dt-obs-predictive-analytics
Predictive analytics for Dynatrace — time series forecasting with the timeseries-forecast tool, capacity saturation planning, trend and anomaly detection across hosts, services, and infrastructure.
- Installs
- 2.1K
- Last 24h
- +13
- Trending rank
- #7348
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/dynatrace/dynatrace-for-ai --skill dt-obs-predictive-analytics- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads dt-obs-predictive-analytics automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Predictive Analytics Skill
Forecast resource saturation, detect trends, analyze anomalies, and characterize signal behavior using DQL and Dynatrace analyzer tools.
Analysis Disciplines
| # | Discipline | Use when … |
|---|---|---|
| 1 | Forecast and Prediction | Predicting future metric values for capacity planning, cost estimation, or proactive alerting |
| 2 | Detecting Changes | A metric shifted — find when the character of the signal changed, regardless of whether it crossed a limit |
| 3 | Detecting Violations | A metric is currently out of bounds — find entities that exceed or fall below an acceptable range |
| 4 | Timeseries Characteristics | Characterizing a signal's seasonality, noise level, and trend before further analysis |
Choosing the Right Detection Tool
The single most important decision: are you asking "did this metric change?" or "is this metric currently wrong?"
| Question | Tool | Why |
|---|---|---|
| "Did this metric change in the last N hours?" | timeseries-novelty-detection | Detects when the signal's character changed (spike, step, trend onset, variability shift) without requiring a known acceptable limit |
| "Which services spiked or dropped recently?" | timeseries-novelty-detection with SPIKE / CHANGE_IN_VALUES | Finds the specific entities and timestamps where change occurred; returns empty for stable signals |
| "When did CPU start trending up?" | timeseries-novelty-detection with TREND_IN_VALUES | Pinpoints the onset of a directional shift |
| "Which hosts are currently above 90% CPU?" | static-threshold-analyzer | Known fixed limit — fire alerts when exceeded |
| "Which services are currently above their usual load?" | adaptive-anomaly-detector | Learns the normal distribution from the data and flags sustained threshold violations |
| "Which services are high right now vs. their weekly pattern?" | seasonal-baseline-anomaly-detector | Accounts for time-of-day/day-of-week patterns before deciding what is anomalous |
Decision rule in plain language
- Use
timeseries-novelty-detectionwhen the question contains "changed", "shifted", "spiked", "dropped", "started", "when did", or "did anything unusual happen". The tool answers whether a change occurred and when. It requires no predefined threshold. - Use an anomaly detector (
adaptive,seasonal, orstatic) when the question is about ongoing or current state relative to an expected range: "which are highest", "who is violating", "what is above X". These tools count violation samples inside a sliding window — they confirm how long something has been bad, not whether the signal changed.
Pitfall: Running
adaptive-anomaly-detectoron a broad fleet to answer "which service changed load?" typically flags every service that has any variation, producing low-signal results. Usetimeseries-novelty-detectionfirst to identify entities where the load character genuinely shifted, then use the anomaly detectors to measure the severity of those specific signals.
When to Use This Skill
- Capacity: "Which hosts will hit 90% CPU in the next 30 days?"
- Forecast: "Forecast service request volume for the next 7 days"
- Trend: "Is memory usage growing across our Kubernetes nodes?"
- Anomaly: "Which services have unusual error rates right now?"
- Baseline: "How does today's traffic compare to last week?"
- Signal profile: "Is this metric seasonal or trending before I set up alerting?"
Important Constraints
Dynatrace Forecast Analyzer supports univariate forecasting only — predicting one metric based on its own historical values. Multivariate forecasting (using multiple metrics as inputs) requires external tools (Python, R, Azure AutoML).
Tooling Rule: Run analyses using Dynatrace tools: timeseries-forecast, adaptive-anomaly-detector, seasonal-baseline-anomaly-detector, static-threshold-analyzer, and timeseries-novelty-detection. Use execute-dql for DQL queries.
Result Analysis Rule: Always analyse and summarise results directly from the raw tool output. Derive all numbers, trends, and conclusions inline.
Result Presentation Format
Always present forecast results as a structured table:
| Column | Content |
|---|---|
| Rank | 🥇 🥈 🥉 ordered by urgency or magnitude |
| Signal / Entity | Metric name and entity or dimension |
| Last Actual | Most recent non-null value from the historical series |
| Forecast | Point forecast at the end of the horizon |
| Range | Lower – Upper confidence band at the same horizon point |
| Trend | % change from Last Actual to Forecast: 🔴 >+20% / 🟠 +5–20% / 🟢 ±5% stable / 🔵 −5–20% declining / ⚫ <−20% sharp drop |
| Action | ✅ No action / ⚠️ Monitor / 🔴 Act now |
Always follow the table with a Key Findings section (3–5 bullet points, ranked by priority).
