor_tag_event_count`.
`event_item_count`	Event items: an event split by metric, field and segment. Group by: Event, Alert, Monitor, Monitored metric, Segment, Warehouse, time. Also per asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_tag_event_item_count`, `audience_event_item_count`, `data_product_event_item_count`, `domain_event_item_count`, `monitor_domain_event_item_count`, `monitor_tag_event_item_count`.
`incident_alert_type_incident_count`	Alerts by alert type; an alert with two types counts for both. In the product: the Alert type filter of the Alerts page. Group by: Alert, Alert sub type, time.
`incident_alert_type_incident_median_ttr_hours`	Median time to fixed in hours by alert type; only alerts whose first or latest status is Fixed have it. Group by: Alert, Alert sub type, time.
`incident_alert_type_incident_open_count`	Open alerts by alert type. Group by: Alert, Alert sub type, time.
`incident_alert_type_incident_status_update_rate`	Alerts with a status / alerts, by alert type. Group by: Alert, Alert sub type, time.
`incident_average_first_feedback_hours`	Average hours from alert creation to its first status; alerts without a status are left out. Group by: Alert, Warehouse, time.
`incident_average_ttr_hours`	Average time to fixed in hours, one value per alert; only alerts whose first or latest status is Fixed have it. Group by: Alert, Warehouse, time. Also per asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_tag_incident_average_ttr_hours`, `audience_incident_average_ttr_hours`, `data_product_incident_average_ttr_hours`, `domain_incident_average_ttr_hours`, `monitor_domain_incident_average_ttr_hours`, `monitor_tag_incident_average_ttr_hours`.
`incident_count`	Alerts created in the period. Alerts for monitors that failed to run are not included: they are `incident_rule_run_error_count`. The alerts a user declared as incidents (the product's Incidents) are `incident_declared_count`. Group by: Alert, Warehouse, time. Also per asset, asset tag, audience, data product, domain, monitor domain, monitor, monitor tag: `asset_incident_count`, `asset_tag_incident_count`, `audience_incident_count`, `data_product_incident_count`, `domain_incident_count`, `monitor_domain_incident_count`, `monitor_incident_count`, `monitor_tag_incident_count`.
`incident_declared_count`	Alerts declared as incidents (SEV-1 to SEV-4). In the product: Incidents. Group by: Alert, Warehouse, time.
`incident_median_first_feedback_hours`	Median hours from alert creation to its first status; alerts without a status are left out. In the product: Time to response (alerts) on the Data operations dashboard counts only Acknowledged, Expected and No action needed as a response, else the latest status, so its value differs. Group by: Alert, Warehouse, time.
`incident_median_ttr_hours`	Median time to fixed in hours, one value per alert; only alerts whose first or latest status is Fixed have it. In the product: the Activity dashboard takes the median over event rows, so its value differs. Group by: Alert, Warehouse, time. Also per asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_tag_incident_median_ttr_hours`, `audience_incident_median_ttr_hours`, `data_product_incident_median_ttr_hours`, `domain_incident_median_ttr_hours`, `monitor_domain_incident_median_ttr_hours`, `monitor_tag_incident_median_ttr_hours`.
`incident_open_count`	Alerts without a terminal status (fixed, expected, no action needed, false positive): nobody closed them, which does not mean the table is failing now. Group by: Alert, Warehouse, time. Also per asset, asset tag, audience, data product, domain, monitor domain, monitor, monitor tag: `asset_incident_open_count`, `asset_tag_incident_open_count`, `audience_incident_open_count`, `data_product_incident_open_count`, `domain_incident_open_count`, `monitor_domain_incident_open_count`, `monitor_incident_open_count`, `monitor_tag_incident_open_count`.
`incident_p90_ttr_hours`	90th percentile of time to fixed in hours, one value per alert; only alerts whose first or latest status is Fixed have it. Group by: Alert, Warehouse, time.
`incident_reaction_count`	Actions users or the system took on alerts (status, owner, severity and name changes, comments, splits, merges, feedback). Group by: Alert, Alert activity, User, Warehouse, time.
`incident_rule_run_error_count`	Alerts raised because a monitor failed to run; they are not in the other alert metrics. Group by: Alert, Warehouse, time.
`incident_status_update_rate`	Alerts with a status / alerts. Group by: Alert, Warehouse, time. Also per asset tag, audience, data product, domain, monitor domain, monitor tag: `asset_tag_incident_status_update_rate`, `audience_incident_status_update_rate`, `data_product_incident_status_update_rate`, `domain_incident_status_update_rate`, `monitor_domain_incident_status_update_rate`, `monitor_tag_incident_status_update_rate`.
`monitor_assets`	Assets (tables and AI agents) of active monitors, each counted once however many monitors check it: the base of the health scores per monitor attribute. Group by: Asset, Monitor, Warehouse, time.

