Allow network device flows in dashboard formula queries

.generator/schemas/v1/openapi.yaml

@@ -3496,6 +3496,7 @@ components:
         - logs
         - spans
         - network
+        - network_device_flows
         - rum
         - security_signals
         - profiles
@@ -3514,6 +3515,7 @@ components:
         - LOGS
         - SPANS
         - NETWORK
+        - NETWORK_DEVICE_FLOWS
         - RUM
         - SECURITY_SIGNALS
         - PROFILES

examples/v1/dashboards/CreateDashboard_2030704107.py

@@ -0,0 +1,78 @@
+"""
+Create a dashboard with network device flows formula query
+"""
+
+from os import environ
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v1.api.dashboards_api import DashboardsApi
+from datadog_api_client.v1.model.dashboard import Dashboard
+from datadog_api_client.v1.model.dashboard_layout_type import DashboardLayoutType
+from datadog_api_client.v1.model.formula_and_function_event_aggregation import FormulaAndFunctionEventAggregation
+from datadog_api_client.v1.model.formula_and_function_event_query_definition import (
+    FormulaAndFunctionEventQueryDefinition,
+)
+from datadog_api_client.v1.model.formula_and_function_event_query_definition_compute import (
+    FormulaAndFunctionEventQueryDefinitionCompute,
+)
+from datadog_api_client.v1.model.formula_and_function_event_query_definition_search import (
+    FormulaAndFunctionEventQueryDefinitionSearch,
+)
+from datadog_api_client.v1.model.formula_and_function_event_query_group_by_fields import (
+    FormulaAndFunctionEventQueryGroupByFields,
+)
+from datadog_api_client.v1.model.formula_and_function_events_data_source import FormulaAndFunctionEventsDataSource
+from datadog_api_client.v1.model.formula_and_function_response_format import FormulaAndFunctionResponseFormat
+from datadog_api_client.v1.model.timeseries_widget_definition import TimeseriesWidgetDefinition
+from datadog_api_client.v1.model.timeseries_widget_definition_type import TimeseriesWidgetDefinitionType
+from datadog_api_client.v1.model.timeseries_widget_request import TimeseriesWidgetRequest
+from datadog_api_client.v1.model.widget import Widget
+from datadog_api_client.v1.model.widget_layout import WidgetLayout
+
+body = Dashboard(
+    title="Example-Dashboard network device flows",
+    widgets=[
+        Widget(
+            definition=TimeseriesWidgetDefinition(
+                type=TimeseriesWidgetDefinitionType.TIMESERIES,
+                requests=[
+                    TimeseriesWidgetRequest(
+                        response_format=FormulaAndFunctionResponseFormat.TIMESERIES,
+                        queries=[
+                            FormulaAndFunctionEventQueryDefinition(
+                                data_source=FormulaAndFunctionEventsDataSource.NETWORK_DEVICE_FLOWS,
+                                name="query1",
+                                search=FormulaAndFunctionEventQueryDefinitionSearch(
+                                    query="",
+                                ),
+                                compute=FormulaAndFunctionEventQueryDefinitionCompute(
+                                    aggregation=FormulaAndFunctionEventAggregation.COUNT,
+                                ),
+                                group_by=FormulaAndFunctionEventQueryGroupByFields(
+                                    fields=[
+                                        "@source.ip",
+                                    ],
+                                    limit=10,
+                                ),
+                            ),
+                        ],
+                    ),
+                ],
+            ),
+            layout=WidgetLayout(
+                x=0,
+                y=0,
+                width=4,
+                height=2,
+            ),
+        ),
+    ],
+    layout_type=DashboardLayoutType.ORDERED,
+)
+
+configuration = Configuration()
+configuration.access_token = environ["DD_BEARER_TOKEN"]
+with ApiClient(configuration) as api_client:
+    api_instance = DashboardsApi(api_client)
+    response = api_instance.create_dashboard(body=body)
+
+    print(response)

src/datadog_api_client/v1/model/formula_and_function_events_data_source.py

@@ -16,14 +16,15 @@ class FormulaAndFunctionEventsDataSource(ModelSimple):
     """
     Data source for event platform-based queries.
 