Core DQL Techniques
DQL has no native forecast function. For forward-looking forecasts, use timeseries-forecast (see references/forecasting-analyzer.md).
Key DQL Rules
timeseriesreturns arrays — one value per time slot per entityarrayLast(arr)= most recent value;arrayFirst(arr)= oldest- Growth =
(arrayLast - arrayFirst) / number_of_intervals - Always
filter isNotNull(field)before sorting to avoid null ordering issues - Use
toLong()when dividingLongfields to avoid type errors - Use
dt.smartscape.*not deprecateddt.entity.*in DQL display fields; usedt.smartscape.*inby:{}grouping clauses for entity-level queries
Standard Query Patterns
Moving Average Trend
timeseries cpu = avg(dt.host.cpu.usage), from: now()-24h, interval: 1h, by: {dt.smartscape.host}
| fieldsAdd moving_avg = arrayMovingAvg(cpu, 4)
| fieldsAdd current = arrayLast(cpu)
| fieldsAdd trend = arrayLast(cpu) - arrayFirst(cpu)
| filter isNotNull(current)
| sort trend desc
| limit 20
| fields dt.smartscape.host, current, trend, moving_avg
Saturation Risk Classification
timeseries cpu = avg(dt.host.cpu.usage), from: now()-7d, interval: 1h, by: {dt.smartscape.host}
| fieldsAdd p95 = arrayPercentile(cpu, 95)
| fieldsAdd saturation_risk = if(p95 > 85, "HIGH", else: if(p95 > 70, "MEDIUM", else: "LOW"))
| filter isNotNull(p95)
| sort p95 desc
| fields dt.smartscape.host, p95, saturation_risk
Days to Saturation Forecast
timeseries cpu = avg(dt.host.cpu.usage), from: now()-30d, interval: 1d, by: {dt.smartscape.host}
| fieldsAdd current = arrayLast(cpu)
| fieldsAdd daily_growth = (arrayLast(cpu) - arrayFirst(cpu)) / 30
| filter isNotNull(current)
| fieldsAdd days_to_saturation = if(daily_growth > 0, toLong((90 - current) / daily_growth), else: 9999)
| sort days_to_saturation asc
| limit 20
| fields dt.smartscape.host, current, daily_growth, days_to_saturation
Anomaly Scoring
timeseries cpu = avg(dt.host.cpu.usage), from: now()-24h, interval: 1h, by: {dt.smartscape.host}
| fieldsAdd baseline_avg = arrayAvg(cpu)
| fieldsAdd current = arrayLast(cpu)
| fieldsAdd anomaly_score = if(isNotNull(current) and isNotNull(baseline_avg), abs(current - baseline_avg), else: 0)
| sort anomaly_score desc
| limit 20
| fields dt.smartscape.host, current, baseline_avg, anomaly_score
Metric Discovery
Before forecasting, discover available metrics by keyword:
metrics from: now() - 1h
| filter contains(metric.key, "cpu")
| summarize count(), by: {metric.key}
| sort `count()` desc
Reference Guides
references/forecasting-analyzer.md—timeseries-forecasttool: data requirements, parameter reference, interval selection, horizon limits, common pitfallsreferences/capacity-forecasting.md— CPU/memory/disk/K8s saturation forecasts; multi-resource risk scoring; days-to-saturation DQL patternsreferences/anomaly-scoring.md—adaptive-anomaly-detector,seasonal-baseline-anomaly-detector,static-threshold-analyzer; DQL deviation scoringreferences/novelty-detection.md—timeseries-novelty-detectiontool: spike, drop, step change, trend onset, and variability change detection; all novelty types; parameter reference; worked examplesreferences/trend-detection.md—timeseries-novelty-detectionfor trend onset and change points; week-over-week joins; growth rate and acceleration detection
Related Skills
- dt-dql-essentials — DQL syntax,
timeseriescommand rules, array function reference - dt-obs-hosts — Host and process metrics catalog
- dt-obs-services — Service RED metrics for service-level trend analysis
- dt-obs-problems — Davis AI problem history for anomaly correlation
FAQ
What does the dt-obs-predictive-analytics skill do?
Predictive analytics for Dynatrace — time series forecasting with the timeseries-forecast tool, capacity saturation planning, trend and anomaly detection across hosts, services, and infrastructure.
How do I install dt-obs-predictive-analytics?
Run npx skills add https://github.com/dynatrace/dynatrace-for-ai --skill dt-obs-predictive-analytics in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/dt-obs-predictive-analytics/ (personal) or .claude/skills/dt-obs-predictive-analytics/ (project).
