Watch some videos, run a query, apply filters and functions, and more.

The Wavefront Query Language lets you retrieve and display the data that has been ingested into Wavefront.

  • Time series data The query language is particularly well suited to time series data, because it accommodates the periodicity, potential irregularity, and streaming nature of that data type.
  • Histograms The query language includes functions for manipulating histograms.
  • Traces and spans Use the tracing UI to query traces and spans.

Our v2 UI supports Chart Builder to build queries interactively. But regardless of UI version, you can use Query Editor to examine, filter, group, and manipulate your data, as shown on this page.

Note: If your cluster has been upgraded to v2, you can select your UI version from the gear icon.

Watch these videos to get you started. The videos use the v1 UI, but the basic workflow remains the same.

introduction to query language

Basic Query

A simple query retrieves an individual metric:

ts(<metricName>)

For example, you can the total number of requests by entering ts(~sample.requests.total.num) into a query field to produce the chart below. (The ~sample metrics are available on all clusters for experimentation).

base query

Filter by Source

The example chart is quite busy, but we can filter by source. The Wavefront Data Format includes the source for each metric out of the box, and you can filter by source using the source=<sourceName> parameter: ts(<metricName>, source=<sourceName>).

In the example, we use source="app-1*" to show all sources that start with app-1. The number of lines is reduced.

filtered query

Apply an Aggregation Function

Next, let’s try one of the aggregation functions. For example, use avg() to show the average value of the ~sample.requests.total.num metric across all sources. Or use sum() to get a total for all sources starting with “app-1”. Here’s the chart:

summed query

Further Chart Customization

The query language supports many other ways of getting just the results you want from your data. Here are some examples;

Apply the deriv() function to show the rate of change per second:

deriv(sum(ts(~sample.requests.total.num))

create dashboard
Because sum() is an aggregation function, you can group the results. To group by point tags, add the literal , pointTags (you need the comma!). The legend shows that we're getting results for both point tags (az and env).

sum(ts(~sample.requests.total.num), pointTags)

group by point tags
You can also group by tag, in this example, , az. The legend now shows only the selected tag.

sum(ts(~sample.requests.total.num), az)

group by tag

Next Steps

What’s next depends on the type of data you’re interested in, and how you want to interact with your data.

Query Types for Different Data

Most Wavefront users query for metrics, but we support interacting with other data.

Charts for metrics also support the following types of queries:

Docs, Videos, and Wizards

Wavefront documentation includes videos, tutorials, reference, and guides on the query language.

  • Query Language Videos get you started and Use Case Videos show off some compelling examples.
  • Query builder (for v1) and Chart builder (for v2) can help you come up to speed quickly while using the product.
  • If you’re logged in to Wavefront, select Integrations in the task bar and find the Tutorial or the Tour Pro integration. The Tutorial includes an Interactive Query Language Explorer that shows examples for each function.
  • Wavefront Query Language Reference lists each function and gives query language syntax element. Each function names is a link to a reference page for the function.
  • For in-depth discussions and examples, we have a reference page for each function and some Query Language Recipes.

FAQ

This doc set includes videos and explanations from the engineering team that helps you come up to speed quickly:

QuestionDoc/BlogVideo
How can I combine multiple series? Aggregating Time Series Time Series and Interpolation
Why does my query return NO DATA? Maybe the time series don’t match. See When Multiple Series Match (Or Not)
I got a warning about pre-aligned data. Why? Wavefront improves performance by wrapping align() around certain functions. See Bucketing with align()
How can I use Wavefront for anomaly detection? You can use AI Genie or detect anomalies with functions and statistical functions.
How can I improve query performance? Consider bucketing with align(). Investigate slow queries.