The Wavefront Query Language lets you retrieve and display the data that has been ingested into Wavefront.
- Time series data The query language is particularly well suited to time series data, because it accommodates the periodicity, potential irregularity, and streaming nature of that data type.
- Histograms The query language includes functions for manipulating histograms.
- Traces and spans Use the tracing UI to query traces and spans.
Our v2 UI supports Chart Builder to build queries interactively. But regardless of UI version, you can use Query Editor to examine, filter, group, and manipulate your data, as shown on this page.
Note: If your cluster has been upgraded to v2, you can select your UI version from the gear icon.
Watch these videos to get you started. The videos use the v1 UI, but the basic workflow remains the same.
A simple query retrieves an individual metric:
For example, you can the total number of requests by entering
ts(~sample.requests.total.num) into a query field to produce the chart below. (The ~sample metrics are available on all clusters for experimentation).
Filter by Source
The example chart is quite busy, but we can filter by source. The Wavefront Data Format includes the source for each metric out of the box, and you can filter by source using the
In the example, we use
source="app-1*" to show all sources that start with app-1. The number of lines is reduced.
Apply an Aggregation Function
Next, let’s try one of the aggregation functions. For example, use
avg() to show the average value of the
~sample.requests.total.num metric across all sources. Or use
sum() to get a total for all sources starting with “app-1”. Here’s the chart:
Further Chart Customization
The query language supports many other ways of getting just the results you want from your data. Here are some examples;
Apply the deriv() function to show the rate of change per second:
Because sum() is an aggregation function, you can group the results. To group by point tags, add the literal , pointTags (you need the comma!). The legend shows that we're getting results for both point tags (az and env).
You can also group by tag, in this example, , az. The legend now shows only the selected tag.
What’s next depends on the type of data you’re interested in, and how you want to interact with your data.
Query Types for Different Data
Most Wavefront users query for metrics, but we support interacting with other data.
Charts for metrics also support the following types of queries:
- Events: Query Wavefront events with
- Histograms: Query histograms with
- Traces and spans: Query trace data from the tracing UI with the tracing Query Builder
Docs, Videos, and Wizards
Wavefront documentation includes videos, tutorials, reference, and guides on the query language.
- Query Language Videos get you started and Use Case Videos show off some compelling examples.
- Query builder (for v1) and Chart builder (for v2) can help you come up to speed quickly while using the product.
- If you’re logged in to Wavefront, select Integrations in the task bar and find the Tutorial or the Tour Pro integration. The Tutorial includes an Interactive Query Language Explorer that shows examples for each function.
- Wavefront Query Language Reference lists each function and gives query language syntax element. Each function names is a link to a reference page for the function.
- For in-depth discussions and examples, we have a reference page for each function and some Query Language Recipes.
This doc set includes videos and explanations from the engineering team that helps you come up to speed quickly:
|How can I combine multiple series?||Aggregating Time Series||Time Series and Interpolation|
|Why does my query return NO DATA?||Maybe the time series don’t match. See When Multiple Series Match (Or Not)|
|I got a warning about pre-aligned data. Why?||Wavefront improves performance by wrapping
|How can I use Wavefront for anomaly detection?||You can use AI Genie or detect anomalies with functions and statistical functions.|
|How can I improve query performance?||Consider bucketing with align(). Investigate slow queries.|