Which AI agents can use dt-obs-predictive-analytics?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is dt-obs-predictive-analytics safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains dt-obs-predictive-analytics?
It is published by dynatrace in dynatrace/dynatrace-for-ai. It has 2,136 recorded installs.
More from dynatrace/dynatrace-for-ai
dt-dql-essentials
dynatrace/dynatrace-for-ai
Core DQL syntax, pitfalls, query patterns, and query optimization. Load to write, build, fix, or OPTIMIZE a DQL query — prevents syntax errors and makes queries faster, more efficient, and cheaper (less data scanned = lower query consumption/cost per run). Covers fetch commands, data models, field namespaces, time alignment, entity/smartscape patterns, metric discovery, and performance/cost optimization (filter early, bucket filters, short time ranges, field selection, sampling, cardinality). Trigger: "write/build/fix a DQL query", "DQL syntax", "query logs/spans/metrics", "create a timeseries", "optimize my DQL", "make my query faster/cheaper", "reduce DQL cost/consumption/scanned data", "keep DQL cost under control". Do NOT use to explain an existing query or answer product questions. For MONITORING a tenant's ACTUAL query consumption/billing (how much queries cost, who scanned most, cost trends) use dt-platform-costs — this tunes the query text, not billing data.
dt-app-dashboards
dynatrace/dynatrace-for-ai
Work with Dynatrace dashboards - create, modify, query, and analyze dashboard JSON including tiles, layouts, DQL queries, variables, and visualizations.
dt-obs-logs
dynatrace/dynatrace-for-ai
Log querying, filtering, pattern analysis, and error rate calculation. Use when searching application or infrastructure logs, analyzing error patterns, or correlating log data. Trigger: "show error logs", "search logs for keyword", "log error rate", "recent errors", "logs from last hour", "find log entries", "top error messages", "log patterns", "parse JSON logs", "logs by process group", "log trends over time", "log entry counts per minute". Do NOT use for explaining existing queries, product documentation questions, distributed tracing or span analysis (use dt-obs-tracing).
dt-obs-problems
dynatrace/dynatrace-for-ai
DAVIS problem analysis including root cause identification, impact assessment, and correlation with other telemetry. Use when querying or investigating detected problems. Trigger: "active problems", "root cause analysis", "problem impact", "affected users", "list problems", "P-12345 details", "recurring problems", "problem history", "problem trending", "blast radius", "which entity caused the problem", "problems affecting Kubernetes", "problems by service". Do NOT use for explaining existing queries, product documentation questions, generic log searching, distributed tracing, or host-level resource monitoring.
dt-app-notebooks
dynatrace/dynatrace-for-ai
Work with Dynatrace notebooks - create, modify, query, and analyze notebook JSON including sections, DQL queries, and visualizations.
dt-obs-tracing
dynatrace/dynatrace-for-ai
Distributed traces, spans, service dependencies, and request flow analysis. Use when investigating span-level details, failures, performance bottlenecks, or trace correlation. Trigger: "trace analysis", "slow requests", "failed spans", "service dependencies", "distributed trace", "span details", "HTTP status codes in traces", "database query spans", "messaging spans", "gRPC calls", "Lambda cold starts", "trace ID lookup", "exception analysis", "correlate logs and traces", "request attributes". Do NOT use for explaining existing queries, product documentation or configuration questions, service-level RED metrics (use dt-obs-services), log searching (use dt-obs-logs), or problem analysis (use dt-obs-problems).
Popular data & databases skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pgcron, pgmq), vector/semantic search (pgvector), and restoring dumps (pgrestore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-client-api
prisma/skills
Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".
prisma-database-setup
prisma/skills
Deprecated compatibility name for prisma-orm-setup. Use only when a user or existing integration explicitly invokes prisma-database-setup; otherwise select prisma-orm-setup.
prisma-cli
prisma/skills
Prisma ORM 7 CLI reference for existing Prisma 7 applications or explicitly selected Prisma 7 workflows. Covers prisma init, generate, migrate, db, dev, studio, and mcp. For setup, connection repair, or Prisma 8, use prisma-orm-setup; not the Prisma Platform CLI.
prisma-postgres
prisma/skills
Deprecated compatibility name for prisma-postgres-setup. Use only when a user or existing integration explicitly invokes prisma-postgres; otherwise select prisma-postgres-setup.
prisma-driver-adapter-implementation
prisma/skills
Required reference for Prisma ORM 7 SQL driver adapter work. Use when implementing or modifying adapters, adding database drivers, or touching SqlDriverAdapter, Transaction, savepoint, result mapping, or DriverAdapterError behavior. Covers current transaction lifecycle, optional savepoint hooks, original database-error preservation, and verification.