# Alerting with influxQL using variables **URL:** \ **Category:** Grafana\ **Tags:** influxql, alert-rule, alerting\ **Created:** [February 20, 2024, 9:01am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918 "2024-02-20T09:01:44Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://community.grafana.com/u/codi639)\ **Post date:** [February 20, 2024, 9:01am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/1 "2024-02-20T09:01:44Z")
I’ve read this topics, which is giving a lot of good advice, but using the Flux language. > [@How to create Grafana alerts with InfluxDB and the Flux query language](https://community.grafana.com/t/how-to-create-grafana-alerts-with-influxdb-and-the-flux-query-language/80614): > > There have not been a lot of easy-to-follow examples using [Flux](https://docs.influxdata.com/flux/v0.x/) for creating Grafana Alerts, so with the kind permission of [the Grafana Labs team](https://grafana.com/about/team/), I put together 5 examples that use Flux queries which can be used with Grafana Alerting. Hope this helps others who might be just getting started with Flux and Grafana Alerting. Please reply here if there is any feedback or questions. Is there a way to create alerts with influxQL? I’m a neewbie and, although I can create alerts with simple queries, I can’t get it to iterate with different variable values. For example, I’d like to create an alert that’s triggered if one of my routers reboots, testing whether the uptime is less than 20 seconds. I can do this with this request: ```auto SELECT sysUpTime as UpTime FROM snmp WHERE agent_host =~ /^10.211.0.2$/ AND time > now() - 1m ``` Using this test: ![image](https://us1.discourse-cdn.com/grafana/original/3X/4/a/4abcdaf45e2f36ca5f1f012a43278e496d9a8e88.png) But something like this will not work: ```auto SELECT sysUpTime as UpTime FROM snmp WHERE agent_host =~ /^10.211.0.2$/ AND time > now() - 1m ``` I’ve read about using labels to address query result, but didn’t get it… > **[Templating labels and annotations | Grafana documentation](https://grafana.com/docs/grafana/latest/alerting/fundamentals/annotation-label/variables-label-annotation/#templating-labels-and-annotations)** > > Learn about how to template labels and annotations Furthermore, even after reading the documentation on Grafana alerts, I couldn’t figure out how to configure an alert on several panels… Best regards ---
**Author:** ![grant2](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/grant2/32/42281_2.png) [@grant2](https://community.grafana.com/u/grant2)\ **Post date:** [February 20, 2024, 10:35am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/2 "2024-02-20T10:35:54Z")
> [@codi639](#): > > But something like this will not work: > > ```auto > SELECT sysUpTime as UpTime FROM snmp WHERE agent_host =~ /^10.211.0.2$/ AND time > now() - 1m > > ``` Hi @codi639 Does the above quoted query work in a regular Grafana panel (not alerting)? If yes, can you share the results? ---
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://community.grafana.com/u/codi639)\ **Post date:** [February 20, 2024, 10:42am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/3 "2024-02-20T10:42:29Z")
There you go with using the variable routerIP: ![image](https://us1.discourse-cdn.com/grafana/original/3X/b/0/b0087b77a7fde63097611152e9a328ede5a274f4.png) ```auto SELECT last(sysUpTime) FROM snmp WHERE agent_host =~ /^$routerIP$/ AND time > now() - 1m ``` And with the static IP: ![image](https://us1.discourse-cdn.com/grafana/original/3X/7/c/7cfb08414f9df4152e4b3a81dbf1a9c599586f11.png) ```auto SELECT last(sysUpTime) FROM snmp WHERE agent_host =~ /^10.211.0.11$/ AND time > now() - 1m ``` This is, of course, converted result. There’s the “original” result; which is the number in seconds: ![image](https://us1.discourse-cdn.com/grafana/original/3X/b/d/bdbb365ffe09701947e1ee140ef46b50b597e20d.png) ---
**Author:** ![grant2](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/grant2/32/42281_2.png) [@grant2](https://community.grafana.com/u/grant2)\ **Post date:** [February 20, 2024, 10:49am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/4 "2024-02-20T10:49:09Z")
And the same query in the alerting section (A) plus B: Reduce and C: Threshold gives an error message or just no results? ---
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://community.grafana.com/u/codi639)\ **Post date:** [February 20, 2024, 11:09am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/5 "2024-02-20T11:09:59Z")