-    :param value: Must be one of ["logs", "spans", "network", "rum", "security_signals", "profiles", "audit", "events", "ci_tests", "ci_pipelines", "incident_analytics", "product_analytics", "on_call_events", "errors", "llm_observability"].
+    :param value: Must be one of ["logs", "spans", "network", "network_device_flows", "rum", "security_signals", "profiles", "audit", "events", "ci_tests", "ci_pipelines", "incident_analytics", "product_analytics", "on_call_events", "errors", "llm_observability"].
     :type value: str
     """
 
     allowed_values = {
         "logs",
         "spans",
         "network",
+        "network_device_flows",
         "rum",
         "security_signals",
         "profiles",
@@ -40,6 +41,7 @@ class FormulaAndFunctionEventsDataSource(ModelSimple):
     LOGS: ClassVar["FormulaAndFunctionEventsDataSource"]
     SPANS: ClassVar["FormulaAndFunctionEventsDataSource"]
     NETWORK: ClassVar["FormulaAndFunctionEventsDataSource"]
+    NETWORK_DEVICE_FLOWS: ClassVar["FormulaAndFunctionEventsDataSource"]
     RUM: ClassVar["FormulaAndFunctionEventsDataSource"]
     SECURITY_SIGNALS: ClassVar["FormulaAndFunctionEventsDataSource"]
     PROFILES: ClassVar["FormulaAndFunctionEventsDataSource"]
@@ -63,6 +65,7 @@ def openapi_types(_):
 FormulaAndFunctionEventsDataSource.LOGS = FormulaAndFunctionEventsDataSource("logs")
 FormulaAndFunctionEventsDataSource.SPANS = FormulaAndFunctionEventsDataSource("spans")
 FormulaAndFunctionEventsDataSource.NETWORK = FormulaAndFunctionEventsDataSource("network")
+FormulaAndFunctionEventsDataSource.NETWORK_DEVICE_FLOWS = FormulaAndFunctionEventsDataSource("network_device_flows")
 FormulaAndFunctionEventsDataSource.RUM = FormulaAndFunctionEventsDataSource("rum")
 FormulaAndFunctionEventsDataSource.SECURITY_SIGNALS = FormulaAndFunctionEventsDataSource("security_signals")
 FormulaAndFunctionEventsDataSource.PROFILES = FormulaAndFunctionEventsDataSource("profiles")

tests/generated-test/test-runner-data/manifest.json

@@ -119,6 +119,13 @@
       "scenario": "Clients deserialize a dashboard with a empty time object",
       "version": "v1"
     },
+    {
+      "feature": "Dashboards",
+      "feature_file": "../../v1/features/dashboards.feature",
+      "file": "v1/dashboards/create-a-dashboard-with-network-device-flows-formula-query.json",
+      "scenario": "Create a dashboard with network device flows formula query",
+      "version": "v1"
+    },
     {
       "feature": "Dashboards",
       "feature_file": "../../v1/features/dashboards.feature",

tests/generated-test/test-runner-data/v1/dashboards/create-a-dashboard-with-network-device-flows-formula-query.json

@@ -0,0 +1,65 @@
+{
+  "api": "Dashboards",
+  "expected_status": 200,
+  "feature": "Dashboards",
+  "id": "v1/Dashboards/Create a dashboard with network device flows formula query",
+  "operation_id": "CreateDashboard",
+  "request": {
+    "body": {
+      "schema": {
+        "format": null,
+        "ref": "Dashboard",
+        "type": "object"
+      },
+      "source": "inline",
+      "value": {
+        "layout_type": "ordered",
+        "title": "{{ unique }} network device flows",
+        "widgets": [
+          {
+            "definition": {
+              "requests": [
+                {
+                  "queries": [
+                    {
+                      "compute": {
+                        "aggregation": "count"
+                      },
+                      "data_source": "network_device_flows",
+                      "group_by": {
+                        "fields": [
+                          "@source.ip"
+                        ],
+                        "limit": 10
+                      },
+                      "name": "query1",
+                      "search": {
+                        "query": ""
+                      }
+                    }
+                  ],
+                  "response_format": "timeseries"
+                }
+              ],
+              "type": "timeseries"
+            },
+            "layout": {
+              "height": 2,
+              "width": 4,
+              "x": 0,
+              "y": 0
+            }
+          }
+        ]
+      }
+    },
+    "content_type": "application/json",
+    "method": "POST",
+    "pagination": false,
+    "parameters": [],
+    "path": "/api/v1/dashboard"
+  },
+  "scenario": "Create a dashboard with network device flows formula query",
+  "schema_version": 1,
+  "version": "v1"
+}