Good to know

Grouping and filtering for all metrics, including why the numbers per domain, data product or tag do not add up to the account's: Before you group or filter.

Alerts and incidents: An Alert in the product is an incident in the data (incident_ metrics), a group of one or more events (event_ metrics); an Incident in the product is a declared incident (incident_declared_count, SEV-1 to SEV-4). The status Investigating is shown as Acknowledged.
Alert type: The Alert type filter of the Alerts page is incident_sub_type__incident_alert_type_group (Table, Metric, Validation, Job, Agent; not PII) and incident_sub_type__incident_alert_type (Freshness, Volume, Custom SQL, ...), with the incident_alert_type_ metrics.
Default windows: Alerts and incidents the last 7 days, time to fixed the last 30 days, asset health 7 days. Open alerts: no date filter.
Severity: incident__incident_user_severity is the severity shown in the product.
Dates: Alerts are dated by when they were created, events by when they were detected.
Open alerts: Open now. A date filter keeps the open alerts created in that window; leave it out for all open alerts. Most open alerts never got a status; incident__incident_status tells them apart.
Alert state now: Tables that alerted in the last 24 hours are asset__is_asset_alerting_1d; open alerts are not a state, because most are never closed.
Medians and rates: Ask them at the grain you show (day, week or month); do not average daily values.
Asset health: Current state over rolling windows of 1, 7, 30 or 90 days up to the last data refresh, so it has no date and can differ slightly from a date filter. It counts tables; the product's Data quality score scores Table Monitors per table and other monitors per monitor, from their latest results, and is not here.
Health trend: Asset health keeps no history. For a trend, count the tables with an anomaly per month (asset_anomaly_count by metric_time__month and asset) and divide by today's covered_assets; the share uses today's coverage, while asset health divides by the tables with a result, so the two do not match.
Alerts on tables: An alert counts for every table it concerns, and for every domain, data product or asset tag of those tables. Alerts that concern no table, such as many custom SQL alerts, are not in the domain, data product or asset tag metrics. Alerts per table (asset_incident_count, asset_event_count) include deleted tables (asset__is_asset_deleted) and tables missing from the Asset dimension, whose asset__asset_category is empty, so a filter on it leaves them out.
Status changes: Who changed an alert's status is incident_reaction_count by incident_reaction__incident_reaction_type and user__user_email; some changes have no user.
Groupings: Per domain, data product and asset tag, the metrics count tables and the alerts on them; per monitor domain and monitor tag, the monitors and the alerts they raised; per audience, where alerts were routed. Alerts of monitors without a tag are in no monitor tag: monitor_tag_incident_count without a grouping counts the alerts with any tag, monitor_tag_incident_open_count the open ones; say how many of the account's alerts (incident_count, incident_open_count) that leaves out.
Domain: For alerts and events a domain is the domain of the monitors (monitor_domain__), as in the Alerts page filter; only alerts without a monitor take the domains of their tables. An alert whose monitor has no domain is in no monitor domain, though its tables can be in domains (domain__). For asset health it is the domain of the tables (domain__).
Merged alerts: An alert merged into another alert stays in the data; filter incident__is_incident_merged is false to match the alert counts of the product.
Declared incidents per grouping: Filter the grouping's alert metric on incident__is_incident_declared.
Data quality dimension: Monitors without one have an empty value; show it as "Not classified". A table counts once in every data quality dimension it failed in, so the dimensions overlap and do not add up to the failing tables; "Not classified" is one of them, not the rest. A dimension's number is distinct tables, not monitor-table pairs or checks.
Health by monitor attribute: By data quality dimension, monitor type, priority or status, ask the monitor_asset_health_score_ metrics grouped by the monitor dimension. Inside a domain or data product, take two steps, as Before you group or filter shows.

