> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query workbench

> Run ad-hoc queries against Prometheus, Loki, VictoriaLogs, SLS, CLS, and SQL data sources in Flashduty Monitors. Supports graph, raw, and log volume views.

The Query Workbench (Explore) is an ad-hoc query interface in Flashduty Monitors for running temporary queries against data sources without creating alert rules. It supports Prometheus, Loki, VictoriaLogs, Alibaba Cloud SLS, Tencent Cloud CLS, and MySQL, PostgreSQL, Oracle, ClickHouse, Elasticsearch data sources.

## Access

* **From the data source list**: Go to **Monitors → Data Sources** and click the "Query Workbench" entry on the target data source row.
* **Directly**: open the Query Workbench and select a data source on the page.
* **From incident/alert details**: From the **Investigation** block on an incident or alert details page, the **Investigate** popover on an associated alert row, or the hover card on a system label, clicking an entry opens the workbench with the alert's triggering query and time window pre-filled. See [Search and view incidents](/en/on-call/incident/search-view-incident.md#investigation).

## Query types

Different data sources support different query types, switched above the editor:

| Data Source | Query Type | Description |
| - | - | - |
| Prometheus | Graph + Raw | Shows both a line chart and raw samples |
| Prometheus | Graph only | Shows only the line chart (range query) |
| Prometheus | Raw only | Shows only raw samples (instant query) |
| Loki | Range | Returns log lines within the time range |
| Loki | Instant | Returns matching log lines at the current moment |
| VictoriaLogs | Raw logs | Returns raw log lines |
| VictoriaLogs | Instant stats | Returns instant aggregate statistics |
| VictoriaLogs | Range stats | Returns range trend statistics |
| SLS / CLS | — | No query type selector; vendor-classified logs/tables |
| MySQL / PostgreSQL / Oracle / ClickHouse / ES | — | SQL/query expression executed directly |

> Prometheus queries are syntax-checked as PromQL / MetricsQL first; an invalid expression returns the error detail without running.

## Result display

The result area auto-layouts based on data source and query type:

* **Prometheus**: Split pane — line chart (Graph) on top, raw samples (Raw) below, with a draggable splitter.
* **Other data sources**: Single result pane showing log view, table view, or samples view depending on the query type.

The samples view shows 20 rows per page by default; the table view shows 100 rows per page by default, or 200 or 500. The browser remembers the page size for both views, so it stays after a refresh or a new query.

### Graph features

* **Drag-to-zoom**: Drag-select a time range on the chart to zoom in.
* **Legend facet filtering**: filter by label value and group by metric name; with more than 10 series you can also search by keyword.
* **Tooltip**: shows the value and labels of the series nearest the cursor. To compare several series at once, use the legend filters or the raw data.

### Log time distribution

When the query type includes logs, a log time distribution chart appears above the result area:

* Time range ≤ 24 hours: auto-loaded.
* 24 hours – 30 days: requires manual click to load.
* Beyond 30 days: not supported.

### Log view

Logs are shown row by row, each with the timestamp, body and a field summary.

* Click **Common Fields** on the toolbar to see fields that are identical in every row of the batch (such as Loki stream labels). Tick **Hide Inline** to stop repeating them on each row. Refreshing the page shows them again.
* Click a row to expand all of its fields.

### Query failure hints

When a query fails, the result area explains why, such as a timeout, too many result rows, or an outdated alert engine version. If you cannot query the data source, see [Data source permissions](#data-source-permissions).

## Query parameters

In addition to the query expression, some data sources support private parameters:

| Parameter | Data Sources | Description |
| - | - | - |
| Limit | Loki / VictoriaLogs | Caps the number of returned rows |
| Min step (seconds) | Prometheus / Loki | Lower bound for the auto step of range queries. The workbench shows this input for Prometheus only; on the Loki side the value comes from a dashboard panel — opening a panel's **Open in query workbench** carries that panel's min step over (see [Fullscreen and query details](/en/monitors/dashboards/dashboards.md#fullscreen-and-query-details)) |
| Direction | Loki / VictoriaLogs | Latest-first or earliest-first |
| Project / Logstore | SLS | Required; used in the request URL |
| Region / Topic / Syntax | Tencent CLS | Required |
| PowerSQL | SLS | Enables PowerSQL mode |
| Time macros | SQL data sources | `$__timeFilter(column)`, `$__timeFrom()`, `$__timeTo()`; the time range you pick on the page reaches this query only when the SQL uses a macro — without one the SQL runs as written |
| Built-in time variables | Prometheus / Loki | `$__interval`, `$__rate_interval`, `$__range`, `$__auto` make the query follow the time range and step you pick on the page — see the next section |

### Built-in time variables

Built-in time variables make a query follow the time range and step you pick instead of hard-coding them; write them as `$__interval` or `${__interval}`. Prometheus and Loki range queries can use them all; Loki instant queries can use two of them.

| Variable | Meaning |
| - | - |
| `$__interval` | The query step, for example, `30s`, never below **Min step** |
| `$__rate_interval` | The step plus 15 seconds, at least 60 seconds; ready for `rate()` |
| `$__range` | The length of the time window, for example, `3600s` |
| `$__auto` | In Loki range queries, the same as the step; in Loki instant queries, the whole time window length, for example, `1h` |

Where they are available:

| Query | Available variables |
| - | - |
| Prometheus range (**Graph only**) | `$__interval`, `$__rate_interval`, `$__range` |
| Loki range | `$__auto`, `$__interval`, `$__range` |
| Loki instant | `$__auto`, `$__range` |
| Prometheus instant (**Raw only**) | none |

* Using one where it is not supported returns an error: Prometheus instant queries support none of them, and Loki instant queries accept only `$__auto` and `$__range` — `$__interval` and `$__rate_interval` still fail there.
* Prometheus's default **Graph + Raw** fires a range request and an instant request together. When the expression contains a built-in time variable (`$__interval`, `${__auto}`, and the like), the workbench runs the range query only and the **Raw** pane no longer issues an instant query, so it shows no samples and stays on "Not run yet"; when the expression has no built-in time variable, both halves are sent as before. Using `$__rate_interval` no longer requires switching to **Graph only**.
* These variables mean the same as their namesakes in [dashboards](/en/monitors/dashboards/dashboards.md#built-in-time-variables). The workbench has no dashboard variables, so any other `$` text is sent to the data source as is.

## AI query assistant

With a data source selected, click **Write with AI** at the top right of the query input. The Query Assistant uses the current data source, query type, parameters and time range to generate or rewrite the query.

* The assistant fills in the statement, parameters and query type together and runs the query once. If it chooses a different data source, the workbench switches to it.
* Click **Apply** on a result card to put that version back into the editor (without running it).

## Query history

Successful queries are saved to query history (expressions only). History is kept per data source in this browser, up to 200 entries each; you can delete entries or clear it.

## Sharing and URL state

The current data source, query, time range and query type are kept in the page address, so copying it shares your query. If the link's data source does not exist, is disabled, or you lack access, the query does not run automatically.

## Data source permissions

Only data sources you can query appear in the list. A query might report that you have no access to the data source, for example because permissions changed after you opened the page. Ask the data source's managing team or an administrator to adjust its **Managing team** and **Query-allowed teams** — see [Data source permissions (team authorization)](/en/monitors/data-sources/data-sources.md#data-source-permissions-team-authorization).

## Alert engine version requirements

Queries run on the data source's alert engine. If the cluster's alert engine version is too low or versions are mixed, the page asks you to upgrade; once every alert engine in the cluster is upgraded you can query.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.