Modern cloud applications produce millions of metrics, logs, and traces daily. Manually identifying significant anomalies is nearly impossible. This is where Davis AI Analyzer within Dynatrace Notebooks makes a big difference.
Rather than writing complex rules or manually reviewing dashboards, Davis AI automatically examines your notebook results, detects unusual activity, forecasts future patterns, and assists in identifying problems before they affect end users.
Whether you are an SRE, DevOps Engineer, Platform Engineer, Cloud Engineer, or Observability Specialist, Davis AI Analyzer helps you troubleshoot more quickly through smart anomaly detection.
In this guide, you will explore all the analyzers available in Dynatrace Notebooks and learn when to use each one.
What is Davis AI Analyzer
Davis AI Analyzer is an AI-powered analysis capability available inside Dynatrace Notebooks. After executing a DQL query, you can apply different AI analyzers on your visualization to:
- Detect abnormal spikes
- Identify unusual drops
- Learn historical behavior automatically
- Compare current values against expected values
- Predict future trends like forecast
- Reduce alert noise based on logs count and pattern
- Create intelligent alerts with DQL query directly from notebook results into Anomaly Detector
Where Can You Find Davis AI Analyzer
After executing any DQL query within a notebook, ensure that you apply the maketimeseries function to the specific field you intend to analyze using the AI Analyzer. as shown in below DQL query. then follow below steps.
Steps
- Click on Options
- In Vizualization select Line graph
- Goto down and Find Analyze and Alert
- Select one of the available analyzers
These are the Available Davis AI Analyzers
- Static Threshold Anomaly Detection
- Auto Adaptive Threshold Anomaly Detection
- Seasonal Baseline Anomaly Detection
- Forecast Analyzer
1. Static Threshold Anomaly Detection
Static Threshold Anomaly Detection is the simplest and most predictable analyzer available in Davis AI Analyzer for Dynatrace Notebooks. Instead of learning historical behavior, it compares every incoming data point against a user-defined threshold. Whenever the metric crosses that threshold for the configured number of samples, Davis AI raises an alert.
This analyzer is ideal when you already know the acceptable operating limits of your application or infrastructure.
Example
In the screenshot below, the log query counts ERROR messages that contain the text "cannot be retried" every minute.
The threshold is set as follows:
Threshold: 10
Alert Condition: Metric Above Threshold
Violating Samples: 3
Sliding Window: 5
Because the log count has been consistently around 50 to 60 errors per minute, which is much higher than the set threshold of 10, Davis AI quickly detects this as an unusual situation and creates a simulated alert.
The red area shown highlights that the metric has continuously gone beyond the defined threshold.
Static Threshold Detection is most effective in the following situations:
- When CPU utilization goes beyond 90%
- When disk usage surpasses 85%
- When error rates go above an acceptable level
- When response time Service Level Agreements (SLAs) are not met
- When memory usage triggers alerts
Advantages of Static Threshold Detection include:
- Simple setup process
- Consistent and predictable alert responses
- No need for historical data
- Suitable for monitoring the health of infrastructure
- Well-suited for SLA and compliance tracking
2. Auto Adaptive Threshold Anomaly Detection
Auto Adaptive Threshold Detection employs Davis AI to automatically determine a dynamic baseline based on how metrics have behaved recently.Rather than depending on manually set limits, the AI constantly learns what "normal" behavior looks like and automatically updates the threshold as workloads change.
This approach greatly reduces unnecessary alerts while still identifying unusual spikes in metrics.
Example
In this example, the notebook examines log entries that include the "cannot be retried" error message.
The analyzer has been set up with the following parameters:
Number of Signal Fluctuations: 1
Alert if Metric is Above Baseline
Violating Samples: 3
Sliding Window: 5
Even though the metric varies between 50 and 60 errors per minute, Davis AI identifies this as the application's typical operating pattern. Since the recorded values stay within the automatically determined baseline, no simulated alerts are triggered. Rather than responding to each fluctuation, Davis AI smartly distinguishes between regular behavior and real anomalies.