Examples

How many freshness, volume and validation alerts did we get in the last 30 days?

Metrics: incident_alert_type_incident_count
Grouped by: incident_sub_type__incident_alert_type
Filter: incident_sub_type__incident_alert_type is one of Freshness, Volume, Validation
Filter: metric_time__day on or after 30 days ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": ["incident_alert_type_incident_count"],
  "group_by": ["incident_sub_type__incident_alert_type"],
  "filters": [
    {
      "field": "incident_sub_type__incident_alert_type",
      "op": "in",
      "values": ["Freshness", "Volume", "Validation"]
    },
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Alerts, status update rate and average time to fixed over the last 30 days

Metrics: incident_count, incident_status_update_rate, incident_average_ttr_hours
Filter: metric_time__day on or after 30 days ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": [
    "incident_count",
    "incident_status_update_rate",
    "incident_average_ttr_hours"
  ],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Alerts, status update rate and median time to fixed per month over the last 13 full months

Metrics: incident_count, incident_status_update_rate, incident_median_ttr_hours
Grouped by: metric_time__month
Filter: metric_time__day on or after the start of the month 13 months ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": [
    "incident_count",
    "incident_status_update_rate",
    "incident_median_ttr_hours"
  ],
  "group_by": ["metric_time__month"],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<start of the month 13 months ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Which tables had the most alerts in the last 30 days?

Metrics: asset_incident_count
Grouped by: asset__asset_full_table_id, asset, asset__is_asset_deleted
Filter: metric_time__day on or after 30 days ago
Filter: incident__is_incident_merged is false
Sorted by: asset_incident_count, highest first

Request (JSON)

{
  "metrics": ["asset_incident_count"],
  "group_by": [
    "asset__asset_full_table_id",
    "asset",
    "asset__is_asset_deleted"
  ],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ],
  "order_by": [
    {"field": "asset_incident_count", "descending": true}
  ]
}

Alerts per week over the last 12 weeks

Metrics: incident_count
Grouped by: metric_time__week
Filter: metric_time__day on or after the start of the week 11 weeks ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": ["incident_count"],
  "group_by": ["metric_time__week"],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<start of the week 11 weeks ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Asset health per monitor priority (P1 to P5) this week

Metrics: monitor_asset_health_score_7d, monitor_assets
Grouped by: monitor__monitor_priority
Filter: monitor_asset_quality__is_monitor_asset_with_result_7d is true

Request (JSON)

{
  "metrics": [
    "monitor_asset_health_score_7d",
    "monitor_assets"
  ],
  "group_by": ["monitor__monitor_priority"],
  "filters": [
    {
      "field": "monitor_asset_quality__is_monitor_asset_with_result_7d",
      "op": "in",
      "values": [true]
    }
  ]
}

Asset health per schema this week, worst first

Metrics: asset_health_score_7d, population_assets
Grouped by: asset__asset_project_name, asset__asset_dataset_name
Filter: asset__is_asset_with_result_7d is true
Sorted by: asset_health_score_7d, lowest first

Request (JSON)

{
  "metrics": ["asset_health_score_7d", "population_assets"],
  "group_by": [
    "asset__asset_project_name",
    "asset__asset_dataset_name"
  ],
  "filters": [
    {
      "field": "asset__is_asset_with_result_7d",
      "op": "in",
      "values": [true]
    }
  ],
  "order_by": [{"field": "asset_health_score_7d"}]
}

Asset health per warehouse this week

Metrics: asset_health_score_7d
Grouped by: asset__warehouse, warehouse__warehouse_name

Request (JSON)

{
  "metrics": ["asset_health_score_7d"],
  "group_by": [
    "asset__warehouse",
    "warehouse__warehouse_name"
  ]
}

Alerts and median time to fixed per data product over the last 30 days

Metrics: data_product_incident_count, data_product_incident_median_ttr_hours
Grouped by: data_product, data_product__data_product_name
Filter: metric_time__day on or after 30 days ago
Filter: incident__is_incident_merged is false
Filter: data_product__is_data_product_deleted is false