I have this error (which does **not** appear every time I press preview): ![image](https://us1.discourse-cdn.com/grafana/original/3X/4/0/4096588abe4c2788bbc469d6238178b707b34b97.png) with this graphic: ![image](https://us1.discourse-cdn.com/grafana/original/3X/a/2/a2b1bd7a3a9d1e12341b4a017ab28fa73a9b5df5.png) with this conf: ![image](https://us1.discourse-cdn.com/grafana/original/3X/e/0/e0c0843b7bc598d31029351c5330757f7b834403.png) And if I apply the modifications, I can see my firing alert message: ![image](https://us1.discourse-cdn.com/grafana/original/3X/7/6/76d8c985d6be7d73b4c787c1d9f6306926455080.png) ---
**Author:** ![grant2](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/grant2/32/42281_2.png) [@grant2](https://community.grafana.com/u/grant2)\ **Post date:** [February 20, 2024, 5:33pm UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/6 "2024-02-20T17:33:48Z")
> [@codi639](#): > > `SELECT sysUpTime as UpTime FROM snmp WHERE agent_host =~ /^10.211.0.2$/ AND time > now() - 1m` If you used the query above without the regex and in an alert, like this (my syntax is probably wrong)… `SELECT sysUpTime as UpTime FROM snmp WHERE agent_host = '10.211.0.2' AND time > now() - 1m` …then do you get any errors? In other words, is the query in the alerting section giving errors when it contains the regex, but otherwise works fine without the regex? Just trying to understand the problem better. ---
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://community.grafana.com/u/codi639)\ **Post date:** [February 21, 2024, 7:42am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/7 "2024-02-21T07:42:10Z")
If you use the regular expression `=~`, the query expects a parameter of type `/^something$/` to **exactly** match the value ‘something’. The same applies to `=`, but without ‘match exactly’: only if the value is the same as ‘something’. I was using this syntax to iterate through my variable, but if you prefer, we can use the simpler syntax for testing. So no, I don’t have any errors with the query (and your syntax is good!): ```sql SELECT sysUpTime as UpTime FROM snmp WHERE agent_host = '10.211.0.2' AND time > now() - 1m ``` By the way, I’ve tried to setup an alert on a different panel which worked well (without iterating trough any variables). My problem seams to be that we can not setup alerts on non graph or timeseries panels: `The alert tab and alert annotations are only supported on graph and timeseries panels.` ![image](https://us1.discourse-cdn.com/grafana/original/3X/a/f/afb3c384be00c5cae1a9caad5c57e3122fcb00a9.png) ---
**Author:** ![grant2](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/grant2/32/42281_2.png) [@grant2](https://community.grafana.com/u/grant2)\ **Post date:** [February 21, 2024, 11:03am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/8 "2024-02-21T11:03:18Z")
Hi @codi639 and thanks for the further explanation. In your query A of the Alerting section, you are using this query… `SELECT sysUpTime as UpTime FROM snmp....` and not this one, right? `SELECT last(sysUpTime) FROM snmp....` Going back to your desire to get the multidimensional alerting working, the end result is to get something like this where you can see which `agent_host`(s) have sysUpTime below 20, right? In other words, a view like this (but with the `agent_host` instead of `cpu`), right? ![image](https://us1.discourse-cdn.com/grafana/original/3X/e/8/e81f6a6082ddecda5980bc41d56833a893057d9a.jpeg) For now, just to get things working, can you remove the regex and insert three possible values for `agent_host` using a format like this? `WHERE ("fueltype"::tag =~ /(Wind|Hydro|Nuclear)/` ---
**Author:** ![codi639](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@codi639](https://community.grafana.com/u/codi639)\ **Post date:** [February 21, 2024, 11:36am UTC](https://community.grafana.com/t/alerting-with-influxql-using-variables/114918/9 "2024-02-21T11:36:02Z")
Well yeah that’s the objective! And yeah sorry, I made to much test and send you the wrong query, I’m using it without the `last()` function. Trying with this query: ```auto SELECT sysUpTime FROM snmp WHERE ("agent_host"::tag =~ /(10.211.0.2|10.211.0.3|10.211.0.4)/) ``` where the 3 addresses are real ones, of course. returns me: ![image](https://us1.discourse-cdn.com/grafana/original/3X/5/9/59e078b55373797b9cc0cbc07b84bb6e52811d97.png) And nothing as well on the alert rules panel: ![image](https://us1.discourse-cdn.com/grafana/original/3X/1/4/144258a3221e8c3e1eb88337011b27109bcae8d7.png) I’ve also tried to do multiple queries but didn’t find how to setup multiple alert condition or configure the alert condition to test every queries.