Notebooks: Interactive Analysis

Notebooks: Interactive Analysis

Notebooks are Gen3's replacement for the Data Explorer. They're interactive documents where you combine DQL queries, markdown text, and visualizations — like Jupyter notebooks for observability.

When to Use Notebooks vs Dashboards

Notebooks                               Dashboards
──────────────────────────────────────  ──────────────────────────────────────
Investigation and analysis              Monitoring and status
Sequential (top to bottom)              Grid layout (tiles anywhere)
Markdown + DQL sections                 DQL tiles only
Shareable as documents                  Shareable as documents
Great for incident reports              Great for wall screens
One-time or recurring analysis          Always-on monitoring

Notebook Structure

A notebook is a JSON document with sections:

{
  "name": "Investigation Notebook",
  "type": "notebook",
  "content": {
    "version": 1,
    "sections": [
      {"type": "markdown", "content": "# Incident Investigation\nStarted: 2026-04-13"},
      {"type": "dql", "query": "fetch dt.davis.problems, from:now()-24h | filter not(dt.davis.is_duplicate) | limit 10"},
      {"type": "markdown", "content": "## Root Cause Analysis"},
      {"type": "dql", "query": "fetch logs, from:now()-2h | filter loglevel == \"ERROR\" | limit 20"}
    ]
  }
}

Investigation Notebook Template

Here's a template for incident investigation:

Section 1: Markdown — Incident summary (who, what, when)
Section 2: DQL — Active problems
Section 3: DQL — Host CPU/memory during incident window
Section 4: DQL — Error logs from affected services
Section 5: DQL — Service response time during incident
Section 6: Markdown — Root cause analysis
Section 7: Markdown — Action items

Deploy via API

curl -X POST "${PLATFORM_URL}/platform/document/v1/documents" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d @notebook.json \
  "?name=My+Notebook&type=notebook&isPrivate=false"