Request (JSON)

{
  "metrics": [
    "data_product_incident_count",
    "data_product_incident_median_ttr_hours"
  ],
  "group_by": [
    "data_product",
    "data_product__data_product_name"
  ],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    },
    {
      "field": "data_product__is_data_product_deleted",
      "op": "in",
      "values": [false]
    }
  ]
}

Alerts per week per data product over the last 13 weeks

Metrics: data_product_incident_count
Grouped by: data_product, data_product__data_product_name, metric_time__week
Filter: data_product__is_data_product_deleted is false
Filter: metric_time__day on or after the start of the week 12 weeks ago
Filter: incident__is_incident_merged is false
At most 5,000 rows

Request (JSON)

{
  "metrics": ["data_product_incident_count"],
  "group_by": [
    "data_product",
    "data_product__data_product_name",
    "metric_time__week"
  ],
  "filters": [
    {
      "field": "data_product__is_data_product_deleted",
      "op": "in",
      "values": [false]
    },
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<start of the week 12 weeks ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ],
  "limit": 5000
}

Asset health per data product this week, worst first

Metrics: data_product_asset_health_score_7d
Grouped by: data_product, data_product__data_product_name
Filter: data_product__is_data_product_deleted is false
Sorted by: data_product_asset_health_score_7d, lowest first

Request (JSON)

{
  "metrics": ["data_product_asset_health_score_7d"],
  "group_by": [
    "data_product",
    "data_product__data_product_name"
  ],
  "filters": [
    {
      "field": "data_product__is_data_product_deleted",
      "op": "in",
      "values": [false]
    }
  ],
  "order_by": [
    {"field": "data_product_asset_health_score_7d"}
  ]
}

Scorecard per data product: asset health this week and coverage, worst first

Metrics: data_product_asset_health_score_7d, data_product_coverage_rate
Grouped by: data_product, data_product__data_product_name
Filter: data_product__is_data_product_deleted is false
Sorted by: data_product_asset_health_score_7d, lowest first

Request (JSON)

{
  "metrics": [
    "data_product_asset_health_score_7d",
    "data_product_coverage_rate"
  ],
  "group_by": [
    "data_product",
    "data_product__data_product_name"
  ],
  "filters": [
    {
      "field": "data_product__is_data_product_deleted",
      "op": "in",
      "values": [false]
    }
  ],
  "order_by": [
    {"field": "data_product_asset_health_score_7d"}
  ]
}

Declared incidents by severity over the last 90 days

Metrics: incident_declared_count
Grouped by: incident__incident_user_severity
Filter: metric_time__day on or after 90 days ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": ["incident_declared_count"],
  "group_by": ["incident__incident_user_severity"],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<90 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Asset health per domain this week, worst first

Metrics: domain_asset_health_score_7d
Grouped by: domain, domain__domain_name
Sorted by: domain_asset_health_score_7d, lowest first

Request (JSON)

{
  "metrics": ["domain_asset_health_score_7d"],
  "group_by": ["domain", "domain__domain_name"],
  "order_by": [{"field": "domain_asset_health_score_7d"}]
}

Asset health per data quality dimension this week

Metrics: monitor_asset_health_score_7d
Grouped by: monitor__monitor_data_quality_dimension

Request (JSON)

{
  "metrics": ["monitor_asset_health_score_7d"],
  "group_by": ["monitor__monitor_data_quality_dimension"]
}

Alerts, status update rate and median time to fixed per domain over the last 30 days

Metrics: monitor_domain_incident_count, monitor_domain_incident_status_update_rate, monitor_domain_incident_median_ttr_hours
Grouped by: monitor_domain__domain_name
Filter: metric_time__day on or after 30 days ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": [
    "monitor_domain_incident_count",
    "monitor_domain_incident_status_update_rate",
    "monitor_domain_incident_median_ttr_hours"
  ],
  "group_by": ["monitor_domain__domain_name"],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Which monitors were the noisiest in the last 7 days, and what status did their alerts get?

