This is the panel as seen in the alert Page. The main identifier is “snmp”, which is the
_measurement field of the datapoints I’m querying and since the
_measurement field and all the tags are the same, those two series can not be kept apart.
This is the panel as seen in a Dashboard context. The main identifier in this case is “ABB_Port_13” and “ABB_Port_14” respectively, so those two series can be uniquely identified.
When trying to reduce this query to get a two dimensional alert, the tags of the two are the same. When pressing the “Preview Alert” button, the error message
invalid format of evaluation results for the alert definition : frame cannot uniquely be identified by its labels: has duplicate results with labels {IP-Adresse=xx.xx.xx.xx, Raum=xxx, Standort=xxx, Stockwerk=xx, ZaehlerID=42268, agent_host=xx.xx.xx.xx, name=xxxx, type=ABB xxx}
appears.
It seems like even if the _field field is correctly put as the main identifier, the alert still can’t identify the two streams because it tries to do this via the given tags and not the _field, since the main identifier is being replaced with the name of the Reduce Expression, in this Case “B”.
Original Query:
import "date"
from(bucket: "XXXX")
|> range(start: date.truncate(t: date.sub(d: 90m, from: v.timeRangeStart), unit: 30m), stop: date.truncate(t: now(), unit: 30m))
|> filter(fn: (r) => r["_measurement"] == "snmp")
|> filter(fn: (r) => r["IP-Adresse"] =~ /xx.xx.xx.xx/)
|> filter(fn: (r) => r["_field"] =~ /ABB_Port_13/ or r["_field"] =~ /ABB_Port_14/)
|> aggregateWindow(every: 30m, fn: mean, createEmpty: false)
|> difference(nonNegative: false, columns: ["_value"])
|> difference(nonNegative: false, columns: ["_value"])
|> map(fn: (r) => ({ r with _value: r._value / 10.0 }))