tests/generated-test/test-server-data/v1/dashboards.json

@@ -92,6 +92,99 @@
       "scenario": "Clients deserialize a dashboard with a empty time object",
       "version": "v1"
     },
+    {
+      "feature": "Dashboards",
+      "frozen_at": "2026-10-13T17:22:34.474Z",
+      "interactions": [
+        {
+          "request": {
+            "body": {
+              "type": "json",
+              "value": {
+                "layout_type": "ordered",
+                "title": "Test-Create_a_dashboard_with_network_device_flows_formula_query-1791912154 network device flows",
+                "widgets": [
+                  {
+                    "definition": {
+                      "requests": [
+                        {
+                          "queries": [
+                            {
+                              "compute": {
+                                "aggregation": "count"
+                              },
+                              "data_source": "network_device_flows",
+                              "group_by": {
+                                "fields": [
+                                  "@source.ip"
+                                ],
+                                "limit": 10
+                              },
+                              "name": "query1",
+                              "search": {
+                                "query": ""
+                              }
+                            }
+                          ],
+                          "response_format": "timeseries"
+                        }
+                      ],
+                      "type": "timeseries"
+                    },
+                    "layout": {
+                      "height": 2,
+                      "width": 4,
+                      "x": 0,
+                      "y": 0
+                    }
+                  }
+                ]
+              }
+            },
+            "content_type": "application/json",
+            "method": "POST",
+            "path": "/api/v1/dashboard",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"id\":\"3wt-6t8-i2d\",\"title\":\"Test-Create_a_dashboard_with_network_device_flows_formula_query-1791912154 network device flows\",\"description\":null,\"author_handle\":\"cassettexxxxxxxxxxxxx@datadoghq.com\",\"author_name\":\"David Tapiador del Dujo\",\"layout_type\":\"ordered\",\"url\":\"/dashboard/3wt-6t8-i2d/test-createadashboardwithnetworkdeviceflowsformulaquery-1791912154-network-devic\",\"template_variables\":null,\"widgets\":[{\"definition\":{\"requests\":[{\"queries\":[{\"compute\":{\"aggregation\":\"count\"},\"data_source\":\"network_device_flows\",\"group_by\":{\"fields\":[\"@source.ip\"],\"limit\":10},\"name\":\"query1\",\"search\":{\"query\":\"\"}}],\"response_format\":\"timeseries\"}],\"type\":\"timeseries\"},\"layout\":{\"height\":2,\"width\":4,\"x\":0,\"y\":0},\"id\":4350654696140889}],\"notify_list\":null,\"created_at\":\"2026-10-13T17:22:34.659735+00:00\",\"modified_at\":\"2026-10-13T17:22:34.659735+00:00\",\"experience_type\":\"default\",\"restricted_roles\":[]}"
+            },
+            "headers": {
+              "content-type": "application/json"
+            },
+            "reason": "OK",
+            "status": 200
+          }
+        },
+        {
+          "request": {
+            "body": {
+              "type": "empty",
+              "value": null
+            },
+            "content_type": "",
+            "method": "DELETE",
+            "path": "/api/v1/dashboard/3wt-6t8-i2d",
+            "query": []
+          },
+          "response": {
+            "body": {
+              "encoding": "text",
+              "value": "{\"deleted_dashboard_id\":\"3wt-6t8-i2d\"}"
+            },
+            "headers": {
+              "content-type": "application/json"
+            },
+            "reason": "OK",
+            "status": 200
+          }
+        }
+      ],
+      "scenario": "Create a dashboard with network device flows formula query",
+      "version": "v1"
+    },
     {
       "feature": "Dashboards",
       "frozen_at": "2024-11-15T19:32:26.867Z",

tests/v1/features/dashboards.feature

@@ -17,6 +17,15 @@ Feature: Dashboards
     Then the response status is 200 OK
     And the response "widgets[0].definition.time" is equal to {}
 
+  @team:ddoghq/dashboards-backend
+  Scenario: Create a dashboard with network device flows formula query
+    Given new "CreateDashboard" request
+    And body with value {"title": "{{ unique }} network device flows", "widgets": [{"definition": {"type": "timeseries", "requests": [{"response_format": "timeseries", "queries": [{"data_source": "network_device_flows", "name": "query1", "search": {"query": ""}, "compute": {"aggregation": "count"}, "group_by": {"fields": ["@source.ip"], "limit": 10}}]}]}, "layout": {"x": 0, "y": 0, "width": 4, "height": 2}}], "layout_type": "ordered"}
+    When the request is sent
+    Then the response status is 200 OK
+    And the response "widgets[0].definition.requests[0].queries[0].data_source" is equal to "network_device_flows"
+    And the response "widgets[0].definition.requests[0].queries[0].group_by.fields[0]" is equal to "@source.ip"
+
   @team:ddoghq/dashboards-backend
   Scenario: Create a distribution widget using a histogram request containing a formulas and functions APM Stats query
     Given new "CreateDashboard" request