Adopt Notebooks for Investigation
Notebooks — Replacing Data Explorer
Notebooks replace the Data Explorer for ad-hoc analysis and investigation. Any Data Explorer workflow should move to Notebooks — they combine DQL queries, markdown notes, and visualizations in one shareable document.
When to Use What
Use Case Tool Why
────────────────────────── ──────────── ──────────────────────────────────
Real-time monitoring Dashboard Wall screen, auto-refresh, shared
Investigation & analysis Notebook Sequential, shareable, annotated
Ad-hoc queries Notebook Quick DQL, explore data
Reporting Dashboard Polished, variables, filters
Collaboration Notebook Add notes, share findings
🛠 Try it: Ctrl+K → "Notebooks" → Create new → Add a DQL section → type fetch dt.entity.host | fields entity.name, cpuCores, osType → Add a Markdown section → write your analysis notes.
Notebook Sections
Notebooks support five section types:
Section Type What It Does Icon
────────────── ──────────────────────────────────────── ────
Query (DQL) Write DQL queries, choose visualizations 📊
Explore Point-and-click data exploration 🔍
Code Run JavaScript for custom logic 💻
Markdown Add headers, notes, formatted text 📝
Prompt Ask Davis CoPilot in natural language 🤖
💡 Prompt sections let you ask Davis CoPilot questions in plain English — it generates and runs the DQL for you. Try: "Show me the top 5 hosts by CPU usage in the last hour".
Explore Data (Point-and-Click)
Don't want to write DQL? Use the "Explore data" feature:
- In a Notebook, click "Explore data" instead of "Query Grail"
- Choose your data source (Logs, Metrics, Business events)
- Use the point-and-click interface to filter, aggregate, and visualize
- Click "Show DQL" to see the generated query
💡 "Explore data" is the best way to learn DQL — build your query visually, then read the generated DQL to understand the syntax.
Notebooks vs Dashboards
Aspect Notebook Dashboard
────────────────── ────────────────────────────── ──────────────────────────────
Layout Linear, top-to-bottom Grid-based (24 columns)
Purpose Investigation, analysis, RCA Monitoring, at-a-glance status
DQL location state.input.value query
Viz config state.visualization visualizationSettings
Notebook YAML uses sections format (not cells). Each section is either type: markdown or a DQL query with state.input.value containing the query.