Unexpected API results with event.timestamp filter

Integrations
1

I’m trying to use the API to fetch all “Lock wait timeout events” events which occurred in the last 7, 30, and 120 days.

I’m using the following queries:

"Lock wait timeout exceeded event.timestamp:>=2016-11-29T21:14:28" # last 7 days
"Lock wait timeout exceeded event.timestamp:>=2016-11-06T21:14:28" # last 30 days 
"Lock wait timeout exceeded event.timestamp:>=2016-08-08T21:14:30" # last 120 days

The results are getting weird. It seems like there’s a smaller amount of issues as I expand the time period.

Results:

"Lock wait timeout exceeded event.timestamp:>=2016-11-29T21:14:28"
Issues: 31
-----
"Lock wait timeout exceeded event.timestamp:>=2016-11-06T21:14:28"
Issues: 23
----
"Lock wait timeout exceeded event.timestamp:>=2016-08-08T21:14:30"
Issues: 23

I would expect that as the time period increases, the number of issues would increase. I would expect that issues with event occurrences >= 7 days ago would be a subset of the issues with event occurrences >= 30 days ago

Am I doing something wrong? Am I misinterpreting the event.timestamp parameter? Or perhaps parsing the API results incorrectly?

2

We can probably improve this, but whats happening is the search engine is saying “find me 1k results that happened > than this time period, then find events which match this title”. I’d definitely consider this a bug, but with the way search works it can often be hard to make these things predictable.

3

https://github.com/getsentry/sentry/pull/4642

4

Hey zeeg,

Thanks for the uberfast reply, it’s definitely appreciated. That PR looks like it will be helpful.

That being said, even with that PR, it sounds like there still may be an opportunity to miss an issue if it’s occurrence is not included in the last 1000 occurrences that match the text, is this correct?

Given the use case: I want to find the count of all occurrences of errors that matches the text “Lock wait timeout exceeded” during a certain time period. Occurrences span multiple Issues.

Is the logic below the only way to achieve this?

  • Grab all issues which match the text “Lock wait timeout exceeded”
  • For each issue:
    • Get all issue occurrences from API
    • Manually filter occurrences which fall into desired time period