Why Auto Adaptive Detection is Powerful
Traditional monitoring systems often generate unnecessary alerts when metrics show minor fluctuations.
Auto Adaptive Thresholds solve this issue by:
- Continuously analyzing recent trends
- Automatically adjusting thresholds
- Overlooking expected changes in workload
- Detecting only abnormal deviations
Best Use Cases
- Kubernetes workloads
- Auto-scaling cloud applications
- Dynamic traffic patterns
- Microservices
- Production environments with changing workloads
3. Seasonal Baseline Anomaly Detection
Many enterprise applications have regular usage patterns throughout the day, week, or month.For instance, e-commerce websites usually see more traffic on weekends, whereas business applications tend to have higher usage during typical working hours.
Seasonal Baseline Anomaly Detection allows Davis AI to identify these repeated patterns and assess current behavior against historical trends from similar times in the past.
Rather than comparing today's data only with the most recent values, Davis AI checks whether the current metric fits within historical seasonal behavior.
Example
In this notebook example, the number of ERROR logs stays between 50 and 60 events per minute.
The Seasonal Baseline Analyzer is set up with the following parameters:
Tolerance: 4
Alert if Metric is Above Baseline
Violating Samples: 3
Sliding Window: 5
The analyzer finds that the current error level is higher than what is normally expected based on seasonal trends, which triggers a simulated alert.
A red alert indicator at the top of the chart shows that the current activity differs from historical seasonal patterns.
Why Seasonal Detection Matters
Take an online shopping platform as an example:
- Weekend traffic: 50,000 users per hour
- Weekday traffic: 15,000 users per hour
A standard threshold might mistakenly consider weekend traffic as unusual.
Seasonal AI recognizes that higher traffic during weekends is normal and only raises alerts when activity goes beyond the historical weekend baseline.
4. Forecast Analyzer
The Forecast Analyzer uses past data trends to predict future values of a metric.Rather than focusing on detecting issues in the current data, it helps estimate how the metric might change in the coming time periods. This allows teams to monitor situations more proactively by spotting possible problems before they impact the system.
Example
The notebook looks at the number of ERROR logs from the last 30 minutes. And the Forecast Analyzer is set up with:
Number of Data Points to Predict: 100
Forecast Offset: 1
The graph shows:
- Historical data (green line)
- Predicted pattern (black line)
- Confidence range (blue shaded area)
Based on past trends, Davis AI forecasts that the ERROR count will slowly rise during the forecast period. The blue confidence band shows the range in which future values are likely to fall. Rather than waiting for an issue to happen, engineers can use these predictions to look into rising trends before they turn into actual incidents.
Practical Example
Suppose an application is generating 55 errors each minute. The forecast suggests:
- 60 errors in 15 minutes
- 75 errors in 30 minutes
- 95 errors in one hour
This early warning gives operations teams the chance to find the cause of the increase before users start facing problems.
Best Use Cases
- Planning system capacity
- Forecasting storage needs
- Predicting CPU usage growth
- Anticipating memory usage
- Estimating increases in error rates
- Forecasting business key performance indicators
Benefits
- Predicts future trends: For instance, Davis AI forecasts that application error rates will double in the next 30 minutes based on the current trend.
- Enables early incident response: For example, the SRE team gets a forecast about rising API latency and fixes a memory leak before users face slow responses.
- Supports capacity planning: For example, Davis AI forecasts that Kubernetes CPU usage will go beyond 90% next week, allowing engineers to scale the cluster in advance.
- Increases operational efficiency: For example, operations teams focus only on AI-predicted issues rather than manually checking hundreds of dashboards.
- Helps avoid system outages before they happen: For example, Davis AI forecasts that a database disk will become full in 48 hours, giving administrators time to increase storage before an outage occurs.
