Severity mix per service
mediumSeverity mix per service
Datadog SQL Interview Question
Datadog decides where to spend reliability time from the shape of a service's incidents, not the count. Twenty low severity pages are an alerting problem that a threshold change fixes in an afternoon; two of the highest severity are an architecture problem. On separate rows the two services look alike.
Return the service, and the number of incidents at each level as sev1_incidents, sev2_incidents and sev3_incidents. A level a service never hit counts as zero.
Asked of
- Data Analyst
- Analytics Engineer
- Data Engineer
- Data Scientist
datadog_incidentsTable20 rows
| Column Name | Type |
|---|---|
| incident_id | BIGINT |
| service | VARCHAR |
| started_at | TIMESTAMP |
| resolved_at | TIMESTAMP |
| severity | VARCHAR |
datadog_incidentsExample Input
| incident_id | service | started_at | resolved_at | severity |
|---|---|---|---|---|
| 6001 | checkout-api | 2024-10-01 02:10:00 | 2024-10-01 03:40:00 | SEV2 |
| 6002 | checkout-api | 2024-10-01 03:05:00 | 2024-10-01 04:25:00 | SEV3 |
| 6003 | checkout-api | 2024-10-01 06:00:00 | 2024-10-01 06:45:00 | SEV1 |
| 6011 | billing-worker | 2024-10-01 12:00:00 | 2024-10-01 12:30:00 | SEV3 |
| 6012 | billing-worker | 2024-10-01 12:30:00 | 2024-10-01 13:15:00 | SEV2 |
| 6013 | billing-worker | 2024-10-01 15:40:00 | 2024-10-01 16:55:00 | SEV1 |
Example Output
| service | sev1_incidents | sev2_incidents | sev3_incidents |
|---|---|---|---|
| billing-worker | 1 | 1 | 1 |
| checkout-api | 1 | 1 | 1 |
Explanation
Each service in the example had one incident at each of the three levels. A service with none at a level would show a zero in that column rather than dropping out of the report.
The example above is a small slice of the data. Your query runs against the full tables.
Company
Datadog
Difficulty
medium
Topic
reshaping
Language
SQL
Your query
Starting the SQL engine...