October 2, 2020 - These LogQL query examples have explanations of what the queries accomplish. Return log lines that are not within a range of IPv4 addresses: ... This example matches log lines with all IPv4 subnet values 192.168.4.5/16 except IP address 192.168.4.2: ... {job="security"} |~ "Invalid user.*" | regexp "(^(?P<user>\\S+ {1,2}){8})" | regexp "(^(?P<ip>\\S+ {1,2}){10})" | line_format "IP = {{.ip}}\tUSER = {{.user}}" ... {job="security"} != "grafana_com" |= "session opened" != "sudo: " | regexp "(^(?P<user>\\S+ {1,2}){11})" | line_format "USER = {{.user}}"

Grafana automatically calculates an appropriate interval that you can use as a variable in templated queries. The variable is measured in either seconds ($__interval) or milliseconds ($__interval_ms). Intervals are typically used in aggregation functions like sum or average. For example, this is a Prometheus query that uses the interval variable: rate(http_requests_total[$__interval]).

Copying data from storage to the Grafana server for processing is inefficient, so expressions are targeted at lightweight data processing. Expressions work with data source queries that return time series or number data. They also operate on multiple-dimensional data. For example, a query that returns multiple series, where each series is identified by labels or tags.

Toggle on to include exemplars in the graph. Exemplars link aggregated metric data to specific trace examples, letting you jump from a spike directly to a relevant trace. For more information, refer to Introduction to exemplars. ... Exemplars are not available with Instant query types.

When in Code mode, you can write complete Elasticsearch query DSL in JSON format. The editor provides: ... If you want to filter by time range in a dashboard, you need to use the $__from and $__to macros in your raw DSL. An example query applying dashboard time range using the @timestamp field:

To run a time series query you must include a column named time that returns either a SQL datetime value or a numeric datatype representing the UNIX epoch time in seconds. Additionally, the query results must be sorted by the time column for proper visualization in panels. The examples in this section refer to the data in the following table:

Performs free-form math functions/operations on time series data and numbers. For example, $A + 1 or $A * 100. If queries being compared have multiple series in their results, series from different queries are matched(joined) if they have the ...

For example with cluster="namespace" the cluster is the label identifier, the operation is = and the value is “namespace”. The label identifier is always on the left side of the operation.

If you use raw query mode, your query must include WHERE $timeFilter. You should also provide a group by time and an aggregation function. Otherwise, InfluxDB may return hundreds of thousands of data points, potentially causing your browser to hang. You can enter regular expressions for metric names or tag filter values. Wrap the regular expression pattern in forward slashes (/), as shown in this example: /measurement/. Grafana ...

Grafana workspaces supports up to 26 queries per panel. Query editors are forms that help you write queries. Depending on your data source, the query editor might provide automatic completion, metric names, or variable suggestion. Because of differences between query languages, data sources might have query editors that look different. Data sources have different query languages and syntaxes to ask for the data. Here are two query examples...

March 1, 2026 - To build a new dashboard widget, start by building the SQL query that provides the data for that widget. Grafana's Query Builder will help you build that query using your TrafficPeak data for live examples. To view the Query Builder in Grafana visit the main menu and select Explore . The Query ...

The generated query depends on the operator you choose: Equals (=) or other non-regular expression operators: Each value becomes a separate condition joined with || inside parentheses. For the not-equals (!=) operator, conditions are joined with && instead. Regular expressions match (=~) or not match (!~): Values are concatenated with | inside a single quoted string. This capability only applies to fields with drop-down value selection. For example, if you select Span Name with the = operator and choose both get and log_results_cache as values, the generated query uses separate conditions:

Use the Data operations drop-down to select a macro like $__timeGroup or $__timeGroupAlias. Select a time column from the Column drop-down and a time interval from the Interval drop-down to create a time-series query. ... You can also add custom value to the Data operations. For example, a function that’s not in the drop-down list.

... For example, $__timeGroupAlias("CreatedAt",'5m', 0) groups data into 5-minute intervals and fills any gaps with 0. Grafana applies a server-side row limit to query results to protect against excessive memory usage.

Query management in Explore Grafana Explore provides a variety of tools to help manage your queries. Note For help with debugging queries, Explore allows you to investigate query requests and responses, as well as query statistics, via the Query inspector. Refer to Query inspector in Explore ...

January 15, 2025 - Few grafana versions don’t allow querying instant so better use query_range endpoint. This endpoint allows you to retrieve logs at a specific time. ... Example: Query logs for job="my-app" at a specific timestamp.

December 16, 2024 - The queries use $__rate_interval and $__range Grafana variables for ranges.

Format expressions can be used to change the way lines (line_format()) and labels (label_format()) are displayed. Note that format expressions do not change the underlying source data, only the results that are returned by the query. The previous example uses a line_format() function to rewrite the original log line:

March 31, 2023 - Grafana 9.4.3 on AWS Linux What are you trying to achieve? Using the Dashboard List panel, I want to filter the dashboards that are displayed. I have more than will neatly fit into a single list.

To display multiple time series on the same graph, use wildcards in your query to return all matching series at once. For example, to monitor CPU utilization across a variety of metrics, you can use a single query like cpu.percent.*.g to retrieve all matching time series.