Access
- From the data source list: Go to Monitors → Data Sources and click the “Query Workbench” entry on the target data source row.
- Direct URL: Navigate to
/monit/exploreand select a data source in the page. - From incident/alert labels: In the label area of incident or alert detail, the “Explore” icon on query-type label rows opens the workbench with the alert’s triggering query and time window pre-filled.
Query Types
Different data sources support different query types, switched above the editor:Before a query is routed to Edge for execution, it goes through a syntax check: Prometheus data source expressions must pass a PromQL/MetricsQL syntax validation — invalid expressions are rejected upfront with the parser error detail and are never sent for execution. Other data source types are not affected by this check.
Result Display
The result area auto-layouts based on data source and query type:- Prometheus: Split pane — line chart (Graph) on top, raw samples (Raw) below, with a draggable splitter.
- Other data sources: Single result pane showing log view, table view, or samples view depending on the query type.
Graph Features
- Drag-to-zoom: Drag-select a time range on the chart to zoom in.
- Legend facet filtering: The legend area supports filtering by label-value dimension and searching by keyword, grouped by metric name; a keyword search box appears once there are more than 10 series, the legend is capped at 45% of the panel height, and the rows beyond that scroll.
- Tooltip: Hovering shows the value and label of the single series nearest the cursor at that time point; move the cursor along the time axis to step through the others. To compare several series at once, use the legend filters or switch to the raw data.
Log Time Distribution
When the query type includes logs, a log time distribution chart appears above the result area:- Time range ≤ 24 hours: auto-loaded.
- 24 hours – 30 days: requires manual click to load.
- Beyond 30 days: not supported.
Log View
Log-type query results are displayed row by row; each row contains the timestamp, body, and a field summary. If a batch of results contains fields whose value is identical in every row (common fields, such as Loki’s stream labels), these fields are shown in the summary on every row by default, but they take up width on each row repeatedly.- The Common Fields button on the toolbar lists the fields that are identical across every row in the current batch, with their values; after checking Hide Inline in the popover, these common fields are collapsed out of the inline summary, and each row keeps only the content that differs (with a “+N fields” hint displayed)
- Hide Inline is off by default (common fields are shown by default); the toggle is session state, not persisted — refreshing the page restores the default
- Clicking a row expands its details; the details always show all fields of that row, unaffected by the Hide Inline toggle
Query Failure Hints
When a query fails, the result area shows a hint matched to the failure reason (such as query timeout, result row limit exceeded, or Edge version too low). Among these, a data-source-level authorization denial (HTTP 403, error codeAccessDenied) shows a dedicated hint — “You don’t have access to this data source. Please contact the team responsible for the data source or an administrator.” — instead of the generic “Query failed, please try again later.” For team-based data source authorization rules, see Data source permissions (team authorization).
Query Parameters
In addition to the query expression, some data sources support private parameters:AI Query Assistant
The query editor input has a rainbow Write with AI button in its top-right corner that fades in on hover or focus (select a data source first). Clicking it opens the Query Assistant panel, which can see the current data source, query type, private parameters, and time window, plus how the query will actually run (instant / range / range+instant / window; Prometheus’s default Graph + Raw mode runs one range query and one instant query, which isrange+instant), and generates or rewrites the query statement accordingly.
- The result is applied automatically and as a whole: statement, private parameters, and query type are written back together. If the data source chosen by the assistant differs from the current one, the workbench switches to it first, clears the current results, and remembers it as the default data source for your next visit.
- When the result is delivered, the query runs once automatically and its results appear below. The Apply button on the result card re-applies that version without running it; press Enter or click Run query to execute it manually afterwards.
- Applying overwrites the statement currently in the editor and merges the assistant’s private parameters into the existing ones (parameters it does not return keep their current values), so review the result before continuing or sharing.
Query History
Each successful query is automatically saved to query history, which stores only the query expression — not the time range or results. History is isolated per data source, stored in the browser locally, and retains up to 200 entries. When the limit is exceeded, the oldest entry is evicted. Oversized query expressions are not saved to history but the query itself still succeeds. You can delete individual entries or clear all history for the current data source from the history panel.Sharing and URL State
The workbench encodes the current data source, query expression, time range, and query type into URL parameters. Copy the browser address bar to share the current query state — opening the link restores it automatically. If the data source in the link doesn’t exist, is disabled, or the user lacks permissions, the page prompts and does not auto-execute.Data Source Permissions and Denials
The workbench’s data source options include only data sources you have query (readonly) permission on; a data source you may not query never appears as a candidate and its contents cannot be read (see “Data source permissions (team authorization)” in Data source management for the authorization model). When a query is stopped by data source authorization on the server (HTTP 403, error codeAccessDenied — for instance when permissions changed after the page was opened), the workbench does not fall back to the generic query-failure hint but states:
No access to this data source. Contact the data source’s managing team or an administrator.The result area also shows the raw backend message and the RequestId of that request for troubleshooting. To restore access, ask the data source’s managing team or an administrator to adjust that data source’s Managing team and Query-allowed teams on the data source management page.