Metrics: monitor_incident_count
Grouped by: monitor, monitor__monitor_name, incident__incident_status
Filter: metric_time__day on or after 7 days ago
Filter: incident__is_incident_merged is false
Sorted by: monitor_incident_count, highest first

Request (JSON)

{
  "metrics": ["monitor_incident_count"],
  "group_by": [
    "monitor",
    "monitor__monitor_name",
    "incident__incident_status"
  ],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<7 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ],
  "order_by": [
    {"field": "monitor_incident_count", "descending": true}
  ]
}

Open alerts per monitor domain, by status

Metrics: monitor_domain_incident_open_count
Grouped by: monitor_domain, monitor_domain__domain_name, incident__incident_status
Filter: incident__is_incident_merged is false
Sorted by: monitor_domain_incident_open_count, highest first

Request (JSON)

{
  "metrics": ["monitor_domain_incident_open_count"],
  "group_by": [
    "monitor_domain",
    "monitor_domain__domain_name",
    "incident__incident_status"
  ],
  "filters": [
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ],
  "order_by": [
    {
      "field": "monitor_domain_incident_open_count",
      "descending": true
    }
  ]
}

Open alerts by team (monitor tag) with severity, status and owner

Metrics: monitor_tag_incident_open_count
Grouped by: monitor_tag__monitor_tag_name, monitor_tag__monitor_tag_value, incident__incident_user_severity, incident__incident_status, incident__incident_owner
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": ["monitor_tag_incident_open_count"],
  "group_by": [
    "monitor_tag__monitor_tag_name",
    "monitor_tag__monitor_tag_value",
    "incident__incident_user_severity",
    "incident__incident_status",
    "incident__incident_owner"
  ],
  "filters": [
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

How many alerts are open right now?

Metrics: incident_open_count
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": ["incident_open_count"],
  "filters": [
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

How many open alerts have a monitor tag?

Metrics: monitor_tag_incident_open_count, incident_open_count
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": [
    "monitor_tag_incident_open_count",
    "incident_open_count"
  ],
  "filters": [
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Who changed alert statuses in the last 30 days, and how often?

Metrics: incident_reaction_count
Grouped by: user__user_email, incident_reaction__incident_reaction_new_value
Filter: incident_reaction__incident_reaction_type is status_update
Filter: metric_time__day on or after 30 days ago

Request (JSON)

{
  "metrics": ["incident_reaction_count"],
  "group_by": [
    "user__user_email",
    "incident_reaction__incident_reaction_new_value"
  ],
  "filters": [
    {
      "field": "incident_reaction__incident_reaction_type",
      "op": "in",
      "values": ["status_update"]
    },
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    }
  ]
}

Median time to first response (first status) over the last 30 days

Metrics: incident_median_first_feedback_hours
Filter: metric_time__day on or after 30 days ago
Filter: incident__is_incident_merged is false

Request (JSON)

{
  "metrics": ["incident_median_first_feedback_hours"],
  "filters": [
    {
      "field": "metric_time__day",
      "op": "gte",
      "values": ["<30 days ago>"]
    },
    {
      "field": "incident__is_incident_merged",
      "op": "in",
      "values": [false]
    }
  ]
}

Private preview

Overview

What it answers

Not covered here

Try asking

Metrics

Good to know

Examples

How many freshness, volume and validation alerts did we get in the last 30 days?

Alerts, status update rate and average time to fixed over the last 30 days

Alerts, status update rate and median time to fixed per month over the last 13 full months

Which tables had the most alerts in the last 30 days?

Alerts per week over the last 12 weeks

Asset health per monitor priority (P1 to P5) this week

Asset health per schema this week, worst first

Asset health per warehouse this week

Alerts and median time to fixed per data product over the last 30 days

Alerts per week per data product over the last 13 weeks

Asset health per data product this week, worst first

Scorecard per data product: asset health this week and coverage, worst first

Declared incidents by severity over the last 90 days

Asset health per domain this week, worst first

Asset health per data quality dimension this week

Alerts, status update rate and median time to fixed per domain over the last 30 days

Which monitors were the noisiest in the last 7 days, and what status did their alerts get?

Open alerts per monitor domain, by status

Open alerts by team (monitor tag) with severity, status and owner

How many alerts are open right now?

How many open alerts have a monitor tag?

Who changed alert statuses in the last 30 days, and how often?

Median time to first response (first status) over the last 30 